Open Recommendations

We recommend that the Maryland Department of Health assess at least annually and if necessary, adjust baseline configurations for its MMIS and E&E public servers.

We recommend that the Maryland Department of Health perform periodic phishing exercises and enhance employee and contractor cybersecurity awareness training based on the results of the phishing exercises, if needed.

Create a method to collect the identifying information of authorized individuals as part of the application for a CAF number. For authorized individuals who already have a CAF number assigned, create a method to collect identifying information during subsequent authorization requests.

We recommend that the Vermont Department of Health, Division of Substance Use Programs refund $282,643 to the Federal Government.

We recommend that the Vermont Department of Health, Division of Substance Use Programs require subrecipients to provide and retain supporting documentation for invoices submitted for reimbursement under Federal grants as recommended in Bulletin No. 5.

We recommend that the Vermont Department of Health, Division of Substance Use Programs conduct a periodic review of supporting documentation (i.e., invoices, payroll registers, and time and effort reports) for subrecipient expenditures submitted to DSU for reimbursement.

We recommend that the Vermont Department of Health, Division of Substance Use Programs provide training to State employees responsible for conducting pre-award risk assessments of potential subrecipients of Federal grant funds.

We recommend that the Vermont Department of Health, Division of Substance Use Programs conduct annual site visits as required within the terms and conditions of the grant award that include program and fiscal reviews.

We recommend that the Centers for Medicare & Medicaid Services remediate the seven security control findings OIG identified.

We recommend that the Centers for Medicare & Medicaid Services update security controls to align with the most current NIST SP 800-53 requirements.

We recommend that the Centers for Medicare & Medicaid Services enhance policies and procedures to periodically identify and assess whether security controls are in place and operating effectively in accordance with the most current NIST SP 800-53 controls and remediate weak controls timely.

Embassy Brussels should advise and brief U.S. citizens in Belgium in accordance with Department standards.

Embassy Brussels, in coordination with the Bureaus of Consular Affairs and Overseas Buildings Operations, should provide a wheelchair-accessible restroom option for consular customers.

Embassy Brussels, in coordination with the Bureau of Overseas Buildings Operations, should bring its fire protection program into compliance with Department standards.

The U.S. Mission to the North Atlantic Treaty Organization, in coordination with Embassy Brussels, should require that all residences are inspected and certified in the Post Occupational Safety and Health Officer Certification Application in accordance with Department standards.

Embassy Brussels should obtain authorization from the Bureau of Overseas Buildings Operations to use shipping containers for permanent storage or dismantle and remove them, in accordance with Department standards.

Embassy Brussels should bring its contracting officers representative program into compliance with Department standards.

The U.S. Mission to the North Atlantic Treaty Organization, in coordination with Embassy Brussels, should submit its living quarters expenditure reports in accordance with Department standards.

Embassy Brussels, in coordination with the Bureaus of Budget and Planning, the Comptroller and Global Financial Services, European and Eurasian Affairs, and Global Talent Management, should implement a plan to fully fund the locally employed staff defined benefit pension plan to comply with Belgiums labor laws and address long-term funding concerns.

Embassy Brussels should cease paying for residential internet for vacant residences that do not have an alarm system connected to internet, in accordance with Department standards.

Embassy Brussels should categorize, assess, and authorize its locally developed applications in accordance with Department standards.

Embassy Brussels should replace the unauthorized wireless access points operating within its facilities with an approved wireless network.

Embassy Brussels, in coordination with the U.S. Mission to the North Atlantic Treaty Organization, should obtain proper approval for its video conferencing system in accordance with Department standards.

Embassy Brussels, in coordination with the U.S. Mission to the European Union and the U.S. Mission to the North Atlantic Treaty Organization, should implement a records management program that complies with Department standards.

We recommend the DHS Chief Financial Officer ensure FEMA conducts payment integrity testing of the Funeral Assistance program.

We recommend the DHS Chief Financial Officer ensure FEMA assesses and conducts payment integrity testing, as applicable, for any program with COVID-19 funding that meets the Payment Integrity Information Act of 2019 threshold.

We recommend the DHS Chief Financial Officer ensure DHS’ Risk Management and Assurance Division follows OMB requirements for programs that do not comply with the Payment Integrity Information Act of 2019, as stated in Appendix C of OMB Circular A-123.

Establish, document, and implement a process for the Department to track contractor employees' PIV cards and record the dates the cards are collected and deactivated.

Designate in writing points of accountability for overseeing the entirety of contractor employee PIV card collection and deactivation processes.

Update or supplement the DOT PIV Card Program Order to define "promptly" in all uses throughout the Order.

Develop and implement required annual training for all staff involved in contractor employee PIV card processes and a procedure to verify the training has occurred. The training attendees should include all staff listed in the DOT PIV Card Program Order who could potentially be involved and anyone else an individual OA assigns to this task.

Update or supplement the DOT PIV Card Program Order to address the deactivation process in all instances where PIV cards are no longer needed. This should include establishing the accountable officials as well as concrete metrics when deactivation should occur from when the card is no longer needed.

Implement adequate policies, procedures, and controls to ensure that public housing properties will be inspected within required timeframes.

Status

We recommend that the Office of Refugee Resettlement strengthen oversight of transfers between care provider facilities by requiring that all transfer documentation be maintained in the UC Portal and by developing procedures for tracking and reviewing that documentation.

The Commissioner, Small Business/Self-Employed Division, should continue to identify new tax accounts with a Social Security tax deferral at least through Calendar Year 2024 to ensure that all unpaid deferrals are identified for collection as appropriate.

Establish an improper payment council within HUD that consists of senior accountable officials from across the Department with a role in the effort that would work to identify risks and challenges to compliance and identify solutions as a collaborative group.

We recommend that Retirement Services develop and implement additional cost-effectivecorrective actions, aimed at the root causes of improper payments, to further reduce theimproper payments rate.

Second Consecutive Year of Non-Compliance:a. FSA should propose to the director of OMB in its next budget submission additional program integrity proposals for ECP that would help the program come into compliance. This process will unfold as part of the annual development of the President’s budget. In the budget submission, the agency should describe how each proposal would help the program come into compliance.b. If the director of OMB determines that additional funding would help the program become compliant, the agency should obligate an amount of additional funding determined by the director of OMB to intensify compliance efforts. When providing…

Rec. 2.b: The DoD OIG recommended that the Director, Defense Finance and Accounting Service develop and implement additional controls to identify and review high risk payments, and to make certain that the post pay reviews are adequately identifying improper payment amounts.

Create a detailed plan for how each TXS capability will be implemented and develop benchmarks, performance measures, and milestones.

(U) Rec. 1: The DoD OIG recommended that the Director, Defense Security Cooperation Agency, in coordination with the Tri-Service Committee member representatives, review, analyze, and update the list of defense articles currently designated as requiring Enhanced End-Use Monitoring.

(U) Rec. 2.a: The DoD OIG recommended that the Director, Defense Security Cooperation Agency, update the Security Assistance Management Manual to develop and implement a process for which defense articles no longer requiring Enhanced End-Use Monitoring be removed from the list, similar to the process currently in place for adding a defense article for Enhanced End-Use Monitoring, via "Designating Defense Articles for Enhanced, End-Use Monitoring (EEUM)," Figure C8.F1.

(U) Rec. 2.b: The DoD OIG recommended that the Director, Defense Security Cooperation Agency, update the Security Assistance Management Manual to add a recurring requirement to review and update the list of all defense articles provided to foreign nations to ensure designation of those requiring Enhanced End-Use Monitoring.

The U.S. Agency for Global Media, in coordination with Voice of America, should systematically track and review the metrics on all stages in Voice of America’s federal hiring processes to gather actionable analytics for possible adjustments to these processes.

Radio Free Europe/Radio Liberty should systematically track and review the metrics on all stages in its hiring processes to gather actionable analytics for possible adjustments to these processes.

Voice of America should implement practices to ensure adherence to editorial review standards by the Russian Language Service prior to content dissemination.

The U.S. Agency for Global Media should improve and disseminate procedural guidance for grantee organizations covering distribution and receipt of Ukraine Supplemental Appropriations Act funding.

We recommend that the Health Resources and Services Administration require the 10 health centers identified in our report as having charged unallowable COVID-19 supplemental grant funding costs to refund $787,152 (less any amounts health centers voluntarily refunded as a result of our audit) to the Federal Government.

We recommend that the Health Resources and Services Administration work with the 13 health centers identified in our report that may not have properly allocated COVID-19 supplemental grant funding costs to determine what portion of the $15,056,835 is allocable to their COVID-19 supplemental grant funding and require the health centers to refund the improperly allocated funds to the Federal Government.

We recommend that the Health Resources and Services Administration assist the 17 health centers identified in our report as having charged unallowable costs or potentially improperly allocated costs to implement HRSA's guidance for developing and maintaining financial management systems and internal controls that ensure that only allowable, allocable, and documented costs are charged to their HRSA supplemental grant funding.