Open Recommendations

Recommendation 1a
We recommend the Architect of the Capitol perform an independent risk assessment to identify
and evaluate potential risks within the agency’s supply chain, including risks related to cybersecurity, geopolitical factors, vendor reliability, and compliance with regulatory requirements. This assessment will allow the agency to determine whether a formal Supply Chain Risk Management program is necessary based on the agency’s unique risk profile.

Recommendation 1b
If deemed necessary based on the outcomes of the assessment performed, develop and
implement a Supply Chain Risk Management program tailored to the identified risks. This may
include implementing or enhancing appropriate controls, vendor…

Recommendation 2
We recommend that the agency work with the offices and jurisdictions to define, document, and
implement risk management processes for offices and jurisdictions to consistently identify, track,
and manage risks applicable to them.

Recommendation 3
We recommend that the agency work with the offices and jurisdictions to develop and document
risk tolerance thresholds for strategic objectives.

Reassess and clarify physical inventory requirements for equipment in medical facilities to ensure they are consistent with and meet the intent of VA Directive 7002.

Ensure that facility directors require custodial officers to regularly review nonexpendable inventory to determine whether the equipment is required and take appropriate action.

Ensure medical facility directors review inventory list compliance data to identify noncompliant services and implement a process to resolve noncompliance.

Ensure the Veterans Health Administration’s Procurement and Logistics Office, in coordination with VA’s Office of Acquisition and Logistics, regularly monitors inventory compliance data to identify and communicate with noncompliant facilities to proactively address delinquent inventories.

Require medical facilities to use a standardized report of survey dashboard to centrally report all lost, stolen, or damaged items.

Require medical facility directors to review inventory compliance and establish a process to ensure noncompliant equipment—to include equipment identified in this audit—is reported as lost, stolen, or damaged within required time frames.

Reiterate through formal communication that facilities and regional Veterans Integrated Service Networks are required to fully implement and use the Strategic Equipment Planning Guide and Enterprise Equipment Request process for equipment planning and approval and develop a system to monitor compliance and verifying facilities are using the process as required.

Ensure facilities define and assign Strategic Equipment Planning Guide and Enterprise Equipment Request user roles and responsibilities as applicable.

We recommend that OIT update policies and procedures to ensure that OIT (a) thoroughly documents and understands changes to the SEC’s mobile device management system before such changes are implemented; (b) maintains an accurate inventory of mobile devices enrolled in the SEC’s mobile device management system (including timely follow-up and removal of inactive devices); (c) reviews and escalates mobile device management system notifications involving Capstone officials’ devices; and (d) regularly obtains and, as necessary, responds to information about technical risks from vendors whose products may impact the SEC’s mobile devices.

We recommend that OIT ensure that all SEC Capstone officials’ devices were backed up at the time OIT removed the texting application from SEC devices, and (for each device) document the date OIT verified that all electronic records, including text messages, were successfully saved (as of the October 2022 Capstone initiative and with each subsequent backup). If text messages from any Capstone officials’ devices were not successfully saved, work with ORMS to determine if NARA notification is required.

We recommend that OIT update the applicable system security plan(s) to accurately reflect the mobile device management system audit events and logs that should be forwarded to the SEC’s security information and event management tool, and ensure that those logs support after-the-fact investigations of incidents.

We recommend that OIT develop procedures to periodically verify that the mobile device management system audit events and logs identified in the applicable system security plan(s) are successfully retained in the SEC’s security information and event management tool.

We recommend that OIT update policies and procedures to require OIT management’s approval of commands during troubleshooting activities that result in a factory reset of Capstone officials’ devices, and verification that appropriate device logs and forensic data have been collected and retained beforehand.

Remove the six identified deceased participants from benefit pay status and take other actions, as appropriate.

Coordinate with the OIG to periodically run DNP as needed.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that Management Systems International, Inc., corrects the one
material weakness in internal control detailed on pages 12 to 15 of the audit report.

Review Puerto Rico Department of the Family’s training and procedures for completing the Form SSA-4513 to ensure accurate reporting.

Work with the Department of Agriculture to ensure Puerto Rico Department of the Family implements internal controls over its financial reporting responsibilities for Federal funds.

FHFA's DHMG Deputy Director should review and update, as necessary, the design of all scoring templates to reflect current practices and provide clarity regarding what fields require completion.

FHFA's DHMG Deputy Director should develop and implement written review and reconciliation procedures to ensure that all scoring template evaluations are complete, accurate, and correspond to the final qualitative impact scores used to rate the Enterprises’ annual Duty to Serve performance.

FHFA's DHMG Deputy Director should revise internal written guidance for the oversight of the Enterprises’ compliance with Duty to Serve requirements to incorporate up-to-date practices that include the following:
a. Review and approval procedures for assigning and documenting scores and ratings for evaluation of the Enterprises’ Plans and performance;
b. Review and approval procedures to ensure that DHMG accurately calculates annual evaluation scores and ratings;
c. Procedures for the practice and frequency of conducting routine meetings with the Enterprises and documenting and communicating results to relevant FHFA stakeholders; and
d. Procedures for the documentation and submission of quarterly monitoring reviews…

Develop and implement an official policy and procedures for the management and implementation of the strategic partnership process.