Open Recommendations

We recommend that the Indian Health Service develop and provide adequate guidance to programs within the GPAO on the proper use of Paycheck Protection Act funds in accordance with Federal requirements.

We recommend that the Indian Health Service identify and recover amounts not used for COVID-19 testing or other testing-related activities that we did not sample from remaining Tribal and UIO programs within the GPAO.

We recommend that the Indian Health Service work with Tribal and UIO programs within the GPAO that we did not sample to ensure that they have properly tracked and accounted for funds used under the Paycheck Protection Act.

We recommend that the Indian Health Service identify and correct any other Purpose Statute violations relating to funds not used on COVID-19 testing and other testing-related activities from the Families First Act and Paycheck Protection Act funds allocated to the IHS Direct programs within the GPAO, and, if IHS is unable to correct those violations, report any Antideficiency Act violations.

We recommend that the Indian Health Service strengthen its review process to ensure that modifications to ISDEAA agreements and IHCIA/FAR contracts contain complete and accurate information, including the funding source, amount awarded, and applicable language required under the funding source.

We recommend the ICE Office of the Chief Information Officer develop and implement processes to remove separated employees’ access to all ICE systems, networks, and applications in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer develop and implement a process to identify all transferred employees and ensure their user group access is reviewed and verified immediately at the end of their prior position in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer develop and implement a repeatable process to conduct and monitor privileged user and service account reviews in accordance with DHS policy.

We recommend the ICE Office of the Chief Information Officer remove the unnecessary privileges that allow additional users to access the sensitive security account we identified.

We recommend the ICE Office of the Chief Information Officer submit requests for waivers or risk acceptance to the DHS Chief Information Security Officer to forgo implementing DHS’ required encryption setting on affected ICE service accounts.

We recommend the ICE Office of the Chief Information Officer develop and implement measures to ensure service account passwords are updated as required.

We recommend the ICE Office of the Chief Information Officer develop and implement measures to ensure service account passwords are updated as required.

We recommend the ICE Office of the Chief Information Officer evaluate its vulnerability management program to identify and implement automated tools to help address known vulnerabilities within required timeframes.

We recommend the FEMA Administrator take action to develop and improve the Logistics Management Directorate’s internal controls, guidance, and system integration to obtain more accurate information that enhances logistics decision making regarding the fulfillment of commodity requests during disaster response operations. At a minimum, FEMA should: a. develop internal controls to ensure appropriate information related to facility types, intermediate locations, and transportation-only orders is accurately reported in the Logistics Supply Chain Management System or an alternative integrated solution; b. update guidance and deliver training to ensure there is a clear audit trail when aggregating distribution data on FEMA-owned commodities, supplies…

We recommend the FEMA Administrator issue guidance and ensure a standardized process for collecting and maintaining documentation to confirm delivery and receipt of FEMA-owned commodities, supplies, and equipment, as well as those sourced by FEMA from partners across the Federal Government, non-governmental organizations, and the private sector to fulfill state, local, tribal, and territorial requests. At a minimum, the guidance and standardized process should: a. identify the required types of documentation to confirm delivery and receipt such as signed bills of lading, packing slips, and other forms; b. include controls to ensure the shipment documentation includes item descriptions and the…

Treasury OIG pursue obtaining documentation from Dallas management related to the Aggregate Payments to Individuals and ensure that expenditures reported are properly supported. Further, based on Dallas’ responsiveness to Treasury OIG’s requests and its ability to provide documentation, we recommend Treasury OIG determine if a focused audit on Aggregate Payments to Individuals is feasible.

Treasury OIG should pursue obtaining missing documentation from Florida management and ensure reporting corrections are made, or whether recoupment of funds is necessary. Further, based on Florida's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation, Treasury OIG should determine if a full-scope audit over Florida's use of its CRF proceeds is feasible.

San Bernardino County management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury OIG should determine if a focused audit over Grants Greater Than or Equal to $50,000 is feasible.

San Bernardino County management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury OIG should determine if a focused audit over Grants Greater Than or Equal to $50,000 is feasible.

San Bernardino County management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury OIG should determine if a focused audit over Direct Payments Greater Than or Equal to $50,000 is feasible.

Improve usability of the staffing assessment tool by implementing policy to address the inconsistencies with staffing data entry and review the reported data for accuracy.

We recommend that the Virginia Medicaid Department of Medical Assistance Services continue to pursue development and implementation of an automated matching and eligibility update process.

We recommend that the Virginia Medicaid Department of Medical Assistance Services identify and recover unallowable capitaiton payments, which we estimate to be at least $21,849,401, made to MCOs during our audit period on behalf of deceased enrollees.

We recommend that the Virginia Medicaid Department of Medical Assistance Services implement additional supervisory review to ensure that State agency personnel completely and accurately update the State agency's eligibility system based on information provided by the Virginia Department of Health's Office of Vital Statistics.

We recommend that the Virginia Medicaid Department of Medical Assistance Services identify and recover unallowable capitation payments made on behalf of deceased enrollees in 2018 and 2022 (the years before and after our audit period) and repay the Federal share of amounts recovered.