Open Recommendations

REDACTED

(U) Rec. 1.a: Recommendation is Classified. (2020, 2021, and 2022 High Priority)

(U) Rec. 2.b: Recommendation is Classified.

(U) Rec. 2.c: Recommendation is Classified.

(U) Rec. 3: Recommendation is Classified.

Resolve the questioned costs described in this report and ensure that appropriate incurred cost audits are conducted prior to official contract closeout.

Resolve the questioned costs described in this report and ensure that appropriate incurred cost audits are conducted prior to official contract closeout.

We recommend that CMS instruct the MACs to recover the portion of the $56,668 in identified net overpayments that are within the 4-year reopening period.

FDA should further communicate to hospitals the importance of obtaining NPS compounded drugs from outsourcing facilities

FDA should take appropriate followup action with the unregistered compounding facilities on the list that we provided

We recommend that Retirement Services develop and implement additional cost effective corrective actions, aimed at the root cause(s) of improper payments, in order to further reduce the improper payments rate.

We recommend that the Assistant Secretary for Elementary and Secondary Education require the Commissioner Nominee of the Virgin Islands DOE to finalize its monitoring and internal control plan and implement fiscal and programmatic monitoring processes for the Restart program that provide reasonable assurance that the Virgin Islands DOE will spend Restart program funds within the required 24 months and conduct effective programmatic monitoring of the Restart program.

We recommend that the Assistant Secretary for Elementary and Secondary Education require the Commissioner Nominee of the Virgin Islands DOE to update its monitoring and internal control plan once an external evaluator is contracted to include the role the external evaluator will ultimately have in assisting the Virgin Islands DOE in monitoring the Restart program and information about how the Virgin Islands DOE will oversee the contractor to ensure contract deliverables are met.

We recommend that the Assistant Secretary for Elementary and Secondary Education require the Commissioner Nominee of the Virgin Islands DOE to staff its Internal Audit Division at planned levels and develop and implement standard operating procedures to provide reasonable assurance that it will fulfill its responsibilities.

We recommend that the Assistant Secretary for Elementary and Secondary Education require the Commissioner Nominee of the Virgin Islands DOE to assess the risk of fraud in the Restart program and develop and implement control activities to prevent, detect, and respond to potential fraud.

We recommend that the Assistant Secretary for Elementary and Secondary Education require the Commissioner Nominee of the Virgin Islands DOE to develop and implement a fraud reporting mechanism and display in public places the U.S. Department of Education Office of Inspector General hotline contact information, as required by Section 9203 of the Every Student Succeeds Act.

Develop and implement controls to ensure that the data entered into PMS and IFS is accurate and consistent with CPSC policies and procedures.

Develop procedures to review applicable regulations and laws on an annual basis in order to ensure the property management policies and procedures remain accurate and complete.

Establish and implement POA&M management procedures to ensure that all identified security weaknesses, including PMS application-specific and inherited control weaknesses, are fully documented and tracked.

Establish and implement POA&M management procedures to ensure that changes to estimated completion dates should be documented and reflected in the POA&M tracker.

Estimated completion dates should be documented and reflected in the POA&M tracker.

Upon a justifiable determination of PMS’s system categorization, design and implement standard procedures for requesting and approving user access to roles and resources in PMS.

Upon completion of the risk analysis, develop and implement procedures to ensure that CPSC users do not have unmonitored conflicting access across multiple systems.

Perform and document a risk analysis to identify potential SoD conflicts within PMS.

Upon the completion of the risk analysis noted above, management should develop and implement procedures that ensure PMS users do not have sufficient access to allow the unmonitored execution of incompatible transactions.