Open Recommendations

Work with ARC to resolve the questioned costs of $3,857 for non-ARC Matching cost share.

Revise policies and procedures to ensure the timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

Develop formal subrecipient agreement procedures to ensure that all subrecipient agreements are reviewed for completeness and include all required elements in accordance with 2 CFR 200.332 prior to execution.

Develop standardized subrecipient agreement templates that incorporate all required Uniform Guidance data elements, including Federal award identification, required disclosures, access to records provisions, and subaward closeout requirements.

The Chief, Taxpayer Services, should review procedures and system programming specific to tax compliance to ensure that initial and continuous suitability reviews function as intended.

The Chief, Taxpayer Services, should Identify individuals with either an incomplete or ineligible citizenship
status and ensure that follow-up to verify their status has been completed.

The Chief, Taxpayer Services, should review programming specific to citizenship verification and consider
including this check in continuous suitability reviews.

The Chief, Taxpayer Services, should continue to identify and request that participants who are subject to fingerprinting requirements, and are not under continuous monitoring, submit their fingerprints and are enrolled in the FBI’s Rap Back Service.

The Chief, Taxpayer Services, should establish a systemic method of identifying IRS employees during initial and continuous suitability checks.

We recommend the Chief Information Officer (CIO): Develop and implement a process to create and maintain target and current cybersecurity profiles.

We recommend the CIO: Develop and implement controls to validate information within the Cybersecurity Assessment Management tool.

We recommend DOL OIG: Implement a control to help ensure that all interconnection service agreements or related documents are reviewed in accordance with the DOL Cybersecurity Policy Portfolio.

We recommend DOL OIG: Implement a baseline deviation monitoring process for its general support
system.

We recommend the CIO: Ensure all systems comply with the Cybersecurity Policy Portfolio requirements for session timeouts.

We recommend the CIO: Ensure the adherence to DOL logical access policies and procedures.

We recommend the CIO: Establish mechanisms to ensure that logical access controls are implemented and effective.

We recommend the CIO: Design and implement a process to ensure identity and access management internal control documentation is retained to support its system of internal controls and operational needs, as required by Government Accountability Office’s Standards for Internal Control in the Federal Government.

We recommend the CIO: Develop and implement effective data exfiltration controls to ensure unauthorized data does not leave the DOL network.

Develop and communicate guidance that explains what detail should be included in a valid justification for every Veterans Benefits Management System for Rating override.

Develop and implement a plan to reestablish an overrides quality review process that provides individualized feedback for claims processors.

Develop and implement a plan to monitor the effectiveness of override reviews and continue to address areas and trends that are found to need improvement.

Identify the business need for the override review tab and, if there is one, develop and implement requirements for updating and using it.

Develop and implement a plan that addresses the limitations of the aggregate dashboard.

Take appropriate actions to monitor the collection of the remaining 11 restitutions identified in our audit and the 3 restitutions from our prior audit, as appropriate.

Review the remaining 1,440 restitutions in the restitution tracking tool and the remaining 15 restitutions reported as errors in our prior audit to determine whether the Agency is monitoring the collection of the restitution as required and take corrective actions when appropriate.