Open Recommendations

We recommend that Kentucky conduct FBI fingerprint checks on the five applicants and other household members identified by our audit as lacking completed checks.

STB management should review the current version of OMB Circular A-136 to independently verify that all required footnotes are included and bring any omissions to the service provider's attention so that errors or omissions can be corrected.

STB management should review the service provider's Financial Statement and Notes Review Checklist to verify that the checklist is up to date and includes all required elements per OMB and Treasury guidance and then complete the checklist independently. Alternatively, STB management should develop and complete its own review checklist based on current Treasury and OMB reporting requirements.

STB management should request its financial management service provider to:
Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or
Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the Balance Sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

Management's review and certification of the financial statements and footnotes should be clearly documented and indicate what was reviewed, when the review was performed, and who performed the review for each reporting period.

STB should perform a review of 100% of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should develop policies and procedures that include the performance of periodic reviews of employees' Official Personnel Folders to ensure that they are complete and accurate.

STB should address missing or unavailable supporting documentation with its shared service provider to ensure that document retrieval tools are available and are working properly to allow retrieval of all stored documents.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

We recommend that STB implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

KPMG recommends that FAA management design and perform procedures to consistently approve and document new or modified user account and recertification requests and timely remove separated users as required by internal policy and standards for effective internal control systems.

Implement a mechanism in order to associate hardware and software assets with application boundaries.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Ensure policies and procedures governing the provisioning and de- provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role, and role or activity assignments that may cause a segregation of duties conflict.

Establish a mechanism to systematically track all configuration items that are migrated to production in order to produce a complete and accurate listing of all configuration items. Further, develop, document, implement, and enforce requirements and processes to periodically validate that all configuration items migrated to production are authorized and valid.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings, implement a process to periodically validate the settings are appropriate and ensure that proper baselines are scanned.

Develop interface / data transmission design documentation that specifies definition of responsibilities, as well as on-going system balancing requirements.

DFC Chief Executive Officer ensure all divisions update and finalize site visit monitoring policies and procedures to align with the agency’s strategic goals.

Review all current open obligations and identify all contracts entered into without proper authorization and have the EAC and/or service provider contracting officer ratify the contracts. Ensure that the authorization is properly documented.

EXIM’s Chief Management Officer, in coordination with the Vice President for Administrative Services Division, should develop an action plan, including a cost benefit analysis, to address the EXIM headquarters turnstile access issues identified in this report.

EXIM’s Chief Management Officer, in coordination with the Vice President for Administrative Services Division, should finalize the updated EXIM Building Security Policy and ensure the final version of the revised Policy mandates EXIM employee use of the turnstiles at EXIM headquarters.

GLS should amend its procedures relating to the annual count and valuation of OM&S to include verification of unit and total costs. This should include locating or reconstructing source documentation for the total quantity on hand for each item and matching the costs entered in the system to the source documents.