Open Recommendations

Treasury OIG follow-up with Phoenix management on the finalization of its reconciliation and reporting corrections. Based on Phoenix management’s responsiveness to Treasury OIG’s requests, and its ability to provide sufficient documentation, we recommend that Treasury OIG determine if a focused audit is feasible for Grants greater than or equal to $50,000.

Treasury OIG follow-up on necessary reporting corrections for Contracts greater than or equal to $50,000, Transfers greater than or equal to $50,000, and Aggregate Payments to Individuals.

Treasury OIG obtain documentation from Texasmanagement and follow-up on necessary reporting corrections. Further, based onTexas’ responsiveness to Treasury OIG’s requests and its ability to providesufficient documentation, we recommend Treasury OIG determine if a focusedaudit is feasible for Contracts greater than or equal to $50,000 and Grants greaterthan or equal to $50,000.

We recommend that the Indian Health Service develop and implement procedures to identify and deobligate any unused Families First Act funds that expired on September 30, 2022, from all locations within the GPAO.

We recommend that the Indian Health Service correct Purpose Statute violations totaling $19,912 relating to funds not used on COVID-19 testing and other testing-related activities from the Pine Ridge Service Unit (an IHS Direct program), and, if IHS is unable to correct those violations, report any Antideficiency Act violations.

We recommend that the Indian Health Service recover $460,525 in funds not used on COVID-19 testing and other testing-related activities from the applicable sampled Tribal and UIO programs.

We recommend that the Indian Health Service provide adequate guidance to the programs on how to track and account for funds allocated and used under the Paycheck Protection Act.

We recommend that the Indian Health Service develop and provide adequate guidance to programs within the GPAO on the proper use of Paycheck Protection Act funds in accordance with Federal requirements.

We recommend that the Indian Health Service identify and recover amounts not used for COVID-19 testing or other testing-related activities that we did not sample from remaining Tribal and UIO programs within the GPAO.

We recommend that the Indian Health Service work with Tribal and UIO programs within the GPAO that we did not sample to ensure that they have properly tracked and accounted for funds used under the Paycheck Protection Act.

We recommend that the Indian Health Service identify and correct any other Purpose Statute violations relating to funds not used on COVID-19 testing and other testing-related activities from the Families First Act and Paycheck Protection Act funds allocated to the IHS Direct programs within the GPAO, and, if IHS is unable to correct those violations, report any Antideficiency Act violations.

We recommend that the Indian Health Service strengthen its review process to ensure that modifications to ISDEAA agreements and IHCIA/FAR contracts contain complete and accurate information, including the funding source, amount awarded, and applicable language required under the funding source.

We recommend the ICE Office of the Chief Information Officer develop and implement processes to remove separated employees’ access to all ICE systems, networks, and applications in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer develop and implement a process to identify all transferred employees and ensure their user group access is reviewed and verified immediately at the end of their prior position in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer develop and implement a repeatable process to conduct and monitor privileged user and service account reviews in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer remove the unnecessary privileges that allow additional users to access the sensitive security account we identified.

We recommend the ICE Office of the Chief Information Officer submit requests for waivers or risk acceptance to the DHS Chief Information Security Officer to forgo implementing DHS’ required encryption setting on affected ICE service accounts.

We recommend the ICE Office of the Chief Information Officer develop and implement measures to ensure service account passwords are updated as required.

We recommend the ICE Office of the Chief Information Officer develop and implement measures to ensure service account passwords are updated as required.

We recommend the ICE Office of the Chief Information Officer evaluate its vulnerability management program to identify and implement automated tools to help address known vulnerabilities within required timeframes.

We recommend the FEMA Administrator take action to develop and improve the Logistics Management Directorate’s internal controls, guidance, and system integration to obtain more accurate information that enhances logistics decision making regarding the fulfillment of commodity requests during disaster response operations. At a minimum, FEMA should: a. develop internal controls to ensure appropriate information related to facility types, intermediate locations, and transportation-only orders is accurately reported in the Logistics Supply Chain Management System or an alternative integrated solution; b. update guidance and deliver training to ensure there is a clear audit trail when aggregating distribution data on FEMA-owned commodities, supplies…

We recommend the FEMA Administrator issue guidance and ensure a standardized process for collecting and maintaining documentation to confirm delivery and receipt of FEMA-owned commodities, supplies, and equipment, as well as those sourced by FEMA from partners across the Federal Government, non-governmental organizations, and the private sector to fulfill state, local, tribal, and territorial requests. At a minimum, the guidance and standardized process should: a. identify the required types of documentation to confirm delivery and receipt such as signed bills of lading, packing slips, and other forms; b. include controls to ensure the shipment documentation includes item descriptions and the…

Treasury OIG pursue obtaining documentation from Dallas management related to the Aggregate Payments to Individuals and ensure that expenditures reported are properly supported. Further, based on Dallas’ responsiveness to Treasury OIG’s requests and its ability to provide documentation, we recommend Treasury OIG determine if a focused audit on Aggregate Payments to Individuals is feasible.

Treasury OIG should pursue obtaining missing documentation from Florida management and ensure reporting corrections are made, or whether recoupment of funds is necessary. Further, based on Florida's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation, Treasury OIG should determine if a full-scope audit over Florida's use of its CRF proceeds is feasible.

San Bernardino County management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury OIG should determine if a focused audit over Grants Greater Than or Equal to $50,000 is feasible.