Open Recommendations

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Strengthen educational efforts to make providers aware of educational materials on how to meet Medicare requirements and guidance for psychotherapy services, including services provided via telehealth.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS work with the MACs to take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Review MAC jurisdictions' LCD requirements for psychotherapy services to identify which provisions effectively promote program integrity, and consider additional steps that CMS could undertake to ensure appropriate coverage and payment for psychotherapy services across all jurisdictions.

Establish and implement a maintenance technician workforce plan that considers factors such as average training time, training requirements, and staffing turnover for a period longer than 1 year.

Include in its quarterly review process, privileged accounts with access to cybersecurity devices such as firewalls and the SIEM tool.

Complete the risk-based selection and procurement of additional audit logging tools needed to strengthen audit logging tools, retention, and visibility to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Acquire the additional resources needed to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Complete implementation of OMB M-21-31 to achieve past due Event Logging 1 and 2 maturity levels and to meet the Event Logging 3 maturity due by August 27, 2023.

We recommend that the GSA Administrator, FAS Commissioner, and Associate Administrator of the Office of Government-wide Policy address the problems with the TDR data and usage as described in this report within 1 year of report issuance. To do so, GSA should, at a minimum: conduct a comprehensive assessment of all TDR data; verify the accuracy and completeness of all TDR data; implement a verification process to ensure that TDR data is accurate and complete when it is submitted by MAS contractors; require the contractors that are not submitting complete and accurate data to correct their data or suspend their…

Embassy Juba should submit its FY 2022 annual Statement of Assurance in accordance with Department standards.

Embassy Juba should install signage at the Consular Section’s public entrance with all information required by Department guidance.

Embassy Juba should bring its consular cashiering operations into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should bring the privacy booth into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should upgrade the booth in the West Compound Access Control to allow the consular cash register to be located there, bringing oversight of consular cashiering operations into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should bring its developmental training program into compliance with Department standards.

The Bureau of African Affairs, in coordination with the Foreign Service Institute, should evaluate and provide resources to assist with improving communication and coordination within the Management Section and with the U.S. Agency for International Development alternate service provider.

Embassy Juba, in coordination with the Bureau of Global Talent Management, should update the embassy’s local compensation plan to comply with South Sudanese labor laws.

Embassy Juba should complete all information systems security officer responsibilities, in accordance with Department standards.

Embassy Juba should implement procedures to maintain documentation for all aspects of its computer support and operations, in accordance with Department standards.

Embassy Juba should complete information technology contingency plans for the unclassified and classified networks and test the plans, in accordance with Department standards.

Embassy Juba should implement standard operating procedures to manage its mobile devices and a policy on the personal use of mobile devices, in accordance with Department standards.

Embassy Juba should develop mail screening standard operating procedures and disseminate it to local guard and mail room staff.

The Bureau of African Affairs, in coordination with the Bureau of Administration and Embassy Juba, should take appropriate action to assist the embassy with its annual inventory and reconciliation for fiscal years 2022 and 2023.

We recommend that Indian Affairs coordinate with the Division of Facilities Management and Construction and the BIA Office of Justice Services to develop and implement a plan to identify and address all critical health and safety issues at the facilities mentioned in this management advisory. This plan should include, at a minimum, specific corrective actions and associated milestones for each identified issue.

We recommend that the Board chair or a designee develop a plan for how to further enhance uniformity across the System’s financial disclosure report review process, including considering additional controls and guidance.

We recommend that the Board chair or a designee develop a process to verify the accuracy of the information on financial disclosure reports for individuals subject to the Investment and Trading Policy. As part of this effort, a. require covered individuals to provide brokerage statements to their respective ethics officer for all accounts with holdings and transactions reported on their annual financial disclosure report.b. update financial disclosure review guidance to include the use of employee-provided brokerage statements to check annual financial disclosure reports for accuracy and completeness.