Open Recommendations

We recommend the Senior Vice President, Commercial, Communications, and Customer Affairs, in conjunction with the Senior Vice President, Economic Development, develop a plan for future business arrangements with industrial customer to mitigate the risk of TVA not fully recovering infrastructure costs for the additional capacity.

We recommend the Vice President, Transmission Planning and Projects, ensure outstanding actions to mitigate the risk of future transmission cost overruns are completed and process changes documented.

Recommendation 1: EXIM’s Office of External Engagement, in coordination with the Office
of the Chairman, should establish consistent nomination processes for all award categories
that delineate roles and responsibilities.

Recommendation 2: EXIM’s Office of External Engagement, in coordination with the Office
of the Chairman, should establish criteria for selecting awardee(s) for each award category,
including special award categories.

Recommendation 3: EXIM’s Office of External Engagement, in coordination with the Chief
Risk Officer, should complete a risk profile, or assessment, to identify all potential risks to
the awards program.

Recommendation 4: EXIM’s Office of External Engagement should identify and implement
due diligence activities, as needed, to mitigate the potential risks based upon its risk profile,
such as determining when character, reputational, and transaction integrity (CRTI) reviews
or other ethical, legal, law enforcement, Office of Inspector General, or non-public source
reviews are needed.

We recommend that the Washington Office issue guidance to its regions to strengthen the LRT project selection process to formally document the information reviewed and decisions made when determining LRT project eligibility and scoring in a manner that allows for independent review.

We recommend that the Washington Office establish a plan to monitor the regions’ implementation of its April 3, 2024, guidance, which clarified that regions should solicit and consistently consider public input regionally in the ranking of IIJA projects for funding.

We recommend that the Washington Office establish a process to confirm that all tasks within an LRT project are eligible before approving the project and funding allocation.

Define in policy
a. the process that examiners should use to request access to files in the Supervision Examination System.
b. the criteria that managers and regional analysts should use to assess whether a need to know exists in accordance with the least privilege principle.
c. the requirement that regional analysts document an examiner’s need to know before granting access to supervision files in the Supervision Examination System.
d. consequences for accessing confidential supervisory information without a need to know or providing access to confidential supervisory information when a need to know does not exist.

Update the document handling directive to require supervision staff to share files by emailing Supervision Examination System links.

Develop and require training for CFPB staff involved in the examination process for the policy and guidance resulting from recommendations 1 and 2.

Update the guidance for prioritizing and scheduling examinations to reflect the current link sharing practice and to limit access to the supporting analysis to those with a need to know.

Update the guidance for managing breaches of confidential supervisory information to include expectations for
a. assessing and documenting the level of harm associated with a breach.
b. counseling, training, or taking other measures to hold CFPB staff responsible for breaches accountable, as appropriate, and documenting such actions.
c. analyzing the causes of breaches to identify trends and implement appropriate control adjustments, as necessary.

Develop required training on the updated guidance after it is implemented.

Update the CFPB’s confidential information breach response directive to
a. provide guidance for assessing the risk to institutions affected by breaches of confidential supervisory information and notifying those institutions.
b. define the roles and responsibilities for those involved in the process.

We recommend that USAID/Kenya and East Africa determine the allowability of $74,752 in ineligible questioned costs on pages 34 to 37 of the audit report and recover any amount that is unallowable.

The Veterans Health Administration chief operating officer establishes a written policy or procedure to reasonably ensure that potential conflicts of interest or appearance of partiality concerns involving VHA employees are identified and remediated before contractor presentations to Veterans Integrated Service Network or facility leaders.

The Veterans Integrated Service Network 8 director confirms that VA has initiated the process to seek recoupment of the critical skill incentive paid by VA to Ms. Skala that was attributable to a service period that she did not complete due to her retirement.

The assistant secretary for Human Resources and Administration/Operations, Security, and Preparedness directs a review to determine whether any VHA employee ranked GS‑15 or above awarded a critical skill incentive has left VA before completing their required service obligation, and, if so, whether VA has established a debt and initiated recoupment in the amount of the CSI attributable to the uncompleted period, and takes further corrective actions as warranted.

The Veterans Health Administration chief operating officer establishes a written policy or procedure to reasonably ensure that potential conflicts of interest or appearance of partiality concerns involving VHA employees are identified and remediated before contractor presentations to Veterans Integrated Service Network or facility leaders.

The Veterans Integrated Service Network 8 director confirms that VA has initiated the process to seek recoupment of the critical skill incentive paid by VA to Ms. Skala that was attributable to a service period that she did not complete due to her retirement.

The assistant secretary for Human Resources and administration/Operations, Security, and Preparedness directs a review to determine whether any VHA employee ranked GS-15 or above awarded a critical skill incentive has left VA before completing their required service obligation, and, if so, whether VA has established a debt and initiated recoupment in the amount of the CSI attributable to the uncompleted period, and takes further corrective actions as warranted.

Improve vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Implement a more effective baseline configuration process to ensure network devices are running authorized software that is configured to approved baselines and free of vulnerabilities.