Open Recommendations

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions, and privileges or activities associated with each role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM establish a means of documenting all users who have access to system.

Grant Thornton recommends that OPM establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate that the settings are appropriate.

We recommended that the State agency refund $41,188,318 to the Federal Government for cost-sharing payments for professional medical services that did not comply with Federal and State requirements.

Develop, implement, and regularly update an information security continuous monitoring strategy that includes performance measures to gauge the effectiveness of related processes and provides agencywide security status.

Classified Report. Recommendation is SSI. Topic = Validation Study

Classified Report. Recommendation is SSI. Topic = FAMS Operations

Classified Report. Recommendation is SSI. Topic = Performance measures

Implement a process to validate telework information reported to outside parties and used for internal decision-making to internal source data on a routine basis.

We recommend that the Deputy Assistant Secretary for Grant Programs develop a process to ensure that grantees properly report the addresses of assisted properties in IDIS and properly calculate and report program income from the disposition of these properties regularly.

We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Newark, NJ, field office to require Jersey City to provide documentation to show that a notice was provided to affected citizens as required or take action to advise affected citizens that they disposed of the property.

We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Newark, NJ, field office to require Jersey City to provide documentation to support the fair market value of the property at the time of disposition. If documentation cannot be provided, the grantee should be required to reimburse $503,550 to its CDBG line of credit from non-Federal funds.

We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Philadelphia, PA, field office to require Luzerne County to provide documentation to support the fair value of the property at the time of disposition. If documentation cannot be provided, the grantee should be required to reimburse $575,263 to its CDBG line of credit from non-Federal funds.

We recommend that the Deputy Assistant Secretary for Grant Programs instruct the Philadelphia, PA, field office to require Luzerne County to reclassify program income already reported to the activity ID in IDIS that generated the income, ensuring that the $798,273 in program income is properly accounted for.

We recommend that the Deputy Assistant Secretary for Grant Programs issue guidance to HUD staff and grantees to clarify the applicability of change of use requirements in cases where there is both a repayment from non-Federal funds and a voluntary grant reduction.

The Bureau of Information Services should develop and implement policies and procedures requiring records management training for new and existing employees and contractors, as well as employees with specialized records management roles and responsibilities. Ensure training for existing employees and contractors is administered annually.