Open Recommendations

Work with CLL to develop and implement comprehensive written policies and procedures to help ensure CLL's compliance with the DOJ Grants Financial Guide and federal award requirements, including financial reporting, subaward expenditures (payroll and non-payroll), and matching costs.

Remedy $127,915 in unsupported costs for the personnel and fringe benefits charged to the subawards.

We recommend that the Health Resources and Services Administration implement policies and procedures to periodically identify and assess whether security controls are in place and operating effectively in accordance with the most current NIST SP 800-53 and remediate weak controls timely.

We recommend that the Health Resources and Services Administration update security configurations to align with the most current NIST SP 800-53 security controls.

We recommend that the Health Resources and Services Administration remediate the nine security control findings we identified.

We recommend that USAID/Mozambique determine the allowability of $745,479 in questioned costs ($130,596 ineligible, $614,883 unsupported) on pages 17 and 18 of the audit report and recover any amount that is unallowable.

(U) Rec. 3: Recommendation is Classified.

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

We recommend the FEMA Chief Security Officer develop and implement internal controls to monitor and enforce supervisors and contracting officer’s representatives’ compliance with the Access Lifecycle Management system’s offboarding process for removing IT access.

We recommend the FEMA Chief Security Officer implement a process to identify and verify that transferred personnel’s unneeded access is removed in accordance with FEMA requirements.

We recommend the FEMA Office of the Chief Information Officer implement a standardized process to conduct and monitor privileged and service account reviews in accordance with FEMA requirements.

We recommend the FEMA Office of the Chief Information Officer remove the unnecessary privileges that allowed additional users to access the sensitive security account we identified.

We recommend the FEMA Office of the Chief Information Officer implement automated tools or additional controls and policies to change service account passwords as required and prevent interactive logon.

We recommend the FEMA Office of the Chief Information Officer implement automated tools or additional controls and policies to change service account passwords as required and prevent interactive logon standards where possible or submit requests for waivers or risk acceptance to the DHS Chief Information Security Officer to forgo this setting on affected FEMA service accounts.

We recommend that OPM's Contracting Officer require the Carrier to return $11,251,490 to the FEHBP for pass-through transparent drug pricing that was not received from the PBM for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $1,228,855 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer require the Carrier to return $816,814 to the FEHBP for its portion of the PBM's non-specific drug discounts that were not received due to the Carrier's failure to move its FEHBP experience-rated group to a transparent PBM arrangement with pass-through pricing for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $100,559 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer assess the Carrier $56,697 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer require the Carrier to return $957,512 to the FEHBP for the underpayment of drug manufacturer rebates and corresponding administrative fees that were withheld by the PBM for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $90,895 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.