Open Recommendations

Implement adequate controls to ensure that the Authority's information system properly tracks the completion of work orders.

Implement adequate controls to ensure that the correction of life-threatening deficiencies is reported to HUD accurately and in a timely manner.

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

Review the 1,799 PPP loans totaling over $89 million that matched a DNP data source to ensure eligibility requirements were met and seek remedy or repayment of all loans deemed ineligible.

Review the 49 PPP loans totaling approximately $3.5 million and the 43 loans totaling approximately $7.2 million to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

Review PPP loans in which the DNP hold codes were cleared to 1) identify those cleared using pre-decisional memos and 2) those cleared without sufficient evidence to support the reviewer’s loan decision and seek remedy or repayment of loans deemed ineligible.

Develop and implement controls, such as supervisory reviews, to ensure PPP loans and loans for future stimulus programs with DNP matches receive manual reviews, as required. The reviews should ensure that pre-decisional memos are not used to clear DNP hold codes and that loan files contain relevant and appropriate documentary evidence to support the loan review decisions.

Develop and implement clear guidance requiring responsible officials to maintain documentary evidence used to support loan decisions in the loan files.

Review the 59,893 PPP applications that matched a DNP data source to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

Review the additional 47,940 PPP loans totaling over $1.7 billion, identified through the DNP data match, to ensure borrowers met the eligibility requirements and seek remedy or repayment of loans deemed ineligible.

1. We recommend that the Deputy Secretary of Commerce ensure the development and ongoing maintenance of a lifecycle cost estimate and schedule for the program in accordance with the Department's Acquisition Project Management Policy (DAO-208-16) and the U.S. Government Accountability Office's (GAO) Cost Estimating and Assessment Guide and Schedule Assessment Guide.

3. We recommend that the Deputy Secretary of Commerce ensure the program defines and executes cost management controls in accordance with the Department's Acquisition Project Management Policy (DAO-208-16) and the Department of Commerce Cost Estimating Guide.

4. We recommend that the Deputy Secretary of Commerce ensure the program defines and executes schedule management controls in accordance with the Department's Acquisition Project Management Policy DAO-208-16 and GAO's Schedule Assessment Guide.

6. We recommend that the Deputy Secretary of Commerce ensure the Department facilitates the collection of lessons learned from the NOAA financial applications' implementation and incorporates those lessons into plans and procedures for the NIST and Census implementations.

We recommend that the Office of the Chief Information Officer extend the capability of its data loss prevention solution to include rule-based analysis to detect and prevent the exfiltration of sensitive data from the subject system in accordance with industry best practices.

We recommend that the Office of the Chief Information Officer regularly test the Department's data loss prevention capability to ensure that sensitive data in the subject system is protected against data exfiltration attempts.

We recommend that the Office of the Chief Information Officer evaluate data communication protocols in use by the subject system that are vulnerable to exploitation and implement controls to mitigate identified vulnerabilities.

We recommend that the Office of the Chief Information Officer ensure all existing non-Foundation Cloud Hosting Services contracts are migrated to an approved enterprisewide cloud-hosting procurement or modified to incorporate OCIO requirements and best practices for procuring cloud services, as recommended by the Chief Acquisition Officer and Chief Information Officer Councils and OCIO policy.

Conduct a review of the convalescence claims for hip and knee replacements and
resurfacing completed from February 7, 2021, through August 31, 2022, and take
appropriate actions to correct convalescence periods and ensure monetary benefits are
accurate.

BOP should reassess its policies to ensure that SHU round documentation is preserved for the possible use of such documentation as original evidence in criminal and administrative investigations and proceedings. As part of this reassessment, the BOP should, among other things, consider (1) adjusting its records retention schedule for SHU round forms; and (2) amending its policies to ensure that staff responding to crime scenes associated with inmate misconduct also collect evidence of potentially related staff misconduct, such as SHU round documentation, and account for the possible use of such evidence as original evidence in criminal and administrative investigations and…

BOP should modify its policies regarding SHU round forms, including BOP Program Statement 5500.14, Section 310, to refer employees to the document retention schedule for SHU round forms, or otherwise ensure that its employees across all institutions are aware of the retention schedule.

BOP should ensure that all Special Investigative Services Staff, Executive Management Staff, staff involved with evidence collection and preservation, and other relevant staff are trained/advised on how to preserve SHU logs and to recognize when they may be needed as original evidence in criminal or administrative investigations and proceedings, e.g., when there is an escape or death in custody and the original log may reflect who purportedly conducted round counts during the pertinent time period.

Fully implement the 90-day closeout process for National Small Business Week as outlined in SOP 90 75 5, as amended, and resolve the identified closeout discrepancy between the fiscal agent and the Office of Strategic Affairs for business week 2023.

We recommend that CPB management require the station to repay $25,179 in CSG overpayments.

We recommend that CPB management require the station to identify the corrective actions and controls it will implement to ensure future compliance with all CPB NFFS reporting requirements, specifically addressing:a) endowment revenues, andb) revenue from ineligible sources, as well as, c) documenting staff time spent on TV and radio activities.

Develop strategies to ensure that staff assign accurate, consistent, and timely Mental Health Care Level designations to inmates.

Assess the benefit and feasibility of expanding its policy requiring After Action Reviews to include reviews of all inmate homicides and deaths by accidental and unknown factors, not just for inmate suicides.

Clarify responsibility for tracking at an enterprise level the reports and recommendations required in the wake of an inmate death by suicide, homicide, accident, or unknown factors, and assess the information contained therein for broader trends, applicability, and implementation.

Evaluate existing electronic devices used for inmate screening to identify whether they are functioning as intended, and, if necessary, implement any needed adjustments or upgrades.

Ensure that all institutions conduct required mock suicide drills, and develop strategies to increase staff participation in those drills.

Ensure that all appropriate staff are trained in automated external defibrillator use and that automated external defibrillators are strategically placed, readily available, and regularly checked to ensure that they are in working order at each BOP institution.

Ensure that cut-down tools in working order are accessible to staff in each housing unit at each institution, that staff are trained on proper use of the tool, and that the BOP determines whether staff should be issued and required to keep their own cut-down tool on their duty belt during their entire shift.

Ensure that each institution has a sufficient number of maneuverable gurneys in strategic locations to provide proper medical response during inmate transport.

Issue standard, enterprise-wide guidance and training to staff on using the radio to communicate clear, descriptive information during inmate medical emergencies.

Ensure that staff receive both the initial and refresher naloxone training and are fully prepared to administer naloxone to an unresponsive inmate suspected of having experienced a drug overdose.

Ensure that all Evidence Recovery Teams are properly trained on post-incident evidence recovery protocols.

Develop procedures to ensure that all required death-related records are completed and collected consistently and in accordance with established deadlines.

Fully assess the operational condition of the chiller plant and establish a replacement plan as warranted.

Develop a plan to address and possibly replace the old and dirty air ducts. If duct replacement is not an option, develop a comprehensive cleaning schedule to address this concern.

Update or prepare schematics to reflect the current locations of all ventilation and air cleaning components.