Open Recommendations

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Provide refresher or updated training to staff regarding the requirements and processes for reviewing auditees’ reporting packages.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats.

We recommend that the contracting officer disallow $1,876,349 in overcharges to the FEHBP due to procedure code modifier claim payment errors.

We recommend that the Director of CPD's Office of Disaster Recovery adopt LMI benchmarking to ensure that grantees budget adequate funds to LMI at significant milestones in the grant lifecycle.

We recommend that the Director of CPD's Office of Disaster Recovery make changes to the action plan process so that the action plan calculates an overall LMI percentage.

We recommend that the Florida Agency for Health Care Administration invoice for, and collect from manufacturers, an estimated $57,700 ($35,126 Federal share) in rebates for single-source physician-administered drugs and refund the Federal share of rebates collected.

We recommend that the Florida Agency for Health Care Administration ensure that all physician-administered drugs eligible for rebates after our audit period are processed for rebates.

We recommend that the Administration for Children and Families work with State agencies to ensure compliance with Federal requirements to report missing children episodes to NCMEC in a timely manner.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator policy-defined exigent situations and 18 U.S.C. 3125-defined emergency circumstances to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure privacy compliance documentation is completed and approved before developing or procuring information technology that collects, maintains, or disseminates information in identifiable form.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to modify the current QASP to ensure that NPSBN contract QASP items, for TOs 6 and 7, ae complete and sufficiently detailed to measure the contractor's performance regarding the quality of NPSBN services expected to be provided for the respective TOs.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to ensure the QASP is adequately updated for future reinvestment TOs and QASP items are complete and sufficiently detailed to measure the contractor's performance regarding the quality of NPSBN services expected to be provided for the TOs.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to ensure that any personnel conducting surveillance activities on the NPSBN are appointed, in writing, and complete any necessary training and certifications as required by the Commerce Acquisition Manual and/or the Federal Acquisition Regulation.

We recommend that the OCIO develop and implement a process to evaluate all systems' Authorizations to Operate annually for accuracy and completeness to ensure systems are operating with a valid authorization determined by actual residual risk.

We recommend that the OCIO develop and implement a process to conduct quality control reviews at least annually to ensure that all systems within the official system of record (Cyber Security Assessment and Management system) have an accurate operating status.

We recommend that the OCIO, in addition to ongoing continuous monitoring, develop and implement a policy to direct system owners to test all of the controls for their systems at least every 3 years.

We recommend that the OCIO develop and implement a policy to verify that bureaus and offices perform control assessments every 3 years.

We recommend that the OCIO develop and implement a review process that includes, at minimum, verifying that system owners have completed required testing for a sample of controls for each system before accepting the annual assurance statement.

We recommend that the OCIO develop and implement a comprehensive quality control plan to perform required quarterly reviews of Plans of Action and Milestones in the official system of record to ensure that bureaus and offices address them in a timely manner, close them as appropriate, and continuously monitor and track them.

We recommend that the FWS require the Department to develop and implement an internal control mechanism to ensure the program income method is properly applied and reported in accordance with grant award approvals and regulations.

We recommend that the FWS require the Department to amend all open subaward agreements to date to include all required elements.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

Incorporate the EPA's certification test report expectations set forth in the April 2022 corrective action list into the 2023 revisions to the New Source Performance Standards for residential wood heaters.

Develop and adopt an EPA cord wood test method that is supported by data to provide the public reasonable assurance that certified appliances meet emission standards.

Establish mechanisms to promote independence between emissions testing labs and third-party certifiers.

Develop and implement procedures to verify that airport sponsors have provided evidence satisfactory to FAA that the airport sponsor has or will obtain good title to land, prior to requesting reimbursement for costs associated with noise compatibility land acquisition. Implementing this recommendation could put up to $2,077,796 in funds to better use by requiring that only costs associated with completed noise land acquisitions are reimbursed.

Update and implement procedures to require airport sponsors to maintain Noise Land Inventory and Reuse Plans in electronic format available for FAA review, upon request.

Require all airport sponsors that have acquired noise land to identify noise land eligible for disposal via sale and verify that noise land sales revenues are used in accordance with Federal law. Based on our review of five airports, implementing this recommendation could put up to $38,530,768 in funds to better use by generating revenue that could be reinvested in the program.

Update guidance to clarify for airport sponsors when noise land should be considered no longer needed for eligible current or planned airport purposes and disposed of in accordance with FAA policy.

Update guidance for Noise Land Inventory and Reuse Plans to require that the Noise Land Inventory include original acquisition dates, estimated or final completion dates for proposed or completed methods of disposal, and the date of FAA approval.

Update guidance for Noise Land Inventory and Reuse Plans to require that the Noise Land Inventory include the Federal share of the sale price at the time of sale and how sales proceeds were used. Implementing this recommendation could put up to $66,160 in funds to better use by properly accounting for noise land disposal proceeds in accordance with Federal law.

Update the Noise Land Management and Requirements for Disposal of Noise Land or Development Land Funded with AIP policy to establish a reasonable schedule for FAA Airport District Offices and Regional Offices to review Noise Land Inventory and Reuse Plans for accuracy and consistency with FAA policy.

Require the Rhode Island T.F. Green International Airport, Phoenix Sky Harbor International Airport, and Harry Reid International Airport to develop and submit for FAA's approval current Noise Land Inventory and Reuse Plans after implementation of recommendations 4, 7, and 8.

We recommend that the Centers for Medicare & Medicaid Services notify appropriate providers (i.e., those for whom CMS determines this audit constitutes credible information of potential overpayments) so that the providers can exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

We recommend that the Centers for Medicare & Medicaid Services review at-risk payments made to at-risk providers during and after our audit period to determine whether payments for procedure code G0483 complied with Medicare requirements and recover any overpayments.

We recommend that the Centers for Medicare & Medicaid Services expand program safeguards to prevent and detect at-risk payments to at-risk providers for the definitive drug testing service with the highest reimbursement amount (procedure code G0483), which could have saved up to $215.8 million for our audit period.