Open Recommendations

8. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to revise FirstNet Authority's Acquisition Review Board Review Process and Procedures to define what is considered a "significant modification" and to ensure results of ARB meetings are documented in compliance with FAR section 4.803.

9. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to ensure the Chief Procurement Officer provides oversight to verfy that contract modifications are sufficiently supported, justified, in compliance with the FAR, and in the best interests of the government and first responders.

Update the Bank Secrecy Act scope tasks and questions within the Modern Examination and Risk Identification Tool to ensure examiners complete and document all necessary steps during Bank Secrecy Act examinations and direct examiners to use additional external guidance such as the National Supervision Policy Manual, Examiner’s Guide, and Federal Financial Institutions Examination Council BSA/AML Manual, as needed.

Meet with the Financial Crime Enforcement Network (FinCEN), no less often than annually, to discuss the operation of the Memorandum of Understanding and to identify any issues or adjustments that may be required. Document any revised agreements and update the agency’s policies to communicate the FinCEN reporting requirements and information needed from the regions and the Office of National Examinations and Supervision.

Develop and implement an efficient process that ensures the completeness, accuracy, timeliness, and validity of information obtained from the agency’s Modern Examination and Risk Identification Tool, such as establishing reports, to meet the agency’s Bank Secrecy Act reporting objectives, including communicating information in accordance with the Memorandum of Understanding and other agreement(s) with the Financial Crimes Enforcement Network.

Revise the content of the NCUA’s Enforcement Manual to include current policies, procedures, and responsibilities for the NCUA’s formal enforcement actions and ensure its content is consistent with other agency policies. Regularly review this guidance for continued relevance and effectiveness in achieving the agency’s objectives.

We recommend that OPM issue an improper payment estimate for the Federal Employees Health Benefits Program's that will allow them to be in compliance with the four PIIA requirements for future reporting years.

We recommend that Retirement Services develop and implement additional cost-effective corrective actions, aimed at the root causes of improper payments, to further reduce the improper payments rate.

(U) Rec. A.1: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer, in coordination with the Washington Headquarters Services Director, develop, resource, and implement a records management program that includes records management training for all personnel in accordance with Federal and DoD records management requirements.

(U) Rec. A.2: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement a formal after?action review process to determine the success and effectiveness of the Defense Digital Services' engagements.

(U) Rec. A.3: The DoD OIG recommended that the Washington Headquarters Services Director ensure that each head of a Washington Headquarters Services?serviced Component has established and resourced a records and information management program within their organization in accordance with DoD policies.

(U) Rec. B.1.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are necessary to meet the mission requirements of the Defense Digital Service;

(U) Rec. B.1.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are approved for use by the DoD.

(U) Rec. B.1.c: This recommendation is Controlled Unclassified Information

(U) Rec. B.1.d: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools were acquired under terms that ensure that the DoD retains ownership of DoD data.

(U) Rec. B.2.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine the DoD Component owner, the nature, and classification of the data.

(U) Rec. B.2.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether the DoD data were and are appropriately protected in accordance with DoD cybersecurity and cloud security policies.

(U) Rec. B.2.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether any DoD data were spilled, compromised, or potentially compromised, and if so, immediately initiate mitigating and remedial actions to protect DoD information, including personally identifiable information, in accordance with DoD policies.

(U) Rec. B.3: The DoD OIG recommended that after completion of Recommendations B.1 and B.2, the Chief Digital and Artificial Intelligence Officer develop and implement a plan of actions and milestones to bring any out-of-compliance hardware, software, cloud services, networks, and other tools used by the Defense Digital Service and other Office of the Chief Digital and Artificial Intelligence Office Components into compliance with DoD policies.

(U) Rec. B.4.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the request, justification for the request, and the approval or denial from the policy's issuing DoD Component.

(U) Rec. B.4.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the Office of the Secretary of Defense's approval and notification in writing to the policy's issuing DoD Component of the approval of the waiver, if the Office of the Secretary of Defense overrides the denial of the waiver by the Office of the Secretary of Defense Principal Staff Assistant or DoD Component head…

(U) Rec. B.4.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires maintenance of the documentation created as a result of the implementation of Recommendations B.1.a and B.1.b in accordance with Federal and DoD records management requirements.

(U) Rec. B.5: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement Recommendations B.1, B.2, and B.3 for all the Chief Digital and Artificial Intelligence Office directorates.

The Mint Director ensures the Mint considers additional procedures to oversee refiners including, but not limited to, obtaining and periodically reviewing documentation from the Mint’s approved refineries, such as the LBMA-required third party audits and supporting documentation, to ensure that refineries are sourcing gold responsibly in accordance with U.S. law and the best interests of the U.S. Government.

The Mint Director ensures the Mint within 30 days of issuance of this report, develops a plan that outlines the steps and controls the Mint will implement to comply with Public Law 99-185 and Public Law 109-145 in the production of gold coins which includes a review of the Mint’s current methodology to ensure it complies with U.S. law. As part of this review, the Mint should publish its procedures for acquiring newly mined U.S. gold in the Federal Register. Furthermore, the Mint needs to update its website for accuracy and its BOAs and operating procedures to ensure that these…

Rec. 2: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness update DoD Directive 1344.10 to include a requirement for the Services and the National Guard Bureau to provide guidance and training on partisan and nonpartisan political activities to all Service members at least each presidential election year.

Review the two loans in our sample that did not receive appropriate servicing and take administrative actions if appropriate.

(U) Rec. A.1: The DoD OIG recommended that the Commander of the U.S. Army Sustainment Command revalidate the Care of Supplies in Storage requirements in Army Technical Manual 38-470 to determine whether the requirements are operationally realistic and cost effective for Army Prepositioned Stock and revise Army Technical Manual 38-470, as appropriate.

(U) Rec. A.2.a: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to take action to enforce or relieve the Army Prepositioned Stock-5 contractor of Care of Supplies in Storage requirements based on guidance from the Commander of the Army Sustainment Command's implementation of Recommendation A.1 to revalidate Army Technical Manual 38-470 requirements.

(U) Rec. A.2.b: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to update surveillance procedures to require Contracting Officer's Representatives to conduct periodic checks of the Global Combat Support System-Army to provide reasonable assurance that all pieces of Army Prepositioned Stock-5 equipment have a correct maintenance service plan listed in the system.

(U) Rec. B.2: The DoD OIG recommended that the Executive Director of the Army Contracting Command-Rock Island request the Defense Contract Audit Agency perform a review of the 50 invoices totaling $133,401,705.89 to verify whether contractor-reported direct and indirect costs were allowable, allocable, and reasonable.

We recommend that the Chief Financial Officer for the Department develop and implement procedures to ensure that thesampling populations of drawdowns are complete for the basis of calculating the improper payment and unknown paymentestimates.

We recommend that the Chief Financial Officer for the Department ensure changes made for the query design concerningthe use of three filters, are implemented in subsequent years for programs that are required to produce an improper paymentestimate.

We recommend that the Chief Financial Officer for the Department, for programs that require them, design and implementimproper payment and unknown payment sampling and estimation plans that are appropriate for the sampling of paymentsbased on accurate sampling populations and result in reliable estimates. The improper payment and unknown paymentsampling and estimation plans should also include language stating why sampling populations in Stage 1 may not matchsampling population in Stage 2 and explain the statistical impact on the estimates.

We recommend that the Chief Financial Officer for the Department implement its quality assurance checklist to ensure theproper details from the drawdown population are accurately included on the extrapolation sheet.

We recommend that the Chief Financial Officer for the Department, in conjunction with the acting Chief Financial Officer forFSA, develop sampling and estimation plans for the Pell and Direct Loan programs that will produce reliable estimates.Specifically, the plan should (a) produce appropriate and accurate confidence intervals around a statistically valid pointestimate; (b) consistent with 31 U.S.C. section 3352(c)(1)(A), produce an estimate that is otherwise appropriate using amethodology approved by the Director of OMB; or (c) consistent with OMB Circular A-123 Appendix C, Part II, B(2), include adetailed explanation as to why it is not possible to produce a statistically-valid point…

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, a DoD?wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, policies and procedures implementing the DoD-wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance, including organizational-wide tools and techniques that allow DoD Components to consistently and effectively manage risks associated with using external providers.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer determine when DoD Components should complete a privacy impact assessment for information systems and ensure that all DoD guidance, including DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance," July 14, 2015, Incorporating Change 1, August 11, 2017, and the DoD Risk Management Framework Knowledge Service guidance, aligns with that determination.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to require that officials conduct privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.e: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, such as periodic Enterprise Mission Assurance Support Service reviews, to ensure that officials complete privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 2.a: Report is Classified.

(U) Rec. 2.b: Report is Classified.

(U) Rec. 3.b: Report is Classified.

(U) Rec. 4: Report is Classified.

(U) Rec. 4: Report is Classified.

Rec. 1.a: The DoD OIG recommended that the Defense Health Agency Director, in consultation with the Defense Civilian Personnel Advisory Service develop and implement a plan to ensure a more competitive pay rate for nursing and other hard to fill medical positions in all Defense Health Agency regions.

Rec. 1.c: The DoD OIG recommended that the Defense Health Agency Director, in consultation with the Defense Civilian Personnel Advisory Service develop and implement a plan to establish qualification requirements for nursing and other hard to fill medical positions if it is determined that it would enhance the DoD's efforts to help recruit and retain health care personnel.

Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness, in consultation with the Assistant Secretary of Defense for Health Affairs and the Defense Health Agency Director determine whether the DoD needs to extend waiving the authority to apply section 3326, title 5, United States Code, for appointments made to positions in medical or health profession with the DoD under the direct hire authority and, if so, provide the extension in a subsequent memo before the authority for covered positions expires on September 30, 2025.