Open Recommendations

Establish standard, enterprisewide expectations for managing the Board’s inventory of unassigned laptops and hard drives ready for disposal. Such standardized expectations should incorporate leading practices and include inventorying, tracking, assessing missing, securing, and organizing unassigned laptops and hard drives ready for disposal, as well as time frames for tagging, inventorying, and disposing of hard drives.

Develop a monitoring program that
a. requires custodial divisions to report division-level laptop inventory information using the Board’s IT inventory management system.
b. includes procedures for the Division of IT to ensure that custodial divisions follow the standard, enterprisewide expectations.

Develop and implement training for custodial divisions on the standard, enterprisewide expectations.

Determine and clarify in the Board’s Delegations of Administrative Authority who has the oversight responsibility to manage IT equipment purchased by the divisions.

Establish and implement a process to visually confirm that hard drives are removed before surplussing the laptop shells.

Update the CSIRT Framework and Procedures. Include detailed procedures for the following areas:
a. Handling specific incident types during the Detection and Analysis phase.
b. Incident containment strategies for incident types.
c. Incident eradication activities.

Ensure that Triage Coordinators fully document key information in the incident ticket, including (1) the determination of whether or not the event is a computer security incident and (2) the steps taken for incident containment, eradication, and recovery.

Ensure tickets identified in Tables 1 and 2 are correctly categorized as “Computer Security Incident” or reclassified as “problem” tickets in the service ticketing system.

FHFA's DER Deputy Director should update the DER OPB, Sampling Practices for Examination Activity Testing, to establish key attributes of the sample population that should be documented, to include the complete or targeted population size.

FHFA's DER Deputy Director should ensure supervisors and examiners implement updates to the DER OPB, Sampling Practices for Examination Activity Testing, to include documenting key population attributes.

Rec. 1.b: The DoD OIG recommended that the Commander of the Naval Special Warfare Command develop a plan of action with milestones to implement and address all five potential solutions identified in the Operational Deficiency Report or identify and explain alternative solutions if the five potential solutions do not resolve the identified deficiencies.

FHFA’s OHRM Director should determine the allowability of the questioned reimbursement and stipend costs totaling $65,690 and take appropriate action including recoupment of funds.

FHFA’s OHRM Director should strengthen compliance with applicable policies and procedures over reimbursements and stipends through targeted training of OHRM staff responsible for initiating, reviewing, and approving payments. Training on the requirements of Policy 113, the Duty Station Policy, and other applicable guidance should reinforce the following:
a. Reimbursements must be supported by verifiable documentation of an employee’s eligible job-related expenses with required, supporting documentation;
b. Payments must not exceed reimbursement and stipend thresholds and must be accurate;
c. Stipends should be issued exclusively to employees who meet eligibility criteria; and
d. Agreements and other certifications must be properly executed…

FHFA’s OHRM Director should develop and implement standardized controls to systematically review and verify the accuracy of out-stationed employee stipend payments for consistency across the Agency.

FHFA’s OHRM Director should conduct periodic testing of controls over reimbursements and stipends to ensure payments are made in accordance with Policy 113 and other applicable guidance.

FHFA’s DBR Director should reinforce controls governing out-stationed employee stipends through periodic reminders and targeted training of officials responsible to ensure recipient eligibility, accurate payment through coordination with OHRM, as necessary, and maintenance of properly executed duty station agreements.

FHFA’s DBR Director should train DBR staff responsible for initiating, reviewing, processing, and approving stipends on the requirements of Policy 113, 2021-DBR-OPB-04, the Duty Station Policy, and any procedural updates.

FHFA’s OHRM Director should develop a centralized recordkeeping system for managing reimbursement and stipend records that allows timely and accurate retrieval of supporting documentation.

FHFA’s OHRM Director should perform periodic checks of reimbursement and stipend documents to verify that they are accurate, complete, and have been retained for the required period of time.

FHFA’s OHRM Director should provide supplemental, as-needed training to FHFA staff responsible for initiating, reviewing, and approving reimbursements and stipends on the requirements of FHFA’s Records and Information Management Policy; FHFA’s Comprehensive Records Schedule; and the National Archives and Records Administration’s General Records Schedules when retaining information and documentation created under Policy 113 and any corresponding updates. This training should complement, not replace, other mandatory training.

The Chief, Taxpayer Services, should regularly provide training to tax examiners covering credit eligibility requirements and appropriate account actions to take for ITIN holders based on the applicable tax year.

The Chief, Taxpayer Services, should review the 1,769 tax returns where the IRS allowed credits for ITIN holders
who were potentially ineligible and make associated corrections, as necessary.

The Chief, Taxpayer Services, should update PATH Act implementation guidance in Notice 2016-48 to define the issuance date of an ITIN as either the original issuance date or the renewed issuance date, if applicable, for those ITINs that have expired.

The Chief, Taxpayer Services, should update the ITIN Policy Section guidelines to require on-site reviews of high-risk CAAs to be completed periodically to ensure adequate oversight.

The Chief, Taxpayer Services, should establish a process for the ITIN Unit to regularly share its observations of potentially questionable CAA activities or patterns with the ITIN Policy Section.