Open Recommendations

We recommend that the Colorado Department of Health Care Policy & Financing follow up with the 20 nursing homes reviewed in this audit that demonstrated life safety, emergency preparedness, and infection control deficiencies to ensure that they have taken corrective actions.

We recommend that the Colorado Department of Health Care Policy & Financing work with CMS to develop a risk-based approach to identify nursing homes at which surveys would be conducted more frequently than once every 15 months, such as those with a history of multiple high-risk deficiencies or frequent management turnover.

We recommend that the Colorado Department of Health Care Policy & Financing work with CMS to develop standardized life safety training for nursing home staff.

We recommend that the Massachusetts Department of Public health work with CMS to develop standardized life safety training for nursing home staff.

Automate printing applicants’ responses to the earnings-test questions on the application summary SSA provides beneficiaries when they request to start receiving their Old-Age, Survivor, and Disability Insurance benefits.

Revise systems to ensure the Agency requests monthly earnings information from beneficiaries eligible for the monthly earnings test before it assesses an overpayment.

Add language to overpayment notices informing beneficiaries who are eligible for the monthly earnings test their overpayment may be reduced or eliminated if they had monthly wages below the applicable limit.

Expand controls to detect potential underpayments based on discrepancies between the Master Beneficiary Record and Master Earnings File.

Implement systems changes to automatically grant earnings-test-related monthly benefit increases at, or closer to, the date they are first allowed by policy.

Correct the remaining error cases from the sample reviews.

SNL management develops a process to accurately identify, assess, and approve Controlled Articles before these items are allowed into security areas;

SNL policies addressing Controlled Articles do not allow SNL management to grant exceptions to processes that require approval from the ODFSA;

SFO’s approved guidance regarding Controlled Articles at SNL is up to date, aligns with current Department policies, and meets the approval of the ODFSA;

SNL determines if an Incident of Security Concern occurred and takes appropriate action.

SNL management develops a process to accurately identify, assess, and approve Controlled Articles before these items are allowed into security areas;

SNL policies addressing Controlled Articles do not allow SNL management to grant exceptions to processes that require approval from the ODFSA;

SFO’s approved guidance regarding Controlled Articles at SNL is up to date, aligns with current Department policies, and meets the approval of the ODFSA; and

SNL determines if an Incident of Security Concern occurred and takes appropriate action.

(U) Rec. 1.a.1: This recommendation is Controlled Unclassified Information

(U) Rec. 1.a.2: This recommendation is Controlled Unclassified Information

(U) Rec. 1.b: This recommendation is Controlled Unclassified Information

(U) Rec. 1.c: This recommendation is Controlled Unclassified Information

(U) Rec. 1.d: This recommendation is Controlled Unclassified Information

We recommend that the FWS require the Department to analyze and provide justification regarding the allowability of investment of license revenue by the New York State Office of the State Comptroller.

We recommend that the FWS require the Department to resolve any potential diversion of license revenue.

Resolve the $72,578 in questioned indirect costs for which MSU has not agreed to reimburse NSF and direct MSU to repay or otherwise remove the sustained questioned costs from its NSF awards.

Resolve the $9,702 in questioned inadequately supported lodging expenses for which MSU has not agreed to reimburse NSF and direct MSU to repay or otherwise remove the sustained questioned costs from its NSF awards.

Develop and implement an IT modernization plan. This plan should:i. document an inventory of all legacy systems in operation at the CPSCii. identify the cost associated with the operations and maintenance of thelegacy systems in operation in the current environment at the CPSCiii. identify the resources necessary to modernize each CPSC legacy system(e.g., migrating to a Commercial-Off-The-Shelf solution or shared servicessolution, moving to a cloud environment, etc.)iv. analyze potential opportunities to save money, improve operations, andimprove security through modernizing the CPSC’s legacy systems

Develop and establish a process to monitor the implementation of the IT modernizationplan by documenting the objectives, goals, tasks, milestones, metrics, and funding sourcesassociated with management’s modernization efforts.

Establish and implement a policy and procedure to manage the cloud computing, sharedservices, and third-party system inventory necessary for transitioning to a consumptionbasedservice model.

The CPSC should develop and implement policies and procedures to periodically reviewsecurity packages from external service providers (such as those hosting cloud, sharedservices, and third-party systems) to ensure that the risks posed by the external serviceprovider are within the CPSC’s risk appetite and tolerance.

The CPSC should review the external service provider’s customer responsibility matrices,select, tailor, implement the relevant security controls from those matrices and thendocument (and periodically reassess) those controls to support the ongoing authorizationto operate and use decision.

Software that is no longer supported or receiving regular security updates from the vendor should be upgraded to supported versions with relevant security patches.

KPMG recommends that FAA management require privileged users on the Windows virtual machine environment to authenticate using MFA. If it is not technically feasible, then we recommend that Windows security settings are updated to require a minimum password length for privileged accounts to 16 characters and maximum password age to be updated to 60 days.

KPMG recommends that FAA management design and implement documented control activities to monitor the effective operation of its existing process controls related to:
Provisioning of new access requests for the service organization's system; and
Monitoring FAA employees' access to the service organization's system.

KPMG recommends that FAA management take measures to ensure that FAA has sufficient control operator personnel available to support the annual recertification of FAA employees with system access within the reporting timeline prescribed by DOT.

KPMG recommends that FAA design and implement a procedure to identify and timely record contracting actions within the general ledger that were executed outside of the standard business process (i.e., CO authorizations documented outside of the procurement system).

KPMG recommends that FAA update its procurement policy to define the period of time permitted to document a contractor's oral agreement.

KPMG recommends that FAA reinforce existing controls, to review individual lease payment schedules upon lease commencement or modification to ensure that the schedules are consistent with the underlying terms of the lease.

KPMG recommends that FAA design and implement procedures within its existing PP&E Accrual to obtain a complete listing of trailing costs related to completed assets and accrue for such assets that have remaining CIP balances as of the period-end.

KPMG recommends that management design and implement procedures to verify the completeness and accuracy of the non-LOI accrual average billing cycle data input used in the estimate calculation.

KPMG recommends that ESC management review and update the journal voucher control log reconciliation process to ensure it is properly designed to identify all potential deviations from policy throughout the fiscal year.

KPMG recommends that ESC management create monitoring procedures over the journal voucher control log to ensure complete and accurate documentation over manual journal vouchers is maintained.

KPMG recommends that MARAD management, in conjunction with their accounting service provider, ESC, develop a PP&E roll forward control that contains all activity within the relevant PP&E accounts by disclosure category, including additions, annual cost adjustments, year to date depreciation, capitalizations from construction in progress to other categories, and retirements.

Update the Commission’s compliance policies to incorporate all key elements in the AbilityOne and FAR regulations regarding contract performance which includes product quality. Further, add procedural guidance, including documentation requirements, that is complete and sufficient to implement the policies. Key elements include the following: a. NPA quality systems in place to furnish products that meet Government specificationsunder the contract and correct product deficiencies prior to delivery;b. Reporting of quality complaints including handling of inquiries and disputes; andc. Monitoring and evaluation of NPA compliance with these requirements.

The Commission should determine and develop written documentation of criteria/metrics, data needed from all stakeholders (i.e., NPAs, CNAs, and Federal customers), reporting tools and/or mechanisms, and procedures needed to monitor, evaluate, and assess NPA compliance withcontract performance requirements including strict adherence to quality standards. This should include documentation of this evaluation and assessment of NPA compliance in PLIMS.

Develop and implement written procedures that provide Commission requirements and guidelines to CNAs regarding quality control processes they have established to oversee and assist NPAs to ensure successful contract performance and compliance in furnishing a product to the Government. This should include all key elements (e.g., assessment and tracking of quality complaints, types of technical assistance provided to NPAs, documentation requirements, and frequency of interactions with NPAs) and ensure data provided to the Commission is comparable and sufficient to inform their decision-making.

(U) Rec. A.1.a: The DoD OIG recommended that the Under Secretary of Defense for Policy issue a memorandum formalizing the transfer of responsibility for global health engagement from the Assistant Secretary of Defense for Special Operations and Low-Intensity Conflict to the Assistant Secretary of Defense for Strategy, Plans, and Capabilities.

(U) Rec. A.1.b: The DoD OIG recommended that the Under Secretary of Defense for Policy update DoD Instruction 2000.30 to reflect the roles and responsibilities of the Assistant Secretary of Defense for Strategy, Plans, and Capabilities for global health engagement and their role on the Global Health Engagement Council.

(U) Rec. A.2: The DoD OIG recommended that the Deputy Assistant Secretary of Defense for Global Partnerships, in coordination with the DoD Global Health Engagement Council, provide a written proposal to the Under Secretary of Defense for Policy detailing its recommendations about how to implement Recommendations A.3.a-d.