Open Recommendations

We recommend that ACL develop mitigating controls and strategies to address the high and moderate risks we identified.

Issue guidelines that clearly and comprehensively address MCSAP oversight responsibilities, to include: (a) reimbursement request review steps and documentation in support of these steps, (b) expectations for program and process reviews as well as onsite monitoring, and (c) documentation and supervisory review of quarterly report monitoring.

Revise annual risk assessment guidelines to: (a) include an assessment of MCSAP-specific risks; (b) place a necessary level of emphasis on Organizational Management factors; (c) clarify how to address risk factors and Division Office flexibility to change the priority level to something other than what the tool suggests; and (d) provide steps to revise the annual risk assessment template, as needed, to reflect risk changes.

Develop and implement a process to notify FMCSA's State Programs Division of grantees that receive a medium or high priority level-from the annual risk assessment; document and maintain these risk levels in a centralized location.

Revise monitoring plan guidelines to: (a) incorporate supervisory review and approvals of monitoring plans; (b) verify plans are fully completed and include rationale for any activities not completed; and (c) update the monitoring plan template, as needed, to reflect these changes.

Revise guidelines: (a) on the impact of Commercial Vehicle Safety Plan (CVSP) goal performance for creating a clear line between the performance of CVSP goals and when to take enforcement action and (b) for CVSP goal performance tracking to urge Division Offices to document oversight of CVSP goals; identify which systems to review and how often to review them; and follow-up with the State grantee when needed.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

Take corrective actions to ensure that facilities and programs remove unauthorized sensitive information from collaborative application sites.

Expand roles and responsibilities of facility and program information system security officers and privacy officers to include the routine review of SharePoint and Teams site permissions and content.

Implement automated tools and policies, supported with training, to enable the timely and routine detection and correction of improper sharing and unauthorized content throughout VA.

Mandate standardized training for SharePoint administrators and owners to clarify and reinforce data security requirements.

Take corrective actions to ensure that facilities and programs remove unauthorized sensitive information from collaborative application sites.

Expand roles and responsibilities of facility and program information system security officers and privacy officers to include the routine review of SharePoint and Teams site permissions and content.

Implement automated tools and policies, supported with training, to enable the timely and routine detection and correction of improper sharing and unauthorized content throughout VA.

Mandate standardized training for SharePoint administrators and owners to clarify and reinforce data security requirements.

USAID/Sri Lanka verify that Safe Foundation corrects the two instances of material noncompliance detailed on pages 38 to 40 of the audit report.

USAID/Indonesia determine the allowability of $42,764 ineligible questioned costs, as detailed on pages 25 to 37 of the audit report and recover any amount that is unallowable.

USAID/Indonesia verify that Yayasan Project HOPE corrects the seven instances of material noncompliance detailed on pages 25 to 37 of the audit report.

We recommend the Senior Vice President, Grid, update configuration management processes to improve periodic reviews.

The Chief, Taxpayer Services, should ensure that taxpayers without scheduled appointments are provided an opportunity to wait for an available TAC assistor on a first-come, first-served basis.

The Chief, Taxpayer Services, should communicate clearer guidance to the public on the procedures for future extended weekday hours at the TACs, including that scheduled appointments take priority over walk-in customers.

The Chief, Taxpayer Services, should revise the IRM to require that TAC assistors use all available resources, including contacting their manager, or another assistor, before denying taxpayers service and advising them to use similar tools at home because the IRS assistor is not trained.