Open Recommendations

We recommend that the Ministry implement training on the VAP process.

We recommend that the Ministry work with CDC to obtain $343,930 of VAT reimbursement from the South African Government.

We recommend that Retirement Services develop and implement additional cost effective corrective actions, aimed at the root cause(s) of improper payments, in order to further reduce the improper payments rate.

Refund $5,516,838 to the Federal Government

We recommend that the Chief Operating Officer for FSA ensure that staff involved in the contractor personnel security screening process are aware of and comply with the Directive requirements, to include any subsequent updates to the requirements, and fulfill their responsibilities for processing security screenings.

We recommend that the Chief Operating Officer for FSA develop written policies and procedures to comply with the Directive, to include explanations of the key duties to be performed by specific FSA staff, requirements of the contract positions and risk designation process including the use of Position Designation Records, and other internal requirements for the FSA contractor personnel security screening process, as well as contractor employee departure procedures.

We recommend that the Chief Operating Officer for FSA have appropriate FSA staff develop and approve complete position category listings and associated risk level designations for all contractor positions on each contract, through FSA justification of position responsibilities and access, and through reconciliation of current contract position risk levels and any available position risk level designation records.

We recommend that the Chief Operating Officer for FSA ensure that screenings are initiated at the appropriate risk level based on the contractor employee’s position risk level that was classified and approved by FSA.

We recommend that the Chief Operating Officer for FSA coordinate with OM to learn the adjudication results of current contractor employees assigned to FSA contracts to ensure that all contractor employees either have a screening initiated or have been appropriately cleared to work on Department contracts.

We recommend that the Chief Operating Officer for FSA monitor the screening status of contractor employees until final OM adjudication decisions are made.

We recommend that the Chief Operating Officer for FSA maintain all information and records required by the Directive, to include up-to-date listings of all contractor employees assigned to FSA contracts and records of OM adjudication decisions for all contractor employees assigned to FSA contracts.

We recommend that the Chief Operating Officer for FSA ensure that all contractor employee departures are reported to OM as required, and inform contractor companies on a regular basis of their responsibility to notify FSA of contractor employee departures. Also ensure that contractors provide PIV cards to the COR upon contractor employee departure, as required.

We recommend that the Chief Operating Officer for FSA identify and begin tracking all active contractor employees assigned to FSA contracts, along with their risk level and any IT access, to ensure that all contractor employees have undergone security screenings at appropriate risk levels as required by Department policy. For those who have not, take immediate action to complete the security screenings and/or deny further access to Department facilities, systems, and information until appropriate security screenings are completed or required screening information is submitted. Alert the Department CISO of the condition.

We recommend that the Chief Operating Officer for FSA determine through system security audit logs and other appropriate validation processes, if there were instances of unauthorized access to Department information and systems and report appropriately, at a minimum to the Department’s CISO.

We recommend that the Chief Operating Officer for FSA ensure that security screenings and reinvestigations are initiated within the timeframes established by the Directive.

We recommend that the Chief Operating Officer for FSA ensure that all contractor employees complete the appropriate screening steps before receiving access to IT systems or Department sensitive or Privacy Act-protected information.

We recommend that the Chief Operating Officer for FSA ensure that contractor employees review and sign applicable Rules of Behavior for IT systems they are accessing.

We recommend that the Chief Operating Officer for FSA ensure that ISSOs maintain and exercise access approval rights over any IT systems that contain or can access sensitive Department data, whether owned by the Department or by the contractor, and modify applicable contracts accordingly to reflect the FSA ISSO approval rights.

We recommend that the Chief Operating Officer for FSA ensure that any contractor employees with discontinued or rejected investigations have all access to sensitive Department information, including any IT access, discontinued until appropriate screening steps have been completed. Alert the Department CISO should this condition exist.

We recommend that the Chief Operating Officer for FSA ensure that all non-U.S. citizens, current and prospective, are permitted to work on Department contracts only after appropriate steps have been taken with regard to waiver documentation, as required by the Directive.

We recommend that the Chief Operating Officer for FSA ensure that FSA staff are aware of and have an understanding of their responsibilities and applicable policies and procedures.

We recommend that Texas work with the Centers for Medicare & Medicaid Services to determine the portion of the $1.1 million that it received for payments that exceeded providers’ billed charges should be refunded to the Federal Government.

We recommend that Texas refund $20.7 million to the Federal Government that it received for incorrectly claimed and unallowable payments.

We recommend that the Institute refund to CDC $431,458 of unallowable expenditures: $379,243 that it could not adequately support and $52,215 that it used to support non-PEPFAR activities.