Open Recommendations

Strengthen and refine the process for holding contractors accountable for remediation of control deficiencies in CNCS information systems.Pending since FY 2017

Implement all detailed recommendations in the FY 2018 FISMA Evaluation report.Pending since FY 2017

timely review and approval of SVs; and

Complete development of the probabilistic risk assessment tool and screening tool for biosolids land application scenarios.

Develop and implement a plan to obtain the additional data needed to complete risk assessments and finalize safety determinations on the 352 identified pollutants in biosolids and promulgate regulations as needed.

Publish guidance on the methods for the biosolids pathogen alternatives 3 and 4.

Issue updated and consistent guidance on biosolids fecal coliform sampling practices

Grant Thornton recommends that OPM establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that OPM ensures policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM establish a means of documenting all users who have access to systems.

Grant Thornton recommends that OPM establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Grant Thornton recommends that OPM develop interface/data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

We recommend that DHS develop and implement monitoring controls to ensure Components properly apply allocation methodologies for the Statement of Net Cost.

We recommend that DHS establish a process to ensure accounting for non-routine material transactions impacting the financial statements is appropriate.

We recommend that USSS develop and implement policies and procedures over the review of journal entries

We recommend that USSS establish new, or improve existing, policies, procedures, and related internal controls over the valuation of its pension liability to ensure: a. adequate understanding of the pension estimate; b. oversight of assumptions used in significant estimates is maintained and the validity of those assumptions is routinely evaluated; c. the annual pension checklist developed by USSS is completed; and d. the underlying census data is reviewed at least annually.

We recommend that USSS provide sufficient training to personnel responsible for accounting related activities, including the processes resulting from the system transformation and the monitoring of obligations.

We recommend that USSS design and implement controls over the preparation and review of accounting checklists.

We recommend that USCG improve and reinforce existing policies, procedures, and related internal controls to ensure that: a. journal entries and manual adjusting entries are adequately researched, supported, and reviewed before and after recording in the general ledger; b. manual adjusting entries are recorded at the transaction level in the correct underlying general ledger systems in order to generate accurate beginning balances in each system; c. design and implement control procedures to ensure that assumptions are sufficiently reviewed on a timely basis with an appropriate level of precision, and that the results of these reviews are properly documented; and d…