Open Recommendations

(U) Rec. 4.d: The DoD OIG recommended that the Principal Director of Defense Pricing and Contracting, Office of the Under Secretary of Defense for Acquisition and Sustainment develop and implement plans, in coordination with the Principal Deputy Chief Information Officer, Office of the DoD Chief Information Officer, to ensure that contracting officers are aware of the DoD technical experience requirements for contracting officer's representatives who monitor contractor cybersecurity services or accept cybersecurity deliverables.

(U) Rec. 4.e: The DoD OIG recommended that the Principal Director of Defense Pricing and Contracting, Office of the Under Secretary of Defense for Acquisition and Sustainment direct the Defense Acquisition Regulations Council to revise Defense Federal Acquisition Regulation Supplement Part 239, "Acquisition of Information Technology," Subpart 239.71, "Security and Privacy for Computer Systems," to reflect current DoD cybersecurity policies.

(U) Rec. 5: The DoD OIG recommended that the Defense Acquisition University President revise the DoD contracting officer's representative training curriculum and materials, in coordination with the Principal Director of Defense Pricing and Contracting and the Director of the Defense Contract Audit Agency, to include detailed instructions for contracting officer's representatives to review and validate that contractor payment requests, including interim vouchers, are commensurate with performance to prevent improper payments.

We recommend that the CBP Commissioner and the ICEDirector coordinate with the DHS Secretary to contract with an independent,federally funded research and development center to complete a fullassessment of the staffing needs at the Southwest border and strategicallyimplement recommendations based on the assessment. The assessmentshould:• review existing staffing models and methodology for deploying personnelat the Southwest border and across the country and the impact ofcontinuously relying on details and overtime to temporarily fill staffinggaps; and• include factors within and outside of DHS’ control that are affectingworkloads and exacerbating staffing challenges to identify solutions thecomponents can accomplish as well as those…

We recommend that the CBP Commissioner and the ICE Director communicate the duties and responsibilities of the SBCC moreeffectively to frontline staff.

Develop an infrastructure strategy to increase the overall effectiveness of facilities management. The strategy should align infrastructure decisions with the BOP's mission; include one or more methodologies for allocating resources; and include short, medium, and long-range planning goals. As part of this strategy, the BOP should consider incorporating a portfolio-based repair model; a retention or disposal decision model; and business case analyses for new construction, as appropriate.

Develop and implement key performance indicators to track whether the BOP is meeting its infrastructure goals.

Establish an automated and comprehensive inventory for managing and tracking software licenses.

Develop and implement a comprehensive software licensing policy that includes a methodology for analyzing and maintaining software usage data to determine the software license needs of the agency.

Determine the allowability of the questioned transactions and recover $14,886,138, if applicable.

We recommend that the Office of Refugee Resettlement include a review of compliance by ICFs and EISs with all background check requirements and facility access as a part of ORR's routine site visit monitoring.

We recommend that the Centers for Medicare & Medicaid Services work with the MACs to recover $35,560 in improper payments made to providers for the 128 sampled enrollee days that did not meet Medicare requirements. 

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Conduct medical reviews of psychotherapy services, including services provided via telehealth, to verify that the services are documented and billed in accordance with Medicare requirements.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Implement system edits for psychotherapy services, including services provided via telehealth, to prevent payments for services that were billed incorrectly.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Strengthen educational efforts to make providers aware of educational materials on how to meet Medicare requirements and guidance for psychotherapy services, including services provided via telehealth.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS work with the MACs to take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Review MAC jurisdictions' LCD requirements for psychotherapy services to identify which provisions effectively promote program integrity, and consider additional steps that CMS could undertake to ensure appropriate coverage and payment for psychotherapy services across all jurisdictions.

Establish and implement a maintenance technician workforce plan that considers factors such as average training time, training requirements, and staffing turnover for a period longer than 1 year.

Include in its quarterly review process, privileged accounts with access to cybersecurity devices such as firewalls and the SIEM tool.

Complete the risk-based selection and procurement of additional audit logging tools needed to strengthen audit logging tools, retention, and visibility to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Acquire the additional resources needed to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Complete implementation of OMB M-21-31 to achieve past due Event Logging 1 and 2 maturity levels and to meet the Event Logging 3 maturity due by August 27, 2023.

We recommend that the GSA Administrator, FAS Commissioner, and Associate Administrator of the Office of Government-wide Policy address the problems with the TDR data and usage as described in this report within 1 year of report issuance. To do so, GSA should, at a minimum: conduct a comprehensive assessment of all TDR data; verify the accuracy and completeness of all TDR data; implement a verification process to ensure that TDR data is accurate and complete when it is submitted by MAS contractors; require the contractors that are not submitting complete and accurate data to correct their data or suspend their…

Embassy Juba should submit its FY 2022 annual Statement of Assurance in accordance with Department standards.

Embassy Juba should install signage at the Consular Section’s public entrance with all information required by Department guidance.

Embassy Juba should bring its consular cashiering operations into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should bring the privacy booth into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should upgrade the booth in the West Compound Access Control to allow the consular cash register to be located there, bringing oversight of consular cashiering operations into compliance with Department standards.

Embassy Juba, in coordination with the Bureau of Consular Affairs, should bring its developmental training program into compliance with Department standards.

The Bureau of African Affairs, in coordination with the Foreign Service Institute, should evaluate and provide resources to assist with improving communication and coordination within the Management Section and with the U.S. Agency for International Development alternate service provider.

Embassy Juba, in coordination with the Bureau of Global Talent Management, should update the embassy’s local compensation plan to comply with South Sudanese labor laws.

Embassy Juba should complete all information systems security officer responsibilities, in accordance with Department standards.

Embassy Juba should implement procedures to maintain documentation for all aspects of its computer support and operations, in accordance with Department standards.

Embassy Juba should complete information technology contingency plans for the unclassified and classified networks and test the plans, in accordance with Department standards.

Embassy Juba should implement standard operating procedures to manage its mobile devices and a policy on the personal use of mobile devices, in accordance with Department standards.

Embassy Juba should develop mail screening standard operating procedures and disseminate it to local guard and mail room staff.

The Bureau of African Affairs, in coordination with the Bureau of Administration and Embassy Juba, should take appropriate action to assist the embassy with its annual inventory and reconciliation for fiscal years 2022 and 2023.

We recommend that Indian Affairs coordinate with the Division of Facilities Management and Construction and the BIA Office of Justice Services to develop and implement a plan to identify and address all critical health and safety issues at the facilities mentioned in this management advisory. This plan should include, at a minimum, specific corrective actions and associated milestones for each identified issue.

We recommend that the Board chair or a designee develop a process to verify the accuracy of the information on financial disclosure reports for individuals subject to the Investment and Trading Policy. As part of this effort, a. require covered individuals to provide brokerage statements to their respective ethics officer for all accounts with holdings and transactions reported on their annual financial disclosure report.b. update financial disclosure review guidance to include the use of employee-provided brokerage statements to check annual financial disclosure reports for accuracy and completeness.

We recommend that the Board chair or a designee develop an approach to verify the accuracy of the information on financial disclosure reports for individuals who have access to confidential Class I FOMC information and are not covered by the Investment and Trading Policy. As part of this effort,a. determine the method and frequency for checking the accuracy and completeness of financial disclosure reports against brokerage statements, for example, by conducting periodic random sampling or full reviews.b. update financial disclosure review guidance to include the use of employee-provided brokerage statements to check annual financial disclosure reports for accuracy and completeness…

Revise the Transport Airplane Risk Assessment Methodology (TARAM) handbook to incorporate current safety data, including available international data when appropriate.

Review the TARAM handbook's quantitative safety guidelines to determine if they still meet the Agency's needs, and implement identified corrections as appropriate.

Review the TARAM and Transport Airplane Safety Manual (TASM), address any identified key differences the two documents, and integrate TASM into TARAM when appropriate.

Identify lessons learned related to the application of the 737 MAX recertification and the Continued Operational Safety process that have not yet been addressed and include them into airplane certification and safety evaluation processes.

We recommend that the Centers for Medicare & Medicaid Services establish a comprehensive data-sharing agreement with VHA for the ongoing sharing of data.

We recommend that the Centers for Medicare & Medicaid Services establish an interagency process to integrate VHA enrollment, claims, and payment data into the CMS IDR to identify potential fraud, waste, and abuse under the Medicare program.

We recommend that the Centers for Medicare & Medicaid Services establish an internal process (such as system edits) to address duplicate payments made by Medicare for medical services authorized and paid for by VHA, which could have saved Medicare up to $128 million during our audit period.

We recommend that the Centers for Medicare & Medicaid Services issue guidance to providers on not billing Medicare for a medical service that was authorized by VHA.

We recommend that Crow/Northern Cheyenne Hospital, Billings Area Office, and Indian Health Service Headquarters work together to take action to complete background investigations for staff members identified in this report as not having a satisfactory background investigation and adjudicate the investigations that were still pending adjudication.

We recommend that Crow/Northern Cheyenne Hospital, Billings Area Office, and Indian Health Service Headquarters work together to update standard operating procedures for background investigations to address the deficiencies we identified in this report.

We recommend that Crow/Northern Cheyenne Hospital, Billings Area Office, and Indian Health Service Headquarters work together to establish a monitoring system to ensure all elements of required background investigations in accordance with Federal requirements are completed within required timeframes.