Open Recommendations

We recommend that the Centers for Medicare & Medicaid Services direct the appropriate Medicare contractors to determine the amount of improper payments for the claims that did not comply with Medicare requirements and, for those that are within the 4-year claim-reopening period, in accordance with CMS's policies and procedures, recover up to $888,169,038 for claims that were at risk of improper payment during our audit period.

We recommend that the Centers for Medicare & Medicaid Services direct the appropriate Medicare contractors to based upon the results of this audit, notify appropriate providers (i.e., those for whom CMS determines this audit constitutes credible information of potential overpayments) so that the providers can exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

Implement a new labor distribution system that includes features such as timekeeping, overtime and Controller-in-Charge tracking, and real-time leave balances.

Determine the workload impact of commercial space operations at air traffic facilities, and take action as needed.

Identify the specific direct tasks associated with commercial space operations, determine if they should be included in the en-route controller workload model, and if so, incorporate them in the next updated model.

Provide guidance to OAs on how to identify and assess fraud risks in their programs, including guidance on specific tools, methods, and sources for gathering information about fraud risks. This guidance should also address the leading practices for identifying and assessing the likelihood and impact of inherent fraud risks, determining fraud risk tolerance, examining the suitability of existing controls, prioritizing residual fraud risks, and documenting the program's fraud risk profile to inform managers' decisions on their responses to assessed risks.

(U) Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security revise or replace DoD Instruction O-3300.04 to reflect the transition of responsibilities from the Defense Intelligence Agency to the Under Secretary of Defense for Intelligence and Security for the management, support, and requirements of the DoD Biometrically Enabled Watch List.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 1.Ensure that BPA’s information system inventory accurately reflects the current information system environment and that reviews of the information system component inventory are documented.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 2.Develop and maintain a current security architecture for BPA’s organization that includes all necessary Federal and Department requirements.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 3.Ensure continuous monitoring of BPA’s information systems and applications to gain assurance that rquired controls are implemented, working as intended, and continue to operate at an acceptable level of risk.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 4.Develop and implement security assessment plans that establish the appropriate expectations for security control assessments and incorporate all required security controls used as part of the continuous monitoring and security authorization process.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 5.Ensure that all information systems and major applications currently in operation have complete authorization packages, including ensuring that all known issues and supporting processes, such as risk assessments, are fully and effectively addressed, and a rationale of the system categorization is appropriately documented.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 6.Ensure that POA&Ms are tracked to completion and that adequate evidence is maintained to support the correction of the identified condition.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 7.Ensure that configuration management policies and procedures are developed and effectively implemented to support management of configuration baselines and configuration changes, including ensuring that configuration baselines and settings are updated, documented, and approved at least every 6 months in accordance with site-level policies and procedures.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 8.Implement a procedure to monitor and control deviations for information system configuration settings, including, but not limited to, documenting approvals and deviations for configuration settings for BPA’s systems.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 9.Ensure that contingency plans are tested, as required, to include the ability to recover and restore information system components.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 10.Ensure that all required security controls are documented in system security plans and are implemented consistent with the system’s security categorization.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 11.Ensure effective implementation of Federal requirements relate to information input validation controls, including updating, as necessary, BPA’s system and information integrity policies and procedures to help ensure that all necessary controls are implemented.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 12.Develop and implement a role-based continency training program for information system users with assigned contingency roles and responsibilities, to include specific continuity requirements contained in BPA’s system’s contingency plans.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 13.Develop and/or update policies and procedures to facilitate an effective cybersecurity program through the implementation of security controls in accordance with Federal and Department requirements.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 14.Implement an effective oversight structure at BPA that encompasses program management activities, to include the development and implementation of continuous monitoring, risk management, and governance activities.

We recommend that the Administrator, BPA, direct personnel to: 15.Apply all necessary software patches and fixes in a timely manner and monitor patching capabilities to ensure patches and fixes are applied as intended.

We recommend that the Administrator, BPA, direct personnel to: 16.Ensure that effective web application testing processes and procedures are implemented as part of the application development and vulnerability management programs to identify and remediate known web application vulnerabilities in a timely manner.

We recommend that the Chief Information Security Officer, BPA, direct personnel to: 17.Develop and implement a role-based security training program for personnel in roles with privileged system access or other security-related responsibilities, to include ensuring training is completed prior to granting system access or initiating activities related to other responsibilities.

We recommend that the Chief Information Security Officer, BPA, direct personnel to: 18.Update existing policies to require complete and documented user access reviews for standard and privileged users on BPA’s systems and applications, at least quarterly.