Open Recommendations

We recommend that the GSA Chief Administrative Services update the questionable charges report to ensure the results are complete. These updates should include a higher level of detail to ensure timely resolution and response, and capture employee name changes or separations from the Agency.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require Iowa torequire Southeast Polk to ensure that LEA officials responsible for making or reviewing and approving purchases receivesufficient training on Federal rules and regulations related to grant administration and management, particularly thoseaddressing procurement process and documentation requirements.

Establish a requirement in the RPT Program Plan for recurring right-size studies for the RPT capability portfolio and use the results to reexamine workforce and capability requirements for the future.

Ensure that cost models deployed at all RPT Centers include full recovery of applicable maintenance costs for the infrastructure and facilities being utilized, similar to that being piloted at Stennis.

Formally document and establish the FM&M process in the RPT Program Plan or RPTMB Operating Procedures.

Document the results and planned RPT actions following completion of the Commercial Capability Survey.

Ensure that the appropriate revisions are made to NPR and NPD 8600.1 to clarify the authority structure.

We recommend that the Chief Information Security Officer develop and implement procedures to leverage the Repository for Software Attestation and Artifacts to obtain sufficient assurance that the security and supply chain controls of systems or services provided by contractors or other entities on behalf of the organization meet FISMA requirements.

We recommend that the Election Assistance Commission's Chief Information Officer implement EL3 logging requirements in accordance with Office of Management and Budget memorandum M-21-31.

We recommend that the Election Assistance Commission's Chief Information Officer establish and implement a formal Information Security Continuous Monitoring Strategy and an effective monitoring mechanism to track the progress of ongoing lessons learned.

We recommend that the Election Assistance Commission's Chief Information Officer identify and employ an automated notification mechanism to test its system level contingency plans thoroughly and effectively.

We recommend that the Division of Examinations: (a) Develop Broker-Dealer and Exchange examination program goals and objectives that reflect core mission areas; (b) establish Broker-Dealer and Exchange examination program performance metrics that align with established program goals and objectives and are based on recognized leading practices (that is, are outcome-based, informative, clear, and linked to agency goals and mission); and (c) develop Broker-Dealer and Exchange examination program evaluation and monitoring activities that consider performance metric data and are based on recognized leading practices (that is, activities that help drive potential change by determining whether the program is working and why).

"Conduct a comprehensive review of the following topics as part of ongoing efforts to improve the BrokerDealer and Exchange examination program, and establish appropriate corresponding corrective action(s):
a. Examination scoping practices holistically, to include the use of limited scope examinations (such
as thematic initiatives).
b. Alignment of examinations with annual priorities, industry activities, and risks identified in brokerdealer planning data.
c. Extent of asset verification performed and waivers authorized.
d. Broker-dealer examination coverage of the Financial Industry Regulatory Authority and how it
may be leveraged in program planning. "

Require that exam plans or other planning memoranda contain more detailed information about the process used to select broker-dealer examination candidates and the reason(s) for selection to help support that risk-based strategies were used.

Review and update, as appropriate, procedures and guidance relevant to asset verification and risk ratings to ensure recordkeeping in TRENDS is consistent across broker-dealer examination files, which may include incorporating reviews of this information across broker-dealer examinations.

The Chief Information Officer and the Chief, Direct File, should ensure that Direct File developers document their test plan with traceability to test types, test cases, and test results.

The Chief Human Capital Officer should create and implement a systemic fix to ensure that Section 1204 managers completing their quarterly certifications are automatically routed to the appropriate SharePoint page(s) when their responses necessitate additional information reporting about potential ROTER violations.

The Chief Human Capital Officer should perform an annual reconciliation to ensure that: 1) all Section 1204 employees assigned the yearly Section 1204 mandatory briefing are accounted for in the yearly Section 1204 population and 2) the entire Section 1204 population has been assigned the annual Section 1204 mandatory briefing.

Assess electronic health record major performance incident data needs and contractually commit to real-time data sharing that will provide greater awareness of system operations.

Develop a formal procedure for verifying performance metrics and associated credits to ensure the department receives the remedies it is due under the contract.

Update the process for prioritizing major performance incidents to ensure that notification and resolution occur in a consistent manner.

Develop effective notification and resolution metrics that consistently capture results for all major performance incidents, regardless of the owner, and enforce them.

Identify the information needed in post-resolution reports, such as corrective and preventative actions, and require the contractor to consistently collect, verify, and report that information as a contract deliverable.

Develop a plan to ensure all clinicians are familiar with the national downtime procedures.

Identify the appropriate backup system and develop a training strategy to ensure clinicians can use the system during downtime.