Open Recommendations

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

The Chief Information Officer should re-establish the Technology Retirement Office or implement a similar enterprise-wide program to identify, prioritize, and decommission legacy systems.

In coordination with the Department of Justice (Department), continue to support implementation of the Final Rule by advancing counsel and responding expediently to requests for information that are routed to the BOP from various stakeholders.

Improve or enhance its antifraud efforts for the ESG program and incorporate fraud risk
management practices that are consistent with the best practices identified in the Government
Accountability Office's A Framework for Managing Fraud Risks in Federal Programs and Chief
Financial Officers Council and Treasury Bureau of the Fiscal Services' Antifraud Playbook.

Obtain training or technical assistance as needed on the implementation of fraud risk
management practices.

Remedy $8,361 in unsupported contractor costs under Grant Number 15PJDP-22-GG-03809 DGCT.

Remedy $10,077 in unsupported other direct costs, including $7,009 under Grant Number 2020-DC-BX-0110, $895 under Grant Number 2020-AR-BX-0082, $364 under Grant Number 15PBJA-21-GG-03978 MENT, and $1,809 under Grant Number 15PJDP-22-GG-03809 DGCT.

Remedy $74,840 in unsupported matching costs under Grant Number 2020-DC-BX-0110.

Coordinate with MHMR to ensure that the matching requirement is met.

Recover COVID-19 EIDL funds provided to the two ineligible borrowers.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.

Make ERM implementation a priority by providing the ERM team the resources it needs to ensure ERM reaches maturity no later than the planned date of FY 2028, in accordance with its current ERM Implementation Plan.

Ensure as SSA is working toward reaching maturity that the ERMC is providing leadership over the ERM program and that key Circular A-123 requirements are completed. For example, key requirements should include regular evaluation of SSA’s risk appetite and risk tolerance levels and ERMC communications in support of an Agency-wide risk culture.

Implement qualitative or quantitative measures to measure, report on, and monitor the information security and SCRM performance of organizationally defined products, systems, and services provided by external providers.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missinghardware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the hardware inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missingsoftware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the software inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to review and approve theUSDS-MaxED/AidVntge and EDAWSEW MOU. Furthermore, the Department and FSA should update existingprocedures and ensure all MOUs reflect the appropriate two-year review cycle.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement a process tomonitor that PRDs are reviewed and signed prior to the security investigation.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement an automationprocess to centrally document, track, and share risk designation and screening information.

The auditors recommend that the Chief Information Officer require the Department and FSA to reinforce their process fordocumenting the authorization, review, and approval of PUAs.

The auditors recommend that the Chief Information Officer require the Department and FSA to develop enhanced monitoring controls to ensure proper internal controls mechanisms and processes are strictly enforced.

The auditors recommend that the Chief Information Officer require Departmental Principal Offices re-evaluate the use ofPIV alternates/exemptions across the organization, and modify onboarding procedures, as needed, to support a newstrategic direction which aligns with HSPD-12.

Treasury OIG should confirm the transactions noted as unsupported or ineligible expenditures within Contracts greater than or equal to $50,000, Aggregate Reporting less that $50,000, and Aggregate Payments to Individuals are recouped or reallocated to other eligible uses by Bucks County in conformity with Treasury's Guidance. Based on Bucks County's responsiveness to Treasury's OIG's requests and its ability to provide sufficient documentation, we recommend Treasury OIG determine the feasibility of conducting an audit for Contract greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to individuals. Castro also identified other matters throughout the course of…

Add the 915,534 records to the DMF

Develop a plan to add the remaining records to the Death Master File (for example, add the records 117 years after the Numident date of birth).

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to identify all instances where two different individuals’ Numident records are cross-referred and uncross-refer the records.

Review all cases where the Numident records of beneficiaries in current payment status are cross-referred to deceased individuals’ Numident records and take action to correct the records.

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to review the 2.4 million non-current payment status beneficiaries whose cross-referred Numident records contain death information, and input death information on their cross-referred record, as appropriate.

Implement controls to prevent similar errors from occurring in the future.

Review all cases where it simultaneously issues payments to beneficiaries under both cross-referred Social Security numbers and take action to correct the records. 

We recommend that the Chief Operating Officer of FSA ensure that budget requests and lifecycle cost estimates forSABER-related projects are submitted and approved according to FSA’s Management Review 1 SOP and FSA’s otherestablished policies and procedures, and that they are properly maintained.

We recommend that the Chief Operating Officer of FSA ensure that FSA Acquisition officials follow the Department’sContract Monitoring Directive, specifically pertaining to COR Appointment Memorandums, deliverable monitoring, contractpayment records, contract monitoring plans, and QASPs for the FTI SABER system contracts we reviewed.

We recommend that the Chief Operating Officer of FSA ensure that all future SABER-related contract deliverables,including the FTI Infrastructure deliverables, are clearly defined in the contracts, related modifications, or as anattachment to contracts and related modifications to ensure proper tracking, monitoring, and contractor performance.

We recommend that the Chief Operating Officer of FSA clearly define who is responsible for supervising each part of theCOR’s performance for SABER-awarded contracts and hold the contracting officers accountable for the overall monitoringof the contracts awarded by FSA, including the FTI Module, FTI SAIG, and FTI Infrastructure contracts.

We recommend that the Chief Operating Officer of FSA require that the data fields that FSA defines as primary in theSABER risk registers be completed as appropriate, and data fields in decision logs be completed.

We recommend that the Chief Operating Officer of FSA fix the technical issues to reduce data loss in SABER riskregisters and other risk registers.

FMC should develop an executable plan to meet the requirements of OMB M-21-31 and ensure the plan is properly supported.

Create an overall BIA policy, procedures, and processes or incorporate a BIA policy, procedures, and processes into its existing contingency planning documents.

Create a Template for completing BIAs consistently across the commission following NIST SP 800-34, rev. 1, Contingency Planning Guide for Federal Information Systems, Chapter 3.

Incorporate the BIAs results into its overall contingency planning efforts.

We recommend that the Chairman: (a) incorporate a specific harassment-free culture standard into the Performance Management Program and Bonus Criteria for all staff; (b) incorporate harassment prevention into the bonus criteria for managers and executives;(c) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee should serve in a supervisory or managerial capacity; and (d) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee is eligible to receive a bonus.

We recommend that the Chairman/COO develop and implement a mechanism to ensure that corrective actions used to close recommendations related to the sexual harassment prevention program are sustained.

We recommend the Director, Division of Administration, conduct a review of prior allegations to ensure that it has an accurate and complete population of sexual harassment allegations and that it has maintained all allegation records in accordance with the FDIC record retention schedule, which requires that all records be maintained for 7 years.

We recommend the Chairman consider developing and implementing Agency-wide, consistent penalties or recommended penalty ranges to be used in disciplinary actions for harassing conduct, in accordance with applicable laws and regulations, and, as necessary and appropriate, incorporate the consistent penalties and recommended penalty ranges into policy and procedures.

We recommend that the Chairman develop and implement a plan to routinely analyze the FDIC’s sexual harassment training, ensure that it is current, and measure the impact that training is having on reducing harassment and retaliation in the Agency.