Open Recommendations

Reiterate to unit management the policies for providing adequate security for all accountable items.

FHFA’s SAOP in coordination with the System Owner, should conduct a review of all current privileged user accounts in the FHFA.gov production environment to ensure that each privileged user account has documented access requests and approvals.

FHFA’s SAOP in coordination with the System Owner, should update FHFA’s FHFA.gov Customer Controls to document account management requirements for non-privileged users to include account creation and authorization procedures.

FHFA’s SAOP in coordination with the System Owner, should evaluate and implement additional FHFA.gov audit logging capabilities to ensure the FHFA.gov audit logs captures access and deactivation events for all user accounts.

Develop and implement formal written policies and procedures to ensure all subaward agreements fully comply with federal requirements, including the inclusion of the Federal Award Identification Number. These procedures should also require that subrecipients provide final written certification to the federal awarding agency or pass-through entity at the conclusion of each federal award, confirming that the project or activity was completed or that the agreed-upon level of effort was expended.

Provide staff training on these policies and procedures, and establish a process for periodic internal reviews or monitoring to verify compliance.

Establish and implement policies and procedures to ensure timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

Develop an automated process to validate the accuracy of monthly recycling reports, invoices, and checks submitted by contractors, including a process to validate supporting documentation maintained by contractors.

Provide oversight of cardboard mail transport equipment inventory to ensure processing facilities only maintain a seven-day supply, and document facilities with exceptions to the policy.

Require processing facility management to annually certify proper cardboard mail transport equipment recycling and reuse business practices are in place and employees are aware of and following these practices.

Direct Plant Managers to enforce proper cardboard mail transport equipment recycling and reuse practices.

1) Perform a cost benefit analysis for baling cardboard at all processing facilities, 2) provide balers for facilities identified to have a positive benefit, and 3) for the facilities that cannot accommodate a baler, document the approved deviations.

We recommend that USAID/Kenya and East Africa determine the allowability of $86,105 in questioned costs ($54,080 ineligible, $32,025 unsupported) on pages 20 and 26 of the audit report and recover any amount that is unallowable.

We recommend that USAID/Kenya and East Africa verify that TradeMark Africa Limited corrects the four material weaknesses in internal control detailed on pages 30 to 37 of the audit report.

We recommend that USAID/Kenya and East Africa verify that TradeMark Africa Limited corrects the one instance of material noncompliance detailed on pages 50 and 51 of the audit report.

We recommend that DRP management update policies and internal guidance to (a) require that staff document the reasons and relevant risk factors for conducting elective annual report reviews, (b) provide clear direction for scoping annual report reviews, and (c) require that staff document scoping decisions.

We recommend that DRP management coordinate with the SEC Office of the General Counsel to finalize the Sarbanes-Oxley Act of 2002 section 408(b) guidance, including a description of all six factors to be considered when selecting issuer filings for elective reviews, and finalize its interpretation of the minimum review period mandate from section 408(c) of the Act.

We recommend that DRP management consider developing a plan that prioritizes Disclosure Review Program goals and requirements in the event of significant staffing decreases and/or significant workload increases.

The OIG recommends that the Executive Director for Operations establish an assessment process to periodically assess the Reactor OpE Program.

The OIG recommends that the Executive Director for Operations update LIC-401 to include a description of the current process by which staff assess the significance of OpE information.

The OIG recommends that the Executive Director for Operations update the Staff Handbook to provide step-by-step guidance for implementing the requirements stated in the updated LIC-401.

The OIG recommends that the Executive Director for Operations include within the updated LIC-401 and Staff Handbook guidance a description of the purpose of “Instruction Sheets” as interim guidance and indicate where they are located, as needed.

The OIG recommends that the Executive Director for Operations develop, communicate, and implement policies and procedures for the EDG TRGs.

The OIG recommends that the Executive Director for Operations systematically inform EDG TRG members about their membership, update the OpE SharePoint site to show the current membership of TRGs, and record TRG evaluations in a centralized location.

The OIG recommends that the Executive Director for Operations provide and promote EDG TRG training to current members on all SharePoint sites.