Open Recommendations

CAO formally appoint a SPE and procurement officials who are authorized to approve warrants over $100,000,000 and approve warrant for construction and architectural-engineering services contracting officers.

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions, and privileges / activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM ensure termination processes (e.g., return of PIV badges and IT equipment, completion of Exist Clearance Forms and completion of exit surveys) are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow-up or evaluation of issues to the Security Operations Team for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM system owners establish a methodology to systematically track all configuration items that are migrated to production, and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy requiring mandatory security configuration settings, developed by OPM or developed by vendors or federal agencies, are implemented and settings are validated on a periodic basis to ensure appropriateness.

Grant Thornton recommends that OPM establish a means of documenting a list of users with significant information system responsibility to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that OPM perform a comprehensive review of the appropriateness of personnel with access to systems at the Agency's defined frequencies.

We recommend that Coast Guard establish new, or improve existing, policies, procedures, and related internal controls to increase training and development of existing resources to better align them to financial reporting oversight roles.

We recommend that FEMA reinstitute regularly scheduled quarterly meetings with the NFIP Standards Committee to ensure there is sufficient oversight of operations at the WYO insurance companies and its service provider.

We recommend that FEMA develop and implement policies and procedures that ensure results of reviews and audits performed over WYO insurance companies are communicated to the actuary for consideration in the calculation of the insurance liability.

We recommend that CBP establish new, or improve existing policies, procedures, and internal controls to ensure subsequent events with potential financial reporting implications are identified (e.g. through development of a look-back analysis, evaluation of specific items, and/or comparison of available data sets).

We recommend that CBP enforce existing policies, procedures, and related internal controls to ensure that the review of manual journal entries is sufficiently precise to identify errors, and that the underlying information utilized in the preparation of the entries is complete and accurate.

We recommend that CBP enforce existing policies, procedures, and controls at the port level to ensure information recorded in the system of record for seized and forfeited items is complete and accurate. In addition, improve existing controls surrounding the review of financial disclosures related to seized and forfeited narcotics to ensure proper reporting.

We recommend that CBP Attract and deploy additional skilled resources and align them to financial reporting oversight roles.

We recommend that USSS establish new, or improve existing, policies, procedures, and related internal controls to ensure the adequate understanding and oversight of assumptions used in significant estimates is maintained by USSS management and continued appropriateness of those assumptions are routinely evaluated.

We recommend that USSS employ additional resources and design and implement policies and controls to track, monitor, and report the complete population of its not in evidence counterfeit note inventory, including any note processing backlog.

We recommend that DHS develop continuous monitoring and testing of IT general controls to identify weaknesses, assess the resulting risks created by any identified IT deficiencies, and respond to those risks through implementing compensating controls.

We recommend that NPPD involve financial management personnel in the procurement of contracts for NPPD's major IUS projects to ensure they are structured to facilitate isolation of costs between development, maintenance, and research and development (i.e., capitalizable vs. expensed), at an individual asset level, in order to enhance traceability of capital costs.

We recommend that NPPD design and implement controls to appropriately track asset activity at the transaction level and ensure the timely recording of asset additions, deletions, or other adjustments.

We recommend that NPPD attract and deploy additional skilled resources to support the control environment and provide the necessary financial reporting oversight.

We recommend that USSS design and implement controls and procedures to perform reconciliations between the PP&E subledger to the general ledger and reconcile all significant differences.

We recommend that USSS adhere to established inventory policies and procedures and design and implement controls to appropriately track asset activity at the transaction level and ensure the timely recording of asset additions, deletions, or other adjustments.