Open Recommendations

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 13.Develop and/or update policies and procedures to facilitate an effective cybersecurity program through the implementation of security controls in accordance with Federal and Department requirements.

We recommend that the Administrator and Chief Executive Officer direct the Chief Administrative Officer to: 14.Implement an effective oversight structure at BPA that encompasses program management activities, to include the development and implementation of continuous monitoring, risk management, and governance activities.

We recommend that the Administrator, BPA, direct personnel to: 15.Apply all necessary software patches and fixes in a timely manner and monitor patching capabilities to ensure patches and fixes are applied as intended.

We recommend that the Administrator, BPA, direct personnel to: 16.Ensure that effective web application testing processes and procedures are implemented as part of the application development and vulnerability management programs to identify and remediate known web application vulnerabilities in a timely manner.

We recommend that the Chief Information Security Officer, BPA, direct personnel to: 17.Develop and implement a role-based security training program for personnel in roles with privileged system access or other security-related responsibilities, to include ensuring training is completed prior to granting system access or initiating activities related to other responsibilities.

The Bureau of Consular Affairs should require that the visa appointment system provided to Mission Nigeria by the Global Support Strategy vendor complies with the Department’s public service and transparency standards.

Embassy Abuja should develop and implement standard operating procedures for management of federal assistance awards to ensure compliance with Department standards.

Embassy Abuja should establish a comprehensive foreign assistance coordination and collaboration mechanism, in accordance with Department standards.

Embassy Abuja should obtain authorization from the Bureau of Overseas Buildings Operations to use shipping containers for storage and office space or dismantle and remove them in accordance with Department.

Embassy Abuja should dispose of excess expendable and nonexpendable property in accordance with Department guidelines.

Embassy Abuja should adhere to travel regulations in accordance with Department standards.

Embassy Abuja should manage the fuel and motor vehicle transportation coupon program in accordance with Department guidance.

Embassy Abuja should review its unliquidated obligations in accordance with Department standards and put up to $1.2 million to better use.

Embassy Abuja should review and revise locally employed staff position descriptions and classify them in accordance with Department standards.

Embassy Abuja should complete all information systems security officer responsibilities in accordance with Department standards.

Embassy Abuja should install emergency power-off switches inside the server rooms adjacent to each egress door, in accordance with Department standards.

We recommend that Retirement Services update their SOP to provide guidance on when exceptions to pulling a credit report would be warranted. The SOP should also discuss alternate procedures to validate income and expenses, when Retirement Services cannot obtain the credit report.

We recommend that Retirement Services ensure that they maintain sufficient documentation to support when waivers over 20 percent of the debt are approved.

We recommend that the OCFO and Retirement Services develop policies and procedures to ensure that the total (gross) amount of the overpayment(s) is reported as an improper payment, along with controls to validate the proper amount is reported.

The Chief Privacy Officer should ensure that privacy controls for cloud systems are implemented within one year from when updated FedRAMP guidance is approved and released. However, if this is not feasible, the privacy controls should be implemented following the current established continuous monitoring testing plan.

The Commissioner, Wage and Investment Division, and the Commissioner, Small Business/Self-Employed Division, should consider expanding the use of soft notices to address potentially erroneous PTC claims. These notices should provide individuals with information specific to the eligibility or reporting requirements related to the potential error the IRS identified and suggest the filing of an amended return, if an error has occurred.

The Commissioner, Wage and Investment Division, should notify the 317,418 taxpayers we identified, who potentially received less PTC than they were entitled or repaid more APTC than required, that they may qualify for additional PTC or overpaid APTC and encourage them to file an amended Tax Year 2021 return, if applicable.

The Commissioner, Wage and Investment Division, should develop processes, such as the use of courtesy letters to notify individuals of their potential eligibility, to proactively assist taxpayers who, based on available tax return and Exchange data, potentially claimed less PTC than entitled or paid more APTC than required.

Provide additional guidance and training to servicers to address common loss mitigation issues found during this audit.

Update the Save Your Home - Tips to Avoid Foreclosure brochure to include new loss mitigation options as they are introduced and require servicers to send this additional information to delinquent homeowners. This could be done as a redesign of the existing brochure or as addendums to the brochure for temporary programs.