Open Recommendations

We recommend that FSA enforce the operation of established access authorization controls and ensure all requirementsare met prior to granting access to systems.

We recommend that the Department communicate control issues and/or weaknesses through established tools andrelevant reporting lines to the appropriate parties on a timely basis to enable prompt evaluation and resolution of theissues and/or weaknesses.

We recommend that the Department evaluate, design, and implement controls to track and report all new and separatedcontractors.

We recommend that the Department ensure separated contractors are off-boarded and system personnel are notified in atimely manner to disable or remove access to IT resources.

We recommend that the Department provide training and oversight to the Department’s personnel with on/off-boardingcontrols to help ensure new/separated contractors are properly tracked.

We recommend that the Department update access review procedures to require the reviewers to verify the access listsreceived to be used in the performance and operation of the access reviews is complete and accurate and not modifiedprior to commencing the access reviews.

We recommend that the Department identify, design, and implement controls requiring a reviewer to validate thepopulation generated for review is complete and accurate.

We recommend that the Department enforce established access authorization controls and ensure all requirements aremet prior to granting system access. Formally perform and document the periodic reviews of all database user accountsin accordance with Department policy to confirm access is current, authorized, and commensurate with jobresponsibilities.

We recommend that the Department ensure the application and database server access review controls include theverification of access privileges assigned to the user accounts are commensurate with job responsibilities and follow theconcept of least privilege.

We recommend that management improve the risk assessment process at the financial statement assertion level and atthe process level to ensure FSA is appropriately defining objectives to enable the identification of risks and define risktolerances.

We recommend that management implement key monitoring controls to ensure that corrective action plans areimplemented to timely remediate control deficiencies identified. In addition, increase oversight, review, and accountabilityover the process among various offices and directorates within FSA.

(U) Rec. 1: The DoD OIG recommended that the Assistant Secretary of the Navy for Research, Development, and Acquisition, either: * delay the Milestone C decision or the Low Rate Initial Production contract until the Unmanned Carrier Aviation Program Office conducts sufficient developmental test and evaluation on a production-representative air vehicle and completes its modeling and simulation verification, validation, and accreditation reports, or * ensure the Program Office updates the MQ-25 program's risk management documentation to identify all of the risks associated with making the Milestone C decision before conducting developmental test and evaluation, assess the likelihood and potential impacts…

(U) Rec. 2: The DoD OIG recommended that the Assistant Secretary of the Navy for Research, Development, and Acquisition ensure the Unmanned Carrier Aviation Program Office updates the MQ-25 program's risk management documentation to identify all of the risks associated with experiencing further delays in receiving the MQ-25As, including the risk that the MQ-25 program misses the expected deployment dates. The updates should also assess the likelihood and potential impacts should the risks occur, as well as the applicable measures the Program Office would use to mitigate the potential impacts to mission, costs, and schedule.

(U) Rec. 3: The DoD OIG recommended that the Director of the Air Warfare Division, N98, Office of the Chief of Naval Operations, either: * delay the initial operational capability decision until the Unmanned Carrier Aviation Program Office conducts sufficient initial operational test and evaluation, or * ensure the Program Office updates the MQ-25 program's risk management documentation to identify all of the risks associated with declaring initial operational capability before conducting initial operational test and evaluation, assess the likelihood and potential impacts should the risks occur, and include the applicable measures the Program Office would use to mitigate the…

Recommendation 4 We recommend that the Retirement Services' Associate Director improve the transparency in reporting application processing times by developing a process to track and report application processing times based on healthy applications versus unhealthy applications.

Recommendation 1 We recommend that the Retirement Services' Associate Director establish quality control measures to ensure complete and accurate errors are captured and reported in the monthly Agency Audit Report.

Recommendation 5 We recommend that the Retirement Services' Associate Director prioritize and allocate additional resources to close out the open GAO recommendations.

We recommend that the Chief Financial Officer enhance existing policies to establish a formal grant accrual risk management framework to help ensure consistent standards across HUD with regard to the development, review, and execution of the grant accrual and validation.

We recommend that the Deputy Assistant Secretary for Operations of Community Planning and Development enhance CPDs existing Grant Accrual Standard Operating Procedures to strengthen governance within CPD and to effectively work within the framework established by the OCFO in recommendation 1A. The updated procedures should include increased ownership and oversight over the reviews, authorizations, approvals, and changes to the CPD grant accrual estimates and methodology.

The Railroad Retirement Board's Bureau of Information Services should review and update its policy to routinely maintain its Record Disposition Schedule to ensure all the required and necessary financial/nonfinancial data is retained, specifically for its benefit payments to allow management to support its financial activity and support its requirement to obtain an audit of the Railroad Retirement Board's financial statements.

The Railroad Retirement Board's Bureau of Information Services should review and update the entirety of the Railroad Retirement Board Records Disposition Schedule including the removal of items that are no longer relevant.

The Railroad Retirement Board's Office of Programs should, in coordination with the Bureau of Field Service, determine, develop, and document policies and procedures including end-to-end business processes for its Railroad Retirement Act annuity payments. Those procedures should include: (a) an implementation of a checklist when reviewing and accepting employee applications for benefits payments that must be signed by the appropriate preparer and reviewer; (b) requirement that all eligibility documentation is complete and accessible; and (c) the development of an in-depth guide that outlines how the Payment Rate Entitlement History (PREH) completes the benefit payment calculations.

The Railroad Retirement Board's Bureau of Fiscal Operations, Audit and Compliance Section should perform an assessment of the Railroad Retirement Board's internal control program, identify the gaps, and implement remediation actions to address the documentation, implementation, and assessment gaps identified.

The Railroad Retirement Board's Bureau of Fiscal Operations should implement a process to ensure both accounting and financial reporting processes Accounting Procedures Guides are reviewed and updated periodically to support its accounting and financial reporting processes.

The Railroad Retirement Board's Bureau of Fiscal Operations should implement a process to ensure the review and approval of Accounting Procedures Guides are properly documented with a date stamp of when the Audit Program Guides were approved along with an authorizing official's signature indicating the approval.