Open Recommendations

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to remediate the 22 vulnerabilities identified and verify that the 22 vulnerabilities identified were remediated.

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to improve network monitoring by implementing NIST SP 800-53, Revision 5, for the OPTN IT system, to include data loss prevention technology to prevent unauthorized exfiltration of information (Control SC-7(10)) and red-team exercises to simulate attempts by adversaries to compromise organizational systems (Control CA-8(2)).

We recommend that the Health Resources and Services Administration implement procedures to help ensure that the OPTN IT system contractor maintains compliance with federally required cybersecurity controls policies and standards on a continuing basis.

Update the DNA Accounting Manual to align with LSC requirements in 45 C.F.R. 1631.12(d) that prohibit giving or selling assets to DNA employees and/or Board members.

Update the current DNA Company Vehicle policy section on permissible use to:
Provide more detail on what constitutes personal use,
Clearly define commuting to/from work as personal use, and
Inform employees that the value associated with personal use will be accounted for as a fringe benefit in accordance with IRS regulations.

Implement controls to ensure that entries for transactions are adequately referenced in the general ledger, and source documents are traceable to the general ledger. Grant codes should be coded in the accounting system and included with supporting documentation.

Implement a process to ensure that only LSC-allowable expenses are allocated to LSC, in accordance with LSC requirements and guidance.

Update the DNA Accounting Manual to include procedures for obtaining LSC approvals when using more than $25,000 of LSC funds for contracts, purchases/leases of personal property, or capital improvements.

Establish and maintain a proper recordkeeping system that enables DNA to maintain contract files and perform regular backups of electronic records and systems stored offsite or in a virtual environment with easy-to-use restoration options.

Update the DNA Accounting Manual to include a section on costs that are unallowable per LSC regulations, including how to identify and address unallowable costs.

Provide training on identifying and recording unallowable costs to DNA accounting staff and any other personnel responsible for approving purchases or disbursements.

Update the DNA Accounting Manual to assign bank reconciliation duties ensuring segregation of duties so employees who initiate or transmit electronic transactions, have no access to cash, are not check signers, and have no bookkeeping duties.

Establish adequate segregation of duties to:
Ensure cash receipts procedures require that two employees open the mail, and
Ensure the cash receipts log is signed and dated by the preparer and the reviewer.

Establish adequate segregation of duties to ensure employees who take deposits to the bank:
Are not involved with opening the mail or recording cash receipts, and
Do not have access to the DNA Accounting System.

Implement procedures to ensure that bank reconciliations are signed and dated on the date the reconciliation was performed and the bank reconciliation review was performed and documented.

Discuss with the DNA Board of Directors whether DNA should maintain petty cash funds or implement a Purchase Card to replace petty cash funds.

If DNA continues using petty cash funds:
Update the DNA Accounting Manual to comply with the requirements in Section 3.2.5 of the LSC Financial Guide,
Correct its general ledger to show the accurate petty cash fund balance by office,
Eliminate the balances for closed offices,
Make outstanding replenishments and
Provide training to applicable DNA staff (Petty Cash Custodians, Petty Cash Reviewers, and DNA Accounting Personnel).

Update the DNA Accounting Manual and Employee Manual, as required, to include:
A policy prohibiting checks made payable to cash.
A local travel policy with the elements required by the LSC Financial Guide.
The LSC Financial Guide requirements for travel advances.

Implement controls to ensure that entries for transactions are adequately referenced in the general ledger, and source documents are traceable to the general ledger. Grant codes should be coded in the accounting system and included with supporting documentation.

Implement procedures to ensure that budgets are prepared and approved by the Board prior to the start of each fiscal year. Also, ensure that there is documentation of Board approval.

Ensure the budget is fully documented by location, funding source and program, as stipulated in the DNA Accounting Manual.

Castro recommends Treasury OIG follow-up with Guam's management to confirm the transactions noted as unsupported expenditures within the Direct Payments greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to Individuals can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Guam management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on the Government of Guam's responsiveness to Treasury OIG's requests and its ability to provide to provide sufficient documentation and/or replace unsupported and ineligible transactions charged…

Treasury OIG follow-up with Guam's management to 1) determine the feasibility of performing additional testing to verify if unsupported disaster relief payment errors identified were isolated errors or if it represents a systemic issue across other disaster relief payments claimed by Guam; and 2) determine the feasibility of performing additional testing on unsupported expenditures paid to hotels for quarantining to determine eligibility and reasonableness.

We recommend Treasury's Office of Capital Access should follow-up with Guam to obtain a copy of its fiscal year 2022 Single Audit report.

Treasury's Office of Capital Access to ensure that management decision letters are issued on the findings identified in the Single Audit Reports