Open Recommendations

The Portfolio Risk Management Office should enhance transparency in decision-making by establish a formal process for documenting rationales behind timeline changes and delays and provide public-facing updates on major transactions through a structured reporting mechanism.

The Office of General Counsel should update the Watch List procedures to include examples of risks warranting mitigating measures and what mitigating measures can be applied to parties when there is a match.

The Office of General Counsel should implement documentation requirements for actions taken as a result of Watch List matches, to include support for taking mitigating measures.

The Office of General Counsel should update the Watch List procedures to include examples of a suspicion and reputation of untrustworthy behavior and to add parties based on referrals from other agencies.

The Office of General Counsel should update the Watch List procedures to align with actual practices regarding parties EXIM determines should no longer be on the Watch List; the standards for deactivation or removal, including when there is a match to a party that should be deactivated or removed; and in the case of deactivation what the implications are for future searches and reactivation.

The Office of General Counsel, in coordination with the Office of the Chief Information Officer, should implement a process for automatically deactivating or removing parties that have been on the Watch List over 10 years without a match.

The Office of General Counsel should state and implement a requirement in the procedures and develop a process to concurrently notify OIG whenever there are new parties added to the Watch List, there are true matches on the Watch List, and there are parties removed or deactivated from the Watch List.

The Office General Counsel, in coordination with the Office of Communications, should upload the Watch List system of record notice to EXIM’s public website.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch determine the allowability of the $42,764 ineligible questioned costs on pages 25 to 37 of the audit report and recover any unallowable amount.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch Verify that Yayasan Project HOPE corrects the seven instances of material noncompliance detailed on pages 25 to 37 of the audit report.

We recommend that APHIS identify and correct the RBIS algorithm to ensure inspection due dates are properly calculated and recorded in eFile.

We recommend that APHIS establish and provide additional training on dog breeder inspections to inspectors and supervisors, to include proper classification of NCIs and required inspection procedures for dog breeders.

We recommend that APHIS develop and implement a process to ensure that inspectors are consistent throughout their inspection of the dog breeder’s facility to reduce the occurrence of missed items for review.

We recommend that APHIS establish a formal process to track and review open complaints to ensure all complaints are closed prior to the established deadlines. If the complaint is not closed by the deadline, APHIS should ensure reasons are documented in eFile.

We recommend that APHIS perform a risk assessment of the complaint process to evaluate and determine whether APHIS has correctly prioritized resources to manage the identified risks. We also recommend APHIS implement additional processes as necessary to ensure adequate coverage.

The Administrator should require all GSA personnel involved with the FBI headquarters relocation project and any future projects to review and ensure records created via text messages and chats from any device are preserved within a GSA system to comply with the Federal Records Management regulations.

The PBS Commissioner should: establish policies on developing, changing, and approving site selection plans to ensure that the criteria and any changes are sufficiently justified and supported, and establish policies and processes to ensure that the site selection data is relevant, accurate, complete, and current.

Establish a mechanism to ensure that groups with disaster recovery responsibilities prioritize and enforce the company’s strategy and effectively communicate and coordinate with each other.

For each OT system, develop, document, and implement a comprehensive disaster recovery plan that includes a process to keep the plan current.

Develop and begin implementing a technology refresh plan with milestones for replacing outdated OT devices.

Review and take appropriate actions for the 30 beneficiaries we identified who had improper payments.

Obtain accurate WC data for the 357 beneficiaries with missing or inaccurate WC information, make necessary payment adjustments, and resolve any improper payments, if necessary.

We recommend the Vice President and Chief Information and Digital Officer, Technology and Innovation, (1) design and implement a documented process for maintaining an accurate inventory of internet accessible internet protocal addresses and update Cybersecurity and Infrastructure Security Agency within five days of changes.

We recommend the Vice President and Chief Information and Digital Officer, Technology and Innovation, update patch management processes to verify known exploited vulnerabilities are patched or mitigated in accordance with policy.

Require Carrington to remedy HUD and the 27 borrowers in our sample with improper foreclosure filings and take administrative actions if appropriate.