Open Recommendations

Enhance current procedures to implement and require the retention of records to track when computer media are sanitized prior to disposal or reuse and implement procedures to validate the remediation of computer media that have failed media sanitization upon return to DOT.

In coordination with the OA system owners, strengthen DOT's oversight of the contingency planning processes to ensure contingency planning documentation is developed, updated, and tested in a timely manner, in accordance with policy.

Create and implement guidance for a QASP or QASP equivalent to use as the basis to monitor performance under medical services contracts that contains: (1) measurable performance standards to ensure desirable contract requirement outcomes including those related to quality and timeliness of care; and (2) standards for maintaining documentation related to the ratings in the QASP.

Create and implement strategies to leverage inmate healthcare utilization data that the OIG recommended to collect in 2016, which would enable the BOP to determine the cost effectiveness of alternative medical services contract structures.

Create and implement a uniform or universal billing review and approval process to: (1) ensure medical claims are properly supported and (2) improve timeliness of processing medical invoices.

Create and implement a timeline for utilizing the medical claims adjudication vendor contract awarded in December 2019 to process and ensure healthcare claims are accurate and complete

Ensure the existing SBA System Development Methodology is updated to include supply chain risk-management practices as required by OMB Circular A-130 and high-value asset system designation guidance. Also, ensure high-value asset system risks are incorporated into the enterprise risk management framework, as recommended by OMB M-19-03 and SBA SOP 90 47 6.

Communicate and enforce the SBA System Development Methodology in which a traceability matrix is used to ensure that system requirements can be tested and demonstrated in the operational system. Ensure all requirements are aligned with the contractual acceptance criteria.

Implement in updated agency guidance, the requirements of OMB Circular No. A-123 that stipulate a SOC 1 Type 2 report is needed for all new and existing financial systems. This guidance should also require confirmation at least annually that the controls are functioning as designed.

In conjunction with the Enterprise Risk Management Board, implement enterprise-wide privacy risk mitigation practices that can be assimilated into new and existing system program designs.

Complete an initial assessment and authorization for each information system and all agency-designated common controls before operation.

Transition information systems and common controls to an ongoing authorization process (when eligible for such a process) with the formal approval of the respective authorizing officials or reauthorize information systems and common controls as needed, on a time or event-driven basis in accordance with agency risk tolerance, as required by OMB Circular No. A-130 and SOP 90 47 6.

Review and update POA&Ms at least quarterly as required by SOP 90 47 6.

Implement an automated process to document and monitor system changes as recommended by NIST SP 800-53 Rev. 5.

Address the 31 POA&Ms identified as of June 21, 2022, associated with NIST SP 800-53 Rev. 5 control SI-2 (Flaw Remediation).

Review the 179 PPP loans, totaling approximately $684 million, for compliance with affiliation and size standards to ensure eligibility requirements were met and seek remedy or repayment for all loans deemed ineligible.

Seek remedy or repayment of a PPP loan in the amount of $3.5 million.

We recommend that Inter Valley Health Plan, Inc. refund to the Federal Government the $5,372,998 of estimated net overpayments.

We recommend that Inter Valley Health Plan, Inc. continue to enhance its policies and procedures to prevent, detect, and correct noncompliance with Federal requirements for diagnosis codes that are used to calculate risk-adjusted payments.

We recommend that the Department of Health and Human Services ensure that it and its components fully implement the covered agency responsibilities found in GDA section 759(a)

We recommend that the Department of Health and Human Services maintain an inventory of all geospatial data assets, per section 759(b) of the GDA; and

We recommend that CPB management recover $9,106 in CSG overpayments.

Rec. 7: The DoD OIG recommended that the Assistant Commander of Contracts, Marine Corps System Command, develop and distribute guidance requiring contracting officials to obtain and document in the acquisition plan or contract file the potential for cost-reimbursement contracts to transition to firm-fixed-price contracts to the maximum extent practicable, including the nature of cost-reimbursement contracts and the inability to transition to a firm-fixed-price contract.

Update the Enhanced Strategic Workforce Planning: Office Director and Regional Administrator Guidance to provide specific methodologies, detailed instructions, measurement criteria, and scales that can be used to estimate the anticipated level of workload change, ranking of position risk factors, and prioritization of workforce gaps or surpluses;

Update the Enhanced Strategic Workforce Planning: Office Director and Regional Administrator Guidance to incorporate attrition rates so that the NRC quantifies and considers non-retirement separations in workforce planning.