Open Recommendations

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

Implement adequate procedures and controls to ensure that documentation is maintained to support that the reports were submitted to Congress.

1) Review all postal inspectors with assigned equipment and validate they are active employees, 2) retrieve equipment from postal inspectors who separated from the agency, and 3) update the status and assignment of all equipment in the Electronic/Technical Surveillance Tracking System.

Resolve Electronic/Technical Surveillance Tracking System functionality errors preventing users from temporarily transferring, temporarily assigning, and recording the final disposition of law enforcement surveillance equipment, including digital signature capability.

We recommend that the USAID Bureau for Europe and Eurasia, in coordination with USAID/Ukraine:
Implement an action plan to verify the accuracy of Government of Ukraine-submitted expenditure reports for healthcare worker salaries and remediate any identified deficiencies, as appropriate.

Finalize and implement a comprehensive formalized enterprise-wide cloud computing strategy that, at minimum, addresses the following:• Alignment with federal guidance and directives such as Cloud Smart and Executive Order 14028. • Prioritization of the use of FedRAMP-authorized systems. • Identification of workforce requirements needed to support cloud procurement, implementation, and risk management.• Management of risks related to the use of cloud computing services such as secure cloud architecture, data governance, and incident management processes.

Develop and implement policies, procedures, and standards that are consistent with the NCUA’s cloud computing strategy and address, at minimum, the following: • Coordination, identification, and clarification of responsibilities and processes across all stakeholders for IT service contract reviews, service level agreements alignment and monitoring, and cloud service incident management. • Specific criterion for the prioritization, selection, and use of cloud computing services. • Periodic review of contract clauses included for cloud computing services to confirm documentation supporting security requirements are clearly identified to the vendor and security and operational risks are appropriately managed.

Develop comprehensive guidance and training for grantees on how to prepare the PR 29 report to ensure that the information collected is reliable, accurate, timely, and in compliance with the Uniform Administrative Guidance for Grants and Cooperative Agreements, specifically 2 CFR 200.302(a)(b) and 2 CFR 200.303

Follow up with the four grantees without adequate supporting documentation and assess their compliance with the financial management requirements in 2 CFR 200.302(b)(3), which require the financial management system of each non-Federal entity to provide for records that adequately identify the source and application of funds for federally funded activities.

Update the CPD Monitoring Handbook to incorporate the review of the PR 29 report when performing financial monitoring reviews.

Develop written procedures on how to review PR 29 report submissions and monitor resubmissions, late submissions, and nonsubmissions.

Evaluate and update IDIS to ensure that resubmissions of PR 29 reports are tracked and prior submissions are preserved and correct the system's misclassification of unsubmitted and uncertified draft PR 29 reports as submitted.

Determine how often grantees' requests for reimbursement contain cost outside the quarter and in coordination with OCFO, evaluate CPD's grant accrual methodology and assumptions to ensure that it adequately considers the impact of these late cost reimbursements.

Develop guidance that encourages grantees to draw down funds for reimbursement on a regular schedule, not less than quarterly.

Work with OCFO to ensure that CPD collects and reports to OCFO all of the information needed to properly account for all CPD activities in HUD's financial statements in accordance with Federal financial reporting requirements and accounting standards.

Update Line 4 - Cash (grant funds) disbursed during the reporting period in the PR 29 report to allow grantees to report all CDBG grant funds disbursed, including funds that have not yet been drawn down from HUD for reimbursement.

Obtain the required approvals under PRA for the PR 29 report.

Executive director of the Office of Acquisition and Logistics and senior procurement executive: 3. Update and publish the Veterans Affairs Acquisition Regulation and Veterans Affairs Acquisition Manual to direct the department’s acquisition professionals to the correct guidance for vetting contractor employees, which should include VA’s personnel security and suitability program policy.

Assistant secretary for information and technology update and publish VA Handbook 6500.6, Contract Security, in collaboration with the Office of Acquisition, Logistics, and Construction and the Office of Human Resources and Administration/Operations, Security, and Preparedness including retitling it to better correspond to its content and removing any personnel security steps that should only be discussed in VA personnel security and suitability program policies.

The Office of Administration should work with the Bureau of Field Service to create an agency wide capital planning report for fiscal years 2024-2028 that includes all field offices (in addition to headquarters) and addresses all considerations required by the Office of Management and Budget's latest Memorandum M-22-14.

The Office of Administration should adequately document exemptions of the Office of Management and Budget's memorandums related to agencywide capital planning requirement.

The Bureau of Field Service should create policies and procedures for Railroad Retirement Board employees to assist customers with limited English proficiency.

The Bureau of Field Service should provide resources to employees to ensure access to language assistance resources.

The Bureau of Field Service should provide training for employees on how to assist customers with limited English proficiency.

The Bureau of Information Services should work with the Bureau of Field Service to develop and implement a detailed project plan to document and formally communicate project implementation steps to modernize RRB's technology to better serve its customers and carry out the agency's primary mission. At a minimum, the Bureau of Information Services should ensure the plan contains: insights from the Veterans Affairs' design and implementation strategies of their online Veteran Benefits Administration benefits; a course of action to develop and increase availability of an advanced, comprehensive system to include online Railroad Unemployment Insurance Act and Railroad Retirement Act applications…

The Bureau of Fiscal Operations should track costs both by field office and by object class code to ensure that the costs of each of the 53 field offices and staff are readily available and determine how often the cost data will be updated.

The Bureau of Fiscal Operations should establish a process to ensure the breakdown and total cost of the Bureau of Field Serice is consistently monitored and reported.

Brown & Company recommends that the NIH complete the security categorization in accordance with FIPS Pub 199 to include documenting results and supporting rationale in the security plan.

Brown & Company recommends that the NIH conduct a system-level risk assessment for the SRA in accordance with NIST SP 800-53 requirements and NIH polices.

Brown & Company recommends that the NIH ensure that the data normalization policy and procedures comply with Federal requirements to include defining roles and responsibilities.

The Deputy Commissioner for Operations Support should ensure that access to sensitive systems is immediately suspended or disabled when a contractor is identified as not having a favorable background determination.

1. We recommend that the Director of the Census Bureau ensure that the 2030 EAE reports are released in a timely manner.

5. We recommend that the Director of the Census Bureau ensure that integrated project teams (IPTS) responsible for OAs provide the required report elements and document when required report elements are not available or transparency is not permissible.

6. We recommend that the Director of the Census Bureau develop guidelines for the querying and reporting of cost data that permit comparisons between planned and actual costs.

10. We recommend that the Director of the Census Bureau develop mechanisms to better account for the required resources to complete EAE activities to aid in the planning and execution of future EAE operations.

Perform an assessment of employee resources in the Office of Financial Management, Planning, and Evaluation, and other relevant financial process areas to ensure an appropriate complement of resources are in place to manage accounting and reporting matters as they arise and through their normal course of business.

Provide training and supervision for personnel on financial management matters that affect the financial statements, including adhering to accounting policies and procedures, as appropriate, and performing key internal control functions in support of financial reporting.

Develop desktop manuals to assist new personnel in meeting their assigned responsibilities.

Improve the risk assessment process at the financial statement assertion and process level to ensure that CPSC management is appropriately capturing significant changes in the control environment and subsequently responding to those risks.

Implement key monitoring controls over the financial reporting process and develop robust policies and procedures to increase oversight, review, and accountability of accounting events at the process level to ensure the successful implementation of an effective internal control environment.

Design a control to identify, analyze, and respond to risks related to the reporting of pre-paid expenses.

We recommend that the Colorado Department of Health Care Policy & Financing follow up with the 20 nursing homes reviewed in this audit that demonstrated life safety, emergency preparedness, and infection control deficiencies to ensure that they have taken corrective actions.

We recommend that the Colorado Department of Health Care Policy & Financing work with CMS to develop a risk-based approach to identify nursing homes at which surveys would be conducted more frequently than once every 15 months, such as those with a history of multiple high-risk deficiencies or frequent management turnover.

We recommend that the Colorado Department of Health Care Policy & Financing work with CMS to develop standardized life safety training for nursing home staff.

We recommend that the Massachusetts Department of Public health work with CMS to develop standardized life safety training for nursing home staff.

Automate printing applicants’ responses to the earnings-test questions on the application summary SSA provides beneficiaries when they request to start receiving their Old-Age, Survivor, and Disability Insurance benefits.

Revise systems to ensure the Agency requests monthly earnings information from beneficiaries eligible for the monthly earnings test before it assesses an overpayment.

Add language to overpayment notices informing beneficiaries who are eligible for the monthly earnings test their overpayment may be reduced or eliminated if they had monthly wages below the applicable limit.

Expand controls to detect potential underpayments based on discrepancies between the Master Beneficiary Record and Master Earnings File.

Implement systems changes to automatically grant earnings-test-related monthly benefit increases at, or closer to, the date they are first allowed by policy.