Open Recommendations

We recommend that the Chief Operating Officer for FSA have appropriate FSA staff develop and approve complete position category listings and associated risk level designations for all contractor positions on each contract, through FSA justification of position responsibilities and access, and through reconciliation of current contract position risk levels and any available position risk level designation records.

We recommend that the Chief Operating Officer for FSA ensure that screenings are initiated at the appropriate risk level based on the contractor employee’s position risk level that was classified and approved by FSA.

We recommend that the Chief Operating Officer for FSA coordinate with OM to learn the adjudication results of current contractor employees assigned to FSA contracts to ensure that all contractor employees either have a screening initiated or have been appropriately cleared to work on Department contracts.

We recommend that the Chief Operating Officer for FSA monitor the screening status of contractor employees until final OM adjudication decisions are made.

We recommend that the Chief Operating Officer for FSA maintain all information and records required by the Directive, to include up-to-date listings of all contractor employees assigned to FSA contracts and records of OM adjudication decisions for all contractor employees assigned to FSA contracts.

We recommend that the Chief Operating Officer for FSA ensure that all contractor employee departures are reported to OM as required, and inform contractor companies on a regular basis of their responsibility to notify FSA of contractor employee departures. Also ensure that contractors provide PIV cards to the COR upon contractor employee departure, as required.

We recommend that the Chief Operating Officer for FSA identify and begin tracking all active contractor employees assigned to FSA contracts, along with their risk level and any IT access, to ensure that all contractor employees have undergone security screenings at appropriate risk levels as required by Department policy. For those who have not, take immediate action to complete the security screenings and/or deny further access to Department facilities, systems, and information until appropriate security screenings are completed or required screening information is submitted. Alert the Department CISO of the condition.

We recommend that the Chief Operating Officer for FSA determine through system security audit logs and other appropriate validation processes, if there were instances of unauthorized access to Department information and systems and report appropriately, at a minimum to the Department’s CISO.

We recommend that the Chief Operating Officer for FSA ensure that security screenings and reinvestigations are initiated within the timeframes established by the Directive.

We recommend that the Chief Operating Officer for FSA ensure that all contractor employees complete the appropriate screening steps before receiving access to IT systems or Department sensitive or Privacy Act-protected information.

We recommend that the Chief Operating Officer for FSA ensure that contractor employees review and sign applicable Rules of Behavior for IT systems they are accessing.

We recommend that the Chief Operating Officer for FSA ensure that ISSOs maintain and exercise access approval rights over any IT systems that contain or can access sensitive Department data, whether owned by the Department or by the contractor, and modify applicable contracts accordingly to reflect the FSA ISSO approval rights.

We recommend that the Chief Operating Officer for FSA ensure that any contractor employees with discontinued or rejected investigations have all access to sensitive Department information, including any IT access, discontinued until appropriate screening steps have been completed. Alert the Department CISO should this condition exist.

We recommend that the Chief Operating Officer for FSA ensure that all non-U.S. citizens, current and prospective, are permitted to work on Department contracts only after appropriate steps have been taken with regard to waiver documentation, as required by the Directive.

We recommend that the Chief Operating Officer for FSA ensure that FSA staff are aware of and have an understanding of their responsibilities and applicable policies and procedures.

We recommend that Texas work with the Centers for Medicare & Medicaid Services to determine the portion of the $1.1 million that it received for payments that exceeded providers’ billed charges should be refunded to the Federal Government.

We recommend that Texas refund $20.7 million to the Federal Government that it received for incorrectly claimed and unallowable payments.

We recommend that the Institute refund to CDC $431,458 of unallowable expenditures: $379,243 that it could not adequately support and $52,215 that it used to support non-PEPFAR activities.

We recommend that the Institute, work with CDC to obtain VAT reimbursement from the Government of Mozambique.

Identify error-prone MACADE inputs for overpayment adjustments and consider the cost-effectiveness of establishing user messages to alert employees of common errors before they complete their inputs.

As expeditiously as possible, the Under Secretary for Terrorism and Financial Intelligence should ensure that the Office of Intelligence and Analysis (OIA) implements a compliance monitoring program to assess whether intelligence analysts' activities are conducted in accordance with OIA authorities, and electronic searches and other queries are performed in a manner that fully protects the rights of U.S. persons.

Conduct a cost benefit analysis to determine whether tracking SSN cards would be beneficial to the Agency.

[REDACTED]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

Provide documentation to support the $811,325 in code enforcement costs (activities 591, 619, and 645), including meeting code enforcement and salary and benefit requirements,4 or repay the program from non-Federal funds.