Open Recommendations

We recommend the FSA Chief Operating Officer— Ensure that the portal includes adequate descriptors of country names for those that may be confusing (e.g., North Korea).

We recommend the FSA Chief Operating Officer— Develop a more efficient process for preparing data for posting on the website.

Direct FAA to update its policies and procedures and implement corresponding controls and processes to align with the Department's new requirements for mobile device management identified in its Information Technology Implementation Memo (ITIM) 2023-009, and verify completion.

Direct FAA to develop and implement a process to identify and maintain an accurate mobile device inventory in accordance with National Institute for Standards and Technology (NIST) Special Publications 800-124, and verify completion.

Direct USMMA to update its policies and procedures and implement corresponding controls and processes to align with the Department's new requirements for mobile device management identified in its ITIM 2023-009, and verify completion.

Direct USMMA to develop and implement a process to conduct vulnerability assessments on its mobile device solution component and update the solution with the latest available patches/software updates to address specific vulnerabilities in accordance with NIST SP 800-124, and verify completion.

Develop and implement a process for the Office of the Chief Information Officer to identify and disconnect mobile and MIFI devices with zero usage (considering mission-critical exceptions) in accordance with Executive Order 13589, and verify completion. Completing this recommendation could put up to $203,884.19 to better use.

Direct FAA to update and enforce its process to identify and disconnect mobile and MIFI devices with zero usage (considering mission-critical exceptions) in accordance with Executive Order 13589, and verify completion. Completing this recommendation could put up to $422,838.60 to better use.

KPMG recommends that FAA management formally communicate to procurement system users' supervisors their responsibility to ensure that the system administrators are notified by the individual users or their supervisors when individuals separate from FAA.

KPMG recommends that FAA management provide procurement system administrators additional resources or tools, such as a reviewer checklist, to help facilitate adequate review of the procurement system New User ID Form and the annual procurement system User Recertification Request Forms prior to provisioning or recertifying user access to the procurement system, to include verifying that users are provisioned with the appropriate roles and approval thresholds.

KPMG recommends that FAA management design and implement a monitoring control to ensure procurement system administrators consistently verify that the procurement system new user and recertification forms were completed appropriately and signed by the authorized supervisor or COR for all active users prior to provisioning or recertifying user access to the procurement system.

KPMG recommends that FAA management implement measures to ensure the timely and accurate completion of the annual recertification of FAA employees with access to the service organization's payroll system, in accordance with the reporting timeline prescribed by DOT (e.g., identifying specific individuals to serve as backup control operators, modifying the annual recertification timeline, or adopting other effective measures).

KPMG recommends that FAA design and implement a procedure to identify and timely record contracting actions within the general ledger that were executed outside of the standard business process (i.e., CO authorizations documented outside of the procurement system).

KPMG recommends that FAA design and implement a procedure to periodically assess the risk associated with the final project allocations of costs incurred for project obligations with both capitalized and expensed costs, particularly when there has been a change in the scope of the project or there have been de-obligations of project funding. If management determines the risk related to the cost allocation is material, perform additional procedures to respond to the risk identified and determine if adjustments to project cost allocations are necessary.

KPMG recommends that FAA ensure that its detailed financial reporting procedures for identifying and disclosing intragovernmental lease payments are consistent with its existing SFFAS 54 accounting policy for intragovernmental leases.

KPMG recommends that FAA management enforce its existing grant monitoring control procedures, such as strengthen quarterly inactive obligation reviews and requiring regions to certify completion of their dashboard review periodically and consider prioritizing the review of potential inactive grants based on historical grantee disbursement activity.

KPMG recommends that FAA management design and implement a procedure to review Q4 IIJA grant expense activity, used in the additional IIJA accrual, for outliers in the data (e.g., journal vouchers or unusually large invoices).

KPMG recommends that FAA management analyze the reasons for the change in the calculated average billing cycle for FY 2024 and document the impact on its grant accrual methodology as part of its annual retrospective review.

KPMG recommends that FAA management design and implement a policy or procedure to ensure the consistent fund classification of IIJA grants payable and related gross costs activity.

KPMG recommends that the ESC enforce its existing policy on evidencing the review and approval of journal vouchers (e.g., evidencing review manual journal vouchers with signature and/or certified electronic timestamp).

KPMG recommends that the ESC perform procedures to validate that FAA journal vouchers it recorded during FY2024 were authorized per its policy.

KPMG recommends that the ESC design a procedure to review the impact of proposed changes to its manual journal voucher controls prior to implementation.

KPMG recommends that AFM-300 update its quarterly financial reporting checklist or similar documentation to review amounts reported as federal transfers and non-federal donations during the period and verify that the corresponding journal entries are prepared accurately.

Allmond recommended that STB management should create and enforce agency-specific written policies and procedures that specify how personnel actions should be initiated, reviewed, and submitted. These policies and procedures should specify the roles and responsibilities of Human Resources personnel relating to this process and the required elements and documentation of management's review of personnel actions prior to submission.

Allmond recommended that STB management should perform and document routine reviews on a monthly or more frequent basis to ensure that all personnel actions processed during the period were appropriately reviewed and approved by a second, authorized HR official and the information reported on the Standard Form (SF)-50 Notification of Personnel Action is accurate in all respects.