Open Recommendations

(U) Rec. C.1.a: The DoD OIG recommended that the Assistant Secretary of the Army for Installations, Energy, and Environment require the Army Materiel Command to update the Performance Incentive Fee plan to comply with the Common Incentive Fee Frameworkand validate compliance.

(U) Rec. C.1.b: The DoD OIG recommended that the Assistant Secretary of the Army for Installations, Energy, and Environment review the Military Housing Offices Performance Incentive Fee calculations to verify that all awards are in accordance with the Armys Performance Incentive Fee plan, eliminating the potential misuse of funds, including $228,460 at Fort Sam Houston over the next 5 years.

(U) Rec. C.1.c: The DoD OIG recommended that the Assistant Secretary of the Army for Installations, Energy, and Environment direct the Fort Sam Houston Military Housing Office to recalculate the Performance Incentive Fee awards that Hunt Military Communities earned since 2022 and pursue compensation for any overpayments, including the $11,423 identified in this report.

(U) Rec. C.2: The DoD OIG recommended that the Assistant Secretary of the Navy (Energy, Installations, and Environment) require the Naval Facilities Engineering Systems Command to update the Performance Incentive Fee plan to comply with the Common Incentive Fee Framework and validate compliance.

Sensitive But Unclassified

Verify that Hand in Hand: Center for Jewish-Arab Education in Israel corrects the two instances of material noncompliance detailed on pages 24 to 26 of the audit report.

Recommendation 1a
We recommend the Architect of the Capitol perform an independent risk assessment to identify
and evaluate potential risks within the agency’s supply chain, including risks related to cybersecurity, geopolitical factors, vendor reliability, and compliance with regulatory requirements. This assessment will allow the agency to determine whether a formal Supply Chain Risk Management program is necessary based on the agency’s unique risk profile.

Recommendation 1b
If deemed necessary based on the outcomes of the assessment performed, develop and
implement a Supply Chain Risk Management program tailored to the identified risks. This may
include implementing or enhancing appropriate controls, vendor…

Recommendation 2
We recommend that the agency work with the offices and jurisdictions to define, document, and
implement risk management processes for offices and jurisdictions to consistently identify, track,
and manage risks applicable to them.

Recommendation 3
We recommend that the agency work with the offices and jurisdictions to develop and document
risk tolerance thresholds for strategic objectives.

The Director, Collection Policy, SB/SE Division, should revise the IRM to require revenue officers to verify that the CDP hearing
notice has been issued prior to taking levy action.

The Director, Collection Policy, SB/SE Division, should refund the proceeds from the prohibited levies to the 42 taxpayers that
we identified during this review.

The Director, Field Collection, SB/SE Division should ensure employees, and their managers review prohibited levy actions identified in this report, and in employee performance reviews, and take appropriate actions for misconduct if violations are found to be
intentional.

The Director, Field Collection, SB/SE Division, should notify the taxpayers identified in this report that their representatives were not sent a copy of CDP levy notices or other correspondence.

Reassess and clarify physical inventory requirements for equipment in medical facilities to ensure they are consistent with and meet the intent of VA Directive 7002.

Ensure that facility directors require custodial officers to regularly review nonexpendable inventory to determine whether the equipment is required and take appropriate action.

Ensure medical facility directors review inventory list compliance data to identify noncompliant services and implement a process to resolve noncompliance.

Ensure the Veterans Health Administrations Procurement and Logistics Office, in coordination with VAs Office of Acquisition and Logistics, regularly monitors inventory compliance data to identify and communicate with noncompliant facilities to proactively address delinquent inventories.

Require medical facilities to use a standardized report of survey dashboard to centrally report all lost, stolen, or damaged items.

Require medical facility directors to review inventory compliance and establish a process to ensure noncompliant equipment"to include equipment identified in this audit"is reported as lost, stolen, or damaged within required time frames.

Reiterate through formal communication that facilities and regional Veterans Integrated Service Networks are required to fully implement and use the Strategic Equipment Planning Guide and Enterprise Equipment Request process for equipment planning and approval and develop a system to monitor compliance and verifying facilities are using the process as required.

Ensure facilities define and assign Strategic Equipment Planning Guide and Enterprise Equipment Request user roles and responsibilities as applicable.

(U) Rec. 1: This recommendation is Controlled Unclassified Information

(U) Rec. 2.a: This recommendation is Controlled Unclassified Information

We recommend that the Chief Operating Officer for Federal Student Aid (FSA), in conjunction with the Commissioner of NCES, require JJC to Update its existing policies and procedures for collecting, verifying, and reporting accurate data for the Student Financial Aid survey, consistent with the Integrated Postsecondary Education Data System (IPEDS) Keyholder Handbook and survey instructions.

We recommend that the Chief Operating Officer for Federal Student Aid (FSA), in conjunction with the Commissioner of NCES, require JJC to Design and implement procedures for ensuring that employees consider admission records to record and update the accurate classification of first-time, full-time undergraduate students in the student information system before finalizing the cohort.

We also recommend that the Chief Operating Officer for FSA consider taking appropriate action pursuant to subpart G of 34 C.F.R. section 668 because the school reported inaccurate and incorrect information to the Integrated Postsecondary Education Data System (IPEDS) through the Student Financial Aid survey for the 2021–2022 reporting period.

We recommend that the Chief Operating Officer for FSA, in conjunction with the Commissioner of NCES, require JJC to update and implement policies and procedures for collecting, verifying, and reporting accurate data for the Graduation Rates survey to align with current IPEDS reporting requirements and ensure the accurate classification of first-time, full-time undergraduate students.

We recommend that the Chief Operating Officer for FSA, in conjunction with the Commissioner of NCES, require JJC to design and implement procedures for ensuring that employees consider admission records to record and update the accurate classification of first-time, full-time undergraduate students in the student information system before finalizing the cohort.

Ensure a disability compensation examiner who has completed PACT Act training provides an independent assessment and medical opinion for the 29 VHA and five VBA nonpresumptive PACT Act opinions identified by the Office of Inspector General that were provided before completing PACT Act training, and readjudicate the claims as needed.

We recommend that OIT update policies and procedures to ensure that OIT (a) thoroughly documents and understands changes to the SEC’s mobile device management system before such changes are implemented; (b) maintains an accurate inventory of mobile devices enrolled in the SEC’s mobile device management system (including timely follow-up and removal of inactive devices); (c) reviews and escalates mobile device management system notifications involving Capstone officials’ devices; and (d) regularly obtains and, as necessary, responds to information about technical risks from vendors whose products may impact the SEC’s mobile devices.

We recommend that OIT ensure that all SEC Capstone officials’ devices were backed up at the time OIT removed the texting application from SEC devices, and (for each device) document the date OIT verified that all electronic records, including text messages, were successfully saved (as of the October 2022 Capstone initiative and with each subsequent backup). If text messages from any Capstone officials’ devices were not successfully saved, work with ORMS to determine if NARA notification is required.

We recommend that OIT update the applicable system security plan(s) to accurately reflect the mobile device management system audit events and logs that should be forwarded to the SEC’s security information and event management tool, and ensure that those logs support after-the-fact investigations of incidents.

We recommend that OIT develop procedures to periodically verify that the mobile device management system audit events and logs identified in the applicable system security plan(s) are successfully retained in the SEC’s security information and event management tool.

We recommend that OIT update policies and procedures to require OIT management’s approval of commands during troubleshooting activities that result in a factory reset of Capstone officials’ devices, and verification that appropriate device logs and forensic data have been collected and retained beforehand.

Remove the six identified deceased participants from benefit pay status and take other actions, as appropriate.

Coordinate with the OIG to periodically run DNP as needed.

Develop and implement a formal process for defining, documenting, and maintaining its cybersecurity target profile(s).

Develop and formalize thresholds or target values for key cybersecurity and risk performance metrics, at a minimum, in the following areas:
Cybersecurity risk management program;
Data exfiltration and enhanced network defenses;
Information security continuous monitoring (ISCM) policies, strategy, and
processes; and
Incident detection, analysis, handling, and response activities.

Develop and implement detailed procedures to support its existing supply chain risk management policy and implementation plan.

Establish policies and standards for data classification, quality, access, lifecycle management, and metadata management.

Identify the baseline knowledge, skills, and abilities required for STB's cybersecurity workforce, conduct an assessment to determine any skill gaps, and customize specialized training to address the identified deficiencies.

The Chief Information Officer should timely remediate GSS BDA vulnerabilities in accordance with IRS policies.

The Chief Information Officer should ensure that all configurations for GSS BDA assets adhere to federal and IRS policies.

The Chief Information Officer should ensure the asset discovery tool is properly configured to the source data to accurately account for all GSS BDA assets.

(U) Rec. 1: Report is Classified.

(U) Rec. 1: The DoD OIG recommended that the Director of the Defense Security Cooperation Agency revise Defense Security Cooperation Agency Manual 5105.38-M to address DoD storage of benefiting partner-owned items. The revisions should address situations where benefiting partners cannot immediately receive items and should specify how the DoD should segregate and store these items to prevent incorrect accounting on DoD property records.

Update WCF customer documentation to provide a clear understanding of how their advance payments are used regarding what services were provided and at what costs for both estimated and actuals.

Review and take corrective action to address the approximately $1.2 million in questioned costs based on errors and unsupported charges included in customer bills.

Review and take corrective action to address the approximately $443,062 in questioned costs based on issues with WCF-funded employees' salaries, benefits, and bonuses identified in the report.

Reassess DOT's WCF management structure to evaluate how best to consolidate it under one central office to better promote and provide for economy and efficiency in WCF activities.