Open Recommendations

The IPA recommended that OCIO management performs ongoing monitoring to hold responsible control operators accountable for timely completion of such control activities.

The IPA recommended that Fiscal Service management reinforce policy requirements (through training or other means) for removing logical access of terminated and transferred Fiscal Service employees and contractors within 2 business days of their separation date.

The IPA recommended that Fiscal Service management perform ongoing monitoring to hold responsible control performers accountable for timely completion of such control activities

The IPA recommended that Fiscal Service develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.

The IPA recommended that Fiscal Service update existing UNIX and database configuration security baseline documents to ensure that these documents fully incorporate and enforce the components of the DISA STIGs. Management should document any deviations from the STIGs and note compensating controls that mitigate the security risk to an acceptable level.

The IPA recommended that Fiscal Service develop, document, and implement policies, procedures, and controls to conduct periodic reviews of actual UNIX and database settings against the security configuration baselines.

The IPA recommended that Fiscal Service provide logging and monitoring of security related events to include the retention of evidence of reviews performed.

The IPA recommended that Fiscal Service develop a baseline of essential security settings and specify that baseline as the standard to be observed.

The IPA recommended that Fiscal Service implement corrective actions to address all vulnerabilities associated with the baseline enforcement to include removing the three default user accounts on UNIX servers.

The IPA recommended that Fiscal Service perform a review of the current system environment against the CMDB.

The IPA recommended that Fiscal Service perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the CMDB.

The IPA recommended that Fiscal Service update policy and procedures related to the above recommendations and disseminate the documentation to enforce such policy and procedures.

We recommend that BLM develop policies and procedures for identifying and tracking helium-producing wells to ensure helium agreements are established and enforce agreement clauses for annual reporting.

We recommend that BLM resolve the $48,000 in uncollected penalties.

We recommend that BLM establish a records management system for tracking helium agreements.

We recommend that BLM develop policies and procedures for monitoring helium agreements to ensure they are current.

We recommend that BLM conduct a thorough review of royalty payment data to identify potential delinquencies and resolve any delinquencies identified, including resolving the $851,000 of potential delinquencies previously reported.

We recommend that BLM develop policies and procedures for identifying, tracking, and following up on delinquent companies.

We recommend that BLM establish a policy for conducting reviews of helium companies to conform to ONRR practices, including establishing a risk-based strategy and independent verification of company-provided production data to assist the Federal Leased Lands team in performing efficient oversight of helium companies, which would put the team's $96,385 in estimated yearly salary expenses associated with inefficient oversight practices to better use in the future.

The Executive Director ensures staff receive education about badge holders’ responsibilities in preventing unauthorized access to VA facilities and computer systems and safeguarding electronic databases including electronic health care records.

The Executive Director ensures staff monitor patient care areas for expired, damaged, and contaminated medications and remove them as needed.

The Executive Director ensures staff store medications in pharmaceutical grade refrigerators.

The Executive Director ensures primary care staffing is sufficient for patients to receive appropriate health care.

The Executive Director reviews staffing levels for the Housing and Urban Development–Veterans Affairs Supportive Housing program and takes action as needed.

The Medical Center Director ensures staff properly store clean medical equipment.

We recommend that the FAS Commissioner resume iterations of the Competitive Pricing Initiative at the MAS Program level to identify, address, and reduce price variability.

We recommend that the FAS Commissioner strengthen policies and procedures to: address data inaccuracies within FAS pricing tools; and ensure bilateral contract modifications are submitted and approved prior to catalog changes.

We recommend that the FAS Commissioner provide additional guidance to contracting officers regarding adequate sampling techniques for large catalogs to ensure information accuracy.

We recommend that the FAS Commissioner inform federal customer agencies that they should perform separate and independent price determinations because significant price variability puts federal customer agencies at risk of overpaying for products on MAS contracts.

We recommend that the FAS Commissioner increase oversight and implement additional controls related to temporary price reductions.

(U) Rec. 1: The DoD OIG recommended that the Commander of the Naval Facilities Engineering Systems Command Southeast review the February 2023 section 3051 inspection reports and require the Navy Southeast Region privatized housing company to address systemic life, health, and safety issues, such as mold and moisture.

(U) Rec. 2: The DoD OIG recommended that the Commander of Naval Air Station Key West refer residents with health concerns identified during the Navy assessment team inspections to a medical treatment facility for assessment to determine whether association existed between the environmental safety and health issues in military housing.

(U) Rec. 3.a: The DoD OIG recommended that the DoD Chief Housing Officer and Defense Health Agency Director coordinate to define the procedures to refer patients to a medical treatment facility for a medical assessment.

(U) Rec. 3.b: The DoD OIG recommended Defense Health Agency Director update Defense Health Agency Administrative Instruction 6050.01 to incorporate referral procedures.

(U) Rec. 3.c: The DoD OIG recommended that the DoD Chief Housing Officer publish guidance, consistent with Defense Health Agency Administrative Instruction 6050.01, that establishes procedures to refer patients to a medical treatment facility for a medical assessment.

(U) Rec. 4.a: The DoD OIG recommended that the DoD Chief Housing Officer establish guidance for the Military Departments on how to interpret and implement 10 U.S.C. 2893.

(U) Rec. 4.b: The DoD OIG recommended that the Secretary of the Navy conduct a review to determine whether the Navy Southeast Region privatized housing company demonstrated a pattern of failing to remedy, or failing to remedy in a timely manner, health or environmental hazards.

(U) Rec. 4.c: The DoD OIG recommended that the Secretary of the Navy take appropriate corrective action in response to the review in Recommendation 4.b, including whether to deny unawarded performance incentive fees (that we estimated as $3.95 million), in accordance with 10 U.S.C. 2893.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 1.b: Report is Classified.

Embassy San Salvador should bring its drinking water reimbursement program into compliance with Department standards.

Embassy San Salvador should perform all information systems security officer responsibilities in accordance with Department standards.

Embassy San Salvador should manage its non-enterprise networks in accordance with Department standards.

Embassy San Salvador should implement an application life cycle management plan for applications it develops, in accordance with Department standards.

Embassy San Salvador should develop and maintain an inventory of all locally developed applications at the embassy.

Embassy San Salvador should implement its local configuration management protocol in accordance with Department standards.

Embassy San Salvador should conduct a benefit-cost analysis for its arts and graphics services.

Update and fully implement the Collections Care Initiative Interim Guidelines to:
(a) require that awards to NCP be approved and monitored at a higher organizational level,
(b) require NCP to maintain a current list of all CCI projects and the funds awarded to them to use for oversight purposes, and
(c) add specific monitoring procedures for CCI awards.

Develop and implement a report tracking system and procedures requiring NCP staff to remind units of approaching due dates and timely follow-up with units that miss their reporting deadlines.

Develop and implement policies and procedures requiring NCP staff to review PSCI reports upon receipt to:
(a) ensure that they comply with applicable reporting requirements, and
(b) document the results of NCP’s review of the reports.