Open Recommendations

The Commission conduct an information security risk assessment and develop and implement comprehensive written policies and procedures for all areas of the information security program.

The Commission develop and implement a quality review system to review and revise information security policies and procedures on an annual basis, in accordance with previously established Commission standards.

Update the Facility Security Risk Management Program Internal Operating Procedure (IOP) to include.
• Additional guidance on how to implement the Interagency Security Committee’s (ISC) Standard’s Facility Security Level (FSL) criteria.
• A process for documenting the Chief, Physical Security’s approval of the FSL.
• A requirement for supporting documentation and justification for each assigned score, including source references or observed conditions that could impact certain criteria.
• A requirement for documented justifications for any deviations from the Design Basis Threat (DBT) baseline scores identified by ISC.
• A requirement that security incident data be reviewed, analyzed, and attached as…

Develop and implement policies and procedures for centrally obtaining, tracking, and analyzing security incident reports agency-wide.

Develop and implement standard operating procedures (SOPs) that instruct CORs on the invoice approval process, to include a requirement that CORs document their reconciliation of invoices with detailed timesheets before security guard contract invoices are paid.

Recover or otherwise resolve the $158,880.29 in questioned costs from security guard vendors as a result of insufficient documentation.

Provide training on the new documentation requirements to any COR responsible for security guard contracts.

Recover or otherwise resolve the $9,093.65 in questioned costs from the security guard vendor at the Truman Presidential Library related to unallowable supply and material charges.

Provide specific guidance to CORs responsible for security guard contracts or, as appropriate, issue a contract modification which further clarifies the allowable uses for the “Additional Services” Contract Line Item Numbers (CLINs), and processes required to use available funds for other purposes.

The Executive Director ensures staff consistently label reusable medical equipment to show it is clean and ready for use.

Review the $22,504 in unsupported expenses for the contractual invoices and remedy any unallowable costs.

Ensure the Kentucky Small Business Development Center posts service hours including service center addresses on their website and have visible SBDC signage at service center locations in accordance with the terms and conditions of the award.

Ensure the Kentucky Small Business Development Center implements a process to ensure all personnel funded by federal grant funds are notified of their whistleblower protection rights in accordance with 41 U.S.C. §4712.

Review reported client counseling hours for fiscal year 2024 and correct any errors or discrepancies.

Reconcile capital infusion transaction submissions reported in the fourth quarter of fiscal year 2024 from the Kentucky Small Business Development Center’s performance data system with SBA’s data collection system to ensure capital infusion transactions are reported correctly.

We recommend the Vice President, Projects and Outages, develop a process for identifying and evaluating key assumptions of, and risks to, nonroutine projects prior to approval.

We recommend the Vice President, Projects and Outages, determine if additional steps are needed for estimates related to nuclear projects.

We recommend the Vice President, Projects and Outages, determine if the approximate $2.8 million in charges by the installation vendor were authorized.

We recommend the Vice President, Supply Chain, recover the $742,000 for unauthorized pipe fitters and any of the $2.8 million determined by Nuclear to be unauthorized.

We recommend the Senior Vice President and Chief Nuclear Officer, implement a verification process to ensure an engineering review is performed prior to placing orders for long-lead nuclear procurements.

We recommend the Senior Vice President and Chief Nuclear Officer, initiate actions to evaluate the quality of the moisture separator reheaters to determine usability.

We recommend the Senior Vice President and Chief Nuclear Officer, take steps to have quality issues and corrective actions with the Sequoyah Nuclear Plant Moisture Separator Reheater Project documented in the corrective action program.

We recommend the Senior Vice President and Chief Nuclear Officer, initiate a review to determine why the issues were not documented in the corrective action program in a timely manner.

We recommend the Vice President, Projects and Outages, coach project managers on the importance of obtaining input from appropriate personnel and only taking actions they are authorized to perform when making contracting decisions.

We recommend the Vice President, Projects and Outages, coach project managers on the importance of reviewing invoices thoroughly and obtaining input from contracting officers to identify potential unauthorized expenses before approval.

We recommend the Vice President and Controller, Corporate Accounting, develop steps to reinforce the identified areas of noncompliance with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, and TVA Standard Programs and Processes 28.300, Food Services.

We recommend the Vice President and Controller, Corporate Accounting, modify TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, to define what constitutes acceptable alcohol expenses at external relationship events.

We recommend the Vice President and Controller, Corporate Accounting, consider developing a stronger enforcement policy for individuals identified as having multiple instances of non-compliance with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events.

We recommend the Vice President and Controller, Corporate Accounting, include corporate card charges authorized by the Chief Executive Officer and his direct reports in each executive’s summary in the TVA Board of Directors in the annual Board of Directors, CEO, and Direct Reports [FY] Expense Review Summary.

We recommend the Vice President and Controller, Corporate Accounting, document expenses made by the Chief Executive Officer and his direct reports that do not comply with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, including justifications, in the annual Board of Directors, CEO, and Direct Reports [FY] Expense Review Summary.

Execute a plan to provide stable leadership at the Indianapolis Regional Processing and Distribution Center.

Staff management positions at the Indianapolis Regional Processing and Distribution Center to authorized levels.

Continue to work with local management and staff to improve employee availability at the Indianapolis Regional Processing and Distribution Center to meet the national goal.

Revise projected savings and identify opportunities to improve efficiency of operations in the Indianapolis, IN, region.

Optimize usage of mail processing equipment at the Indianapolis Regional Processing and Distribution Center, including potential redeployment of underused equipment to facilities that need additional mail processing.

Strengthen inventory controls over surface visibility scanners and evaluate implementing an automated system.

Direct the Indianapolis Regional Processing and Distribution Center Processing and Logistics managers to review daily scan data to identify problem areas and correct issues to achieve current scanning goals.

Update procedures and provide training to Contracting Officers, Oversight Managers, and Program Office personnel overseeing contracts that use service level metrics that outlines how to a) draft effective and measurable service level metrics, b) monitor contractor compliance with performance requirements and review performance data, and c) review and assess service level metrics to ensure they accurately reflect contractor performance.

Recover service level credits totaling [redacted], so that the funds can be put to better use or provide documentation to justify uncollected credits.

Ensure Contract Management Plans include the controls that will be used by key contract personnel to oversee and manage complex service contracts.

Use the e-invoicing platform to replace manual invoice processing for future Infrastructure Support Services contracts.

Require Contracting Officers, Oversight Managers, and Program Office personnel to document the methodology for service level metrics calculations on all future managed service contracts before contract award or prior to implementing credits on invoices.

Ensure that Oversight Managers upload the supporting data for invoices to the contract electronic file application and determine whether the [redacted] in questioned costs for resource unit charges are supported and allowable.

Ensure that Oversight Managers communicate to Contractor personnel their responsibilities to follow FDIC policies to safeguard data and procedures for self-reporting related incidents.

Ensure Contracting Officers and Oversight Managers have the appropriate access to review and verify that contractors complete the required Privileged User Rules of Behavior training.

Review the installed applications on all issued laptops/desktops/endpoints to ensure no unauthorized software is present and take appropriate action if unauthorized software is present.

Review the Commission’s "user" setting population to ensure each "user" is properly configured in compliance with Commission's approved Group Policy Objectives (GPO). Make the appropriate corrections to user configurations, as appropriate.

Review and update Active Directory settings and Microsoft Defender and Intune policies to ensure unauthorized software cannot be installed.

We recommend that the Grantee reimburse $6,002 to ARC for the unallowable indirect costs charged to the grant.

We recommend that the Grantee implement its procedures for reporting and reviewing expenses, prior to charging them to the grant.