Open Recommendations

We recommend that the Health Resources and Services Administration commit to strengthening its procedures that may apply to future programs of a similar nature to better ensure that; providers receive their intended share of financial assistance; financial assistance payments are properly calculated; data and data sources are appropriate, current, complete, and accurate, and revisions are made when necessary for calculating financial assistance; and all available data sources are utilized to identify ineligible providers and prevent them from receiving financial assistance.

Sensitive information redacted

Sensitive information redacted

We recommend that the CBP Senior Official Performing the Duties of the Commissioner designate an official or group to be responsible for implementing the requirements of the Synthetic Opioid Exposure Prevention and Training Act and: • issue a component-wide policy to the CBP workforce to safely handle potential synthetic opioids; • make personal protective equipment and opioid receptor antagonists, including naloxone, available and readily accessible to all personnel at risk of exposure to opioids; and • require initial and recurrent training for all at-risk personnel on the risk of opioid exposure and how to access and administer naloxone.

We recommend that the Deputy Assistant Secretary instruct PRDOH to implement a process to regularly conduct fraud risk assessments and determine a fraud risk profile. The fraud risk profile should include key findings and conclusions from the risk assessment, including the analysis of the types of fraud risks, their perceived likelihood and impact, risk tolerance, and the prioritization of risks.

We recommend that the Deputy Assistant Secretary for Grant Programs evaluate PRDOH's risk exposure and tolerance as part of HUD's program-specific fraud risk assessment for disaster grant programs.

We recommend that the Deputy Assistant Secretary for Grant Programs coordinate with HUD's Chief Risk Officer to (1) provide training and technical assistance to PRDOH with a focus on the design, implementation, and performance of fraud risk assessments, and (2) establish a fraud risk management framework for the organization.

We recommend that the Deputy Assistant Secretary for Grant Programs assess whether grantees have mature fraud risk management programs within the disaster recovery and mitigation programs.

We recommend that the Deputy Assistant Secretary for Grant Programs determine the fraud risk exposure in HUD's disaster recovery and mitigation programs and work with grantees to implement appropriate fraud mitigation activities.

We recommend the Acting Commissioner for the Bureau of Labor Statistics perform a nonresponse bias study or imputation assessment to determine if bias exists in the Consumer Price Index and Import and Export Price Index economic information due to the increased use of imputations.

We recommend the Acting Commissioner for the Bureau of Labor Statistics, based on the nonresponse bias study or imputation assessment, establish, as applicable, a threshold at which the Consumer Price Index and Import and Export Price Index must publicly disclose the amount of imputations used. Update program policies and procedures to include the established threshold and document how to publicly disclose when the threshold is met.

We recommend that NYC DOHMH refund $15,671,958 to the Federal government.

We recommend that NYC DOHMH strengthen its oversight of subrecipients to prevent future unallowable payments by reviewing subrecipient invoices and supporting documentation to ensure costs claimed are allowable and allocable.

To address the issues identified, we recommend the Administrator direct the Associate Administrator for the Office of Disaster Recovery and Resilience to reevaluate eligibility for the 47 applicants we questioned and recover grant funds from the ineligible applicants.

To address the issues identified, we recommend the Administrator direct the Associate Administrator for the Office of Disaster Recovery and Resilience to implement additional controls to ensure that, during the monitoring, auditing, and compliance phases, awards are carefully screened to verify eligibility and to recover grant funds from ineligible entities.

Ensure the Information System Security Officers are reviewing system configurationcompliance scans monthly as required within NARA’s Configuration ComplianceManagement Standard Operating Procedure. (New Recommendation)

Implement improved processes to remediate security deficiencies on NARA’s networkinfrastructure, to include enhancing its patch and vulnerability management program toaddress security deficiencies identified during our assessments of NARA’s applicationsand network infrastructure. (Recommendation #13 from the FY 2022 FISMA audit, report#22-AUD-09)

Document and implement a process to track and remediate persistent configurationvulnerabilities or document acceptance of the associated risks. (Recommendation #15from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure all information systems are migrated away from unsupported operating systemsto operating systems that are vendor-supported. (Recommendation #18 from the FY 2021FISMA audit, report #22-AUD-04)

Finalize and implement system configuration baseline management procedures, whichencompass at a minimum, the request, documentation, and approval of deviations frombaseline settings for all NARA systems. (Recommendation #22 from the FY 2021 FISMAaudit, report #22-AUD-04)

Enhance current procedures to ensure that new NARA users who do not complete theirinitial security awareness training, have their accounts automatically disabled inaccordance with timeframes promulgated within the Privacy and Awareness Handbook.(New Recommendation)

Continue and complete efforts to require PIV authentication for all privileged users, serversand applications, through NARA’s Privileged Access Management authentication projectand other efforts. (Recommendation #26 from the FY 2021 FISMA audit, report #22-AUD04)

Enforce mandatory PIV card authentication for all NARANet users, in accordance withOMB requirements. (Recommendation #27 from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure NARANet user accounts are reviewed and disabled in accordance with NARA’sinformation technology policies and requirements. (Recommendation #29 from theFY 2021 FISMA audit, report #22-AUD-04)

Ensure that the SAOP complete PIAs for all systems which contain PII. (NewRecommendation)

The SAOP review and update the NARA 1609 Initial Privacy Reviews and Privacy ImpactAssessments privacy policies and procedures to reflect NARA’s current processes andcontrols. (Recommendation #33 from the FY 2021 FISMA audit, report #22-AUD-04)

The CIO and SAOP implement a process to ensure role-based privacy training iscompleted by all personnel having responsibility for PII or for activities that involve PII, andcontent includes, as appropriate: responsibilities under the Privacy Act of 1974 andE-Government Act of 2002, consequences for failing to carry out responsibilities,identifying privacy risks, mitigating privacy risks, and reporting privacy incidents, datacollections and use requirements. (Recommendation #34 from the FY 2021 FISMA audit,report #22-AUD-04)

We recommend that the Centers for Disease Control and Prevention create policies and procedures for developing test kits that include roles, responsibilities, and oversight.

We recommend that the Centers for Disease Control and Prevention ensure that the recently finalized GRF addresses the findings we identified in this report.

We recommend that the Centers for Disease Control and Prevention develop and implement documented processes to ensure that adequate staffing and laboratory space can be obtained for future responses and provide for separation of duties and supervisor controls.

We recommend that CDC re-evaluate the IMS structure at all levels of CDC's response framework and integrate positions or roles and responsibilities that provide effective oversight of a response effort, including a laboratory-based response effort.

We recommend CDC implement a CDC-wide laboratory document control system.

We recommend that CDC ensure that all infectious disease laboratories implement and periodically evaluate a QMS.

Reevaluate the FDIC's strategy to attract, retain, and allocate staffing, including how to enhance the supervision of large, complex financial institutions.a. This evaluation should be documented and submitted to the FDIC’s Chairman for review and approval.

Implement target metrics and monitor variances for key supervisory outputs consistent with requirements contained in CEP Procedures, such as:a. Supervisory Plan percentage completed to actual percentage completed to identify and take timely corrective action when examination teams are not on track to achieve objectives detailed in annual supervisory plans.b. Target review start date to actual review start date to identify and take timely corrective action when examination teams are not on track to achieve objectives detailed in annual supervisory plans.c. Number of days elapsed between target review start date and exit meeting to expectation to identify and take corrective action…

2. We recommend that the Deputy Assistant Secretary for Regional Affairs of EDA, the Grants Management Division Director of NIST, and the Grants Management Division Director of NOAA review and revise their respective policies and procedures to comply with the Uniform Guidance that management decisions are issued within the 6 month deadline and contain the required content.

We recommend that the Director, Office of Disaster Recovery, perform monitoring of or otherwise review grantees' detailed procedures for preventing duplication of benefits for each grant activity within the first year after HUD signs the grant agreement or before grantees process applications for assistance, whichever occurs first.

We recommend that the Director, Office of Disaster Recovery, develop and implement a process to review grantees' detailed procedures for preventing duplication of benefits and require grantees to correct any deficiencies identified in the review before grantees process applications for assistance.

We recommend that the Centers for Medicare & Medicaid Services use the information we obtained from States about the challenges they are still encountering and develop an action plan for helping States more easily identify liable third parties and recover Medicaid payments.

We recommend that the Centers for Medicare & Medicaid Services work with States, as appropriate, to encourage better cooperation from third parties that routinely resist States' TPL identification and recovery efforts.

We recommend that the Centers for Medicare & Medicaid Services, for the four States we identified as not having fully complied with the DRA's TPL provisions, verify whether the States have since come into compliance; and pursue corrective actions for States that have not fully complied.

We recommend that the Centers for Medicare & Medicaid Services verify whether Virginia has refunded the $1.25 million Federal share of the Medicaid TPL collections underreported during two fiscal quarters and, if not, require Virginia to refund any remaining amount owed.

We recommend that the Centers for Medicare & Medicaid Services provide guidance to States to assist them with developing processes that improve the reporting of Medicaid TPL amounts on the form 64.9A.

We recommend that the Centers for Medicare & Medicaid Services ensure that States have current instructions on completing the form 64.9A.

We recommend that the Centers for Medicare & Medicaid Services ensure that States correctly report TPL amounts on the form 64.9A.

We recommend that the Centers for Medicare & Medicaid Services remove or disable lines from the form 64.9A that States are supposed to leave blank.

Incorporate a representative from the Logistics Management Division into each Artemis-related program and project at appropriate milestones, including at the onset of a contract and each life-cycle milestone.

We recommend that the Mississippi Division of Medicaid work with CMS to calculate the rebate amount for claims identified in our findings, invoice drug manufacturers for the calculated rebates, and refund the Federal share of rebates collected for the years covered by our audit period and for years after our audit period.

We recommend that the Mississippi Division of Medicaid strengthen internal controls to facilitate the invoicing of all physician-administered drugs for rebate.

We recommend that the South Dakota Department of Social Services remediate the six control findings OIG identified.