Open Recommendations

We recommend that the Carrier return $45,986 to the FEHBP for the Federal group's portion of the penalties that were paid by the PBM to the Carrier for missed performance guarantees from CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $5,595 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Florida Agency for Health Care Administration resume and enhance procedures that are in accordance with Federal requirements and the State's unwinding plan to identify and disenroll enrollees who are residing and enrolled in Medicaid managed care in another State when the PHE ends.

We recommend that the Florida Agency for Health Care Administration work with CMS to consider the potential use of T-MSIS data to identify potential cases of concurrent enrollment.

We recommend that OPM request that NFC revise the CLER system platform to establish an excessive discrepancy code fail count threshold and oversee the system to hold both agency payroll offices and Carriers accountable for making progress to resolve all discrepancy codes within an established period of time.

We recommend that OPM conduct a comprehensive overview of the 2809/834 Companion Guides and 834 layouts to address dependent terminations due to tier reductions and changes to ensure all possible value combinations advise Carriers of the applicability of the 31-day EOC as required under the Standard Contract terms.

We recommend that OPM review its current and archived FEHB CLs on its website, OPM.gov, to ensure that all CLs are posted and available for Carriers and other users.

We recommend that OPM develop procedures to monitor and enforce progress towards resolution of the CLER for fail counts of 4 or higher for code 160. This includes ensuring payroll offices and Carriers are aware of and resolving the enrollment discrepancies. OPM should also consistently adjust Carrier Plan Performance Assessments for excessive discrepancy code 160 fail counts as a method of enforcing the terms of the Standard Contract.

We recommend that OPM conduct a comprehensive overview of the paper SF 2809 and the OPM 2809 Form to ensure all necessary information is reported for Carriers to process dependent terminations and determine 31-day EOC applicability as required under the Standard Contract terms.

(U) Rec. 2.a: The DoD OIG recommended that the Department of the Navy Chief Information Officer require that the authorizing official for the Navy Enterprise Resource Planning system, in coordination with the Department of the Navy Deputy Chief Information Officer for the Navy, reevaluate the authorization to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and the DoD authorization processes and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.

(U) Rec. 3: The DoD OIG recommended that the Chief Information Officer for the Air Force require that the authorizing officials for the Tailored Multitenancy Integrated Service and Cloud One systems reevaluate the authorizations to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and DoD authorization processed and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.

Determine the allowability of the questioned transactions and recover $3,546,767, if applicable.

The Chief, Appeals, should establish a process with the appropriate Business Operating Divisions (BOD) to identify, track, and update forms, letters, publications, notices, websites, and social media that still require the new IRS Independent Office of Appeals name.

Update DOL entity-wide and system-level security policies, procedures, and plans to comply with NIST SP 800-53, Rev. 5.

Implement data loss prevention tools and alerts based on the results of agencies’ data exfiltration tests.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

We recommend that the GSA Administrator, through the Federal Acquisition Service and Public Buildings Service Commissioners, and the Assistant Administrator for the Office of Administrative Services revise or issue Agency policy to ensure: the appropriate oversight of acquisition planning activities for performance- based service contracts, including the creation of a QASP that complies with applicable regulations; and contracting personnel have clear, descriptive instruction on how to monitor and enforce QASPs during contract administration to ensure compliance and improve acquisition outcomes.

We recommend that the GSA Administrator, through the Federal Acquisition Service and Public Buildings Service Commissioners, and the Assistant Administrator for the Office of Administrative implement management oversight to ensure contracting personnel comply with policies and procedures intended to ensure sufficient government oversight of contractor performance.

Perform an AHP workforce planning analysis using the minimum examination frequencies for AHP risk areas established in response to Recommendation 1 to determine current and future examination needs and address any staffing gaps identified.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, remove all unauthorized unmanaged applications from all DoD mobile devices.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, assess all unmanaged applications for operational and cybersecurity risks and remove those with unacceptable risks or without a justifiable need from users mobile devices and Component application stores.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately assess mobile device users' access to public application stores and remove access of those without a justifiable need. If unable to remove mobile device users' access, require Components to develop and implement policy that defines the acceptable use of public application stores and requires periodic assessments of mobile device users downloads to determine that all applications have a justifiable need.

(U) Rec. 2.a: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, define the acceptable use of DoD mobile devices and mobile applications for official DoD business and personal use.

(U) Rec. 2.b: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the cybersecurity and operational security risks of 1) user access to unmanaged applications without cybersecurity assessments through Component application stores or public application stores, and 2) mobile device features, including geolocation, screen capture, copy and paste, and camera, among others.