Open Recommendations

The Railroad Retirement Board Bureau of Fiscal Operations should develop training or reference guides for stakeholders to utilize when providingdocumentation to ensure the documentation provided meets the required needs.

The Railroad Retirement Board Bureau of Fiscal Operations should develop and communicate an enterprise-wide financial reporting timeline, which includes monthly, quarterly, and yearly deadlines.

The Railroad Retirement Board Bureau of Fiscal Operations should report a statement of no assurance given the materiality of the National Railroad Retirement Investment Trust balances reported in the Balance Sheet.

The Railroad Retirement Board Bureau of Information Services should design and implement the necessary information technology controls in the following five areas: 1. Security Management, 2. Access Controls, 3. Configuration Management, 4. Segregation of Duties, and 5. Contingency Planning.

The Railroad Retirement Board Bureau of Fiscal Operations should round financial statements and other related financial information to thousands or millions to decrease the number of mathematical errors due to rounding.

The Railroad Retirement Board Bureau of Fiscal Operations should develop and implement effective controls, including a quality assurance process, necessary to ensure: (a) accounting and reporting are in accordance with U.S. Generally Accepted Accounting Principles and financial information is presented in compliance with Office of Management and Budget Circular A-136, Financial Reporting Requirements; (b) account balances are accurate as of and through the reporting period; (c) the proper validation, review, and approval over financial reporting and Performance and Accountability Report compilation.

The Railroad Retirement Board Bureau of Fiscal Services should develop, identify, and make available the training necessary to ensure that staff obtain and update the skills necessary to ensure compliance with: (a) Federal Accounting Standards Advisory Board concepts and accounting standards; (b) Office of Management and Budget A-123; (c) Office of Management and Budget A-136; (d) Government Accountability Office disclosure checklist; (e) Treasury’s U.S. Standard General Ledger annual update.

The Railroad Retirement Board Bureau of Fiscal Operations should establish a process to maintain detailed corrective action plans for all internal control deficiencies. More specifically, in order to comply with the requirements of Office of Management and Budget A-123, Railroad Retirement Board Bureau of Fiscal Operations should: (a) Communicate corrective actions to the appropriate level of the Agency and delegateauthority for completing corrective actions to appropriate personnel. (b) Determine the resources required to correct a control deficiency. The corrective action plan must indicate the types of resources needed (e.g., additional personnel, contract support, training, etc.), including non-financial resources, such as…

The Railroad Retirement Board Bureau of Fiscal Operations should require responses to the Open Obligations Review for Current and Prior Fiscal Years Memorandum to be submitted at a time that allows the Railroad Retirement Board to meet its financial reporting deadlines as required by Office of Management and Budget A-136.

The Railroad Retirement Board Bureau of Fiscal Operations should improve its internal controls so that supporting documentation for journal entries is available for external review.

The Railroad Retirement Board Bureau of Fiscal Operations should establish internal controls to support transactions classified within the correct budget fiscal years when initially recorded so that material adjustments as part of the Government-wide Treasury Account Symbol Adjusted Trial Balance System edit process are not required.

The Railroad Retirement Board Bureau of Fiscal Operations should complete a detailed balance fluctuation analysis that is adequate to allow management to evaluate the reasonableness of balances and detect the risk of material misstatement.

The Railroad Retirement Board Bureau of Fiscal Operations should implement internal controls to ensure financial statements are carefully reviewed, approved, and validated by appropriate Railroad Retirement Board staff and account balances are accurate as of and through the reporting period.

Review the activities of the terminated employees and contractors to ensure that their accountswere not used after they separated from SBA.

Update the existing policy and implement adequate controls to ensure that the statement ofassurances provided by the program offices are adequately documented and reviewed forcompleteness and accuracy to provide a sufficient basis to support the Administrator’s statementof assurance.

Implement the defined processes for [REDACTED].

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Establish a mechanism to systematically track all configuration items that are migrated to production in order to produce a complete and accurate listing of all configuration items. Further, develop, document, implement, and enforce requirements and processes to periodically validate that all configuration items migrated to production are authorized and valid.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings, implement a process to periodically validate the settings are appropriate and ensure that proper baselines are scanned.

Develop interface / data transmission design documentation that specifies definition of responsibilities, as well as on-going system balancing requirements.