Open Recommendations

We recommend that the Grantee reimburse $6,002 to ARC for the unallowable indirect costs charged to the grant.

We recommend that the Grantee implement its procedures for reporting and reviewing expenses, prior to charging them to the grant.

Revise the AmeriCorps Grants Accrual (IBNR & Advance) SOP, dated September 2024, and Grant Accrual Survey and Lookback Analysis Policy, dated August 15, 2024, and Record-to-Report End-to-End Narrative Version 2.0, dated March 7, 2025, to address:
a. Validating and documenting the accuracy of the grantee survey data provided in support of the grant accrual validation.
b. Procedures for identifying and documenting AmeriCorps’ internal control objective in terms of materiality risk.
c. Procedures to confirm the validation process met AmeriCorps’ internal control objective. If it does not meet the internal control objective, then determine the cause and corrective action to address…

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Develop and approve an authorization to operate for the special-purpose systems.

Include facility personnel during the security categorization process to ensure all necessary information types are considered when determining the security categorization for special-purpose systems.

Segregate the pharmacy application administrative access from individuals who are custodians of the pharmaceutical inventory.

We recommend that OJP work with the Louisiana Commission on Law Enforcement to ensure its FYs 2020, 2021, and 2022 Crime Victim State Certification Forms accurately reflect all activity and payments and take necessary steps to recover the excess awarded funds as appropriate.