Open Recommendations

The Chief IRS Human Capital Officer should finalize the processes and procedures for the quarterly monitoring of telework use.

Update the CSIRT Framework and Procedures. Include detailed procedures for the following areas:
a. Handling specific incident types during the Detection and Analysis phase.
b. Incident containment strategies for incident types.
c. Incident eradication activities.

Ensure that Triage Coordinators fully document key information in the incident ticket, including (1) the determination of whether or not the event is a computer security incident and (2) the steps taken for incident containment, eradication, and recovery.

Ensure tickets identified in Tables 1 and 2 are correctly categorized as “Computer Security Incident” or reclassified as “problem” tickets in the service ticketing system.

FHFA's DER Deputy Director should update the DER OPB, Sampling Practices for Examination Activity Testing, to establish key attributes of the sample population that should be documented, to include the complete or targeted population size.

FHFA's DER Deputy Director should ensure supervisors and examiners implement updates to the DER OPB, Sampling Practices for Examination Activity Testing, to include documenting key population attributes.

Rec. 1.b: The DoD OIG recommended that the Commander of the Naval Special Warfare Command develop a plan of action with milestones to implement and address all five potential solutions identified in the Operational Deficiency Report or identify and explain alternative solutions if the five potential solutions do not resolve the identified deficiencies.

FHFA’s OHRM Director should determine the allowability of the questioned reimbursement and stipend costs totaling $65,690 and take appropriate action including recoupment of funds.

FHFA’s OHRM Director should strengthen compliance with applicable policies and procedures over reimbursements and stipends through targeted training of OHRM staff responsible for initiating, reviewing, and approving payments. Training on the requirements of Policy 113, the Duty Station Policy, and other applicable guidance should reinforce the following:
a. Reimbursements must be supported by verifiable documentation of an employee’s eligible job-related expenses with required, supporting documentation;
b. Payments must not exceed reimbursement and stipend thresholds and must be accurate;
c. Stipends should be issued exclusively to employees who meet eligibility criteria; and
d. Agreements and other certifications must be properly executed…

FHFA’s OHRM Director should develop and implement standardized controls to systematically review and verify the accuracy of out-stationed employee stipend payments for consistency across the Agency.

FHFA’s OHRM Director should conduct periodic testing of controls over reimbursements and stipends to ensure payments are made in accordance with Policy 113 and other applicable guidance.

FHFA’s DBR Director should reinforce controls governing out-stationed employee stipends through periodic reminders and targeted training of officials responsible to ensure recipient eligibility, accurate payment through coordination with OHRM, as necessary, and maintenance of properly executed duty station agreements.

FHFA’s DBR Director should train DBR staff responsible for initiating, reviewing, processing, and approving stipends on the requirements of Policy 113, 2021-DBR-OPB-04, the Duty Station Policy, and any procedural updates.

FHFA’s OHRM Director should develop a centralized recordkeeping system for managing reimbursement and stipend records that allows timely and accurate retrieval of supporting documentation.

FHFA’s OHRM Director should perform periodic checks of reimbursement and stipend documents to verify that they are accurate, complete, and have been retained for the required period of time.

FHFA’s OHRM Director should provide supplemental, as-needed training to FHFA staff responsible for initiating, reviewing, and approving reimbursements and stipends on the requirements of FHFA’s Records and Information Management Policy; FHFA’s Comprehensive Records Schedule; and the National Archives and Records Administration’s General Records Schedules when retaining information and documentation created under Policy 113 and any corresponding updates. This training should complement, not replace, other mandatory training.

The Chief, Taxpayer Services, should regularly provide training to tax examiners covering credit eligibility requirements and appropriate account actions to take for ITIN holders based on the applicable tax year.

The Chief, Taxpayer Services, should review the 1,769 tax returns where the IRS allowed credits for ITIN holders
who were potentially ineligible and make associated corrections, as necessary.

The Chief, Taxpayer Services, should update PATH Act implementation guidance in Notice 2016-48 to define the issuance date of an ITIN as either the original issuance date or the renewed issuance date, if applicable, for those ITINs that have expired.

The Chief, Taxpayer Services, should update the ITIN Policy Section guidelines to require on-site reviews of high-risk CAAs to be completed periodically to ensure adequate oversight.

The Chief, Taxpayer Services, should establish a process for the ITIN Unit to regularly share its observations of potentially questionable CAA activities or patterns with the ITIN Policy Section.

The Chief, Taxpayer Services, should establish a process for the ITIN Policy Section to review and consider the ITIN Unit’s potentially questionable CAA referrals when selecting CAAs for compliance reviews and processing applications.

Evaluate the pre-award documents for the 13 contracts that had missing documents, which have an overall award value of more than $48.2 million in unsupported costs, and document conclusions reached, as applicable.

Establish and implement oversight controls to ensure that contract file documentation is complete and fully complies with Federal laws and regulations.

Restricted due to sensitive information.