Open Recommendations

We recommend that OPM's Contracting Officer assess the Carrier $100,559 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer assess the Carrier $56,697 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer require the Carrier to return $957,512 to the FEHBP for the underpayment of drug manufacturer rebates and corresponding administrative fees that were withheld by the PBM for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $90,895 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Carrier return $45,986 to the FEHBP for the Federal group's portion of the penalties that were paid by the PBM to the Carrier for missed performance guarantees from CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $5,595 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Florida Agency for Health Care Administration resume and enhance procedures that are in accordance with Federal requirements and the State's unwinding plan to identify and disenroll enrollees who are residing and enrolled in Medicaid managed care in another State when the PHE ends.

We recommend that the Florida Agency for Health Care Administration work with CMS to consider the potential use of T-MSIS data to identify potential cases of concurrent enrollment.

We recommend that OPM request that NFC revise the CLER system platform to establish an excessive discrepancy code fail count threshold and oversee the system to hold both agency payroll offices and Carriers accountable for making progress to resolve all discrepancy codes within an established period of time.

We recommend that OPM conduct a comprehensive overview of the 2809/834 Companion Guides and 834 layouts to address dependent terminations due to tier reductions and changes to ensure all possible value combinations advise Carriers of the applicability of the 31-day EOC as required under the Standard Contract terms.

We recommend that OPM review its current and archived FEHB CLs on its website, OPM.gov, to ensure that all CLs are posted and available for Carriers and other users.

We recommend that OPM develop procedures to monitor and enforce progress towards resolution of the CLER for fail counts of 4 or higher for code 160. This includes ensuring payroll offices and Carriers are aware of and resolving the enrollment discrepancies. OPM should also consistently adjust Carrier Plan Performance Assessments for excessive discrepancy code 160 fail counts as a method of enforcing the terms of the Standard Contract.

We recommend that OPM conduct a comprehensive overview of the paper SF 2809 and the OPM 2809 Form to ensure all necessary information is reported for Carriers to process dependent terminations and determine 31-day EOC applicability as required under the Standard Contract terms.

(U) Rec. 3: The DoD OIG recommended that the Chief Information Officer for the Air Force require that the authorizing officials for the Tailored Multitenancy Integrated Service and Cloud One systems reevaluate the authorizations to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and DoD authorization processed and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.

Determine the allowability of the questioned transactions and recover $3,546,767, if applicable.

The Chief, Appeals, should establish a process with the appropriate Business Operating Divisions (BOD) to identify, track, and update forms, letters, publications, notices, websites, and social media that still require the new IRS Independent Office of Appeals name.

Update DOL entity-wide and system-level security policies, procedures, and plans to comply with NIST SP 800-53, Rev. 5.

Implement data loss prevention tools and alerts based on the results of agencies’ data exfiltration tests.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

Perform an AHP workforce planning analysis using the minimum examination frequencies for AHP risk areas established in response to Recommendation 1 to determine current and future examination needs and address any staffing gaps identified.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, remove all unauthorized unmanaged applications from all DoD mobile devices.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, assess all unmanaged applications for operational and cybersecurity risks and remove those with unacceptable risks or without a justifiable need from users mobile devices and Component application stores.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately assess mobile device users' access to public application stores and remove access of those without a justifiable need. If unable to remove mobile device users' access, require Components to develop and implement policy that defines the acceptable use of public application stores and requires periodic assessments of mobile device users downloads to determine that all applications have a justifiable need.

(U) Rec. 2.a: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, define the acceptable use of DoD mobile devices and mobile applications for official DoD business and personal use.

(U) Rec. 2.b: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the cybersecurity and operational security risks of 1) user access to unmanaged applications without cybersecurity assessments through Component application stores or public application stores, and 2) mobile device features, including geolocation, screen capture, copy and paste, and camera, among others.

(U) Rec. 2.c: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the DoD records management requirements of DoD Instruction 5015.02, "DoD Records Management Program," February 25, 2015 (Incorporating Change 1, August 17, 2017) and the Deputy Secretary of Defense memorandum "Records Management Responsibilities for Text Messages," August 3, 2022.

(U) Rec. 2.d: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to provide regularly scheduled training to DoD mobile device users on the responsible and effective use of mobile devices and applications, including electronic messaging services, in accordance with DoD Chief Information Officer memorandum, "Mobile Application Security Requirements," October 6, 2017, and DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," January 2, 2019 (Incorporating…

(U) Rec. 2.e: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to justify and approve the mission requirements for all managed and unmanaged applications and limit access to only those applications with a justified and approved need.

(U) Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Information Systems Agency Chief Information Officer, revise DoD policy and memorandums and Defense Information Systems Agency mobile application documentation and training to ensure the use of common terminology when referring to approved, managed, DoD-controlled, authorized, and official applications; and unmanaged, non-DoD-controlled, unauthorized, non-official, and personal-use applications.

Establish a documented annual enterprise-wide examination planning process that aligns with the multiyear, comprehensive Examination Strategic Plan.

Develop a tool to consider risk and other relevant variables to inform examination resource allocation decisions, then expand its use to include Examination workstreams from all divisions.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed opioid medications are maintained in accordance with requirements by implementing procedures requiring caseworkers to monitor Medicaid claim data for opioid medications prescribed for the children and providing training to caseworkers on the requirements for documenting medications prescribed for the children in MiSACWIS, including opioid medications due to medical procedures or emergency treatments.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed psychotropic medications are maintained in accordance with requirements by implementing policies specific to non-emergency situations that require the FC-PMOU to document when consent forms do not need to be obtained; implementing procedures for caseworkers and the FC-PMOU to monitor the Medicaid claim data to ensure consent forms are obtained and documented; and implementing procedures requiring caseworkers and the FC-PMOU to monitor other medications prescribed for children, including opioids, for potential medication interaction and adverse side effects.

We recommend that the Michigan Department of Health and Human Services ensure that electronic case records for the children under its care and supervision are maintained in accordance with State requirements by modifying procedures for the monitoring of caseworkers to include a review of medical passports in MiSACWIS.

KPMG recommends that ESC management create monitoring procedures over the existing management review of the JV control logs monthly reconciliation to ensure the consistent operation of the control, as defined within policy.

KPMG recommends that FAA management perform a risk assessment to consider the potential impact of discrepancies between vendor-submitted invoice web portal amounts and the vendor-submitted supporting documentation, and respond to the level of risk identified as appropriate.

KPMG recommends that FAA management design and implement controls to ensure that the population generated to support the disclosure of future minimum lease payments is complete and accurate.

KPMG recommends that FAA management design and implement control activities to monitor the effective operation of its process controls related to provisioning new payroll shared service center access requests.

KPMG recommends that FAA management develop policies and procedures for maintaining completed and authorized payroll shared service center access forms for new user access requests in a secure centralized location.

KPMG recommends that FAA management design and implement control activities to monitor the effective operation of its process controls related to monitoring FAA employees' payroll shared service center access.

KPMG recommends that FAA management take measures to ensure that FAA has sufficient control operator personnel available to support the annual recertification of FAA employees with payroll shared service center access within the reporting timeline prescribed by DOT.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits work with CMS to determine the unallowable portion of $684,731 (Federal share) for other claims for multiple-source physician-administered drugs that may have been ineligible for Federal reimbursement, refund that amount, and consider invoicing drug manufacturers for rebates for these drugs if CMS determines that the drug claims are allowable.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits work with CMS to determine and refund the unallowable portion of Federal reimbursement for physician-administered drugs that were not invoiced for rebates after December 31, 2019.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits to strengthen its internal controls to ensure that all physician-administered drugs eligible for rebates are invoiced.

Ensure compliance with segregation standards, including having a basis for use of restraints and providing access to recreation, library, mail, and religious services.

Ensure all unaddressed facility conditions that we identified as deficient (torn bedding and plumbing issues) are corrected.

Ensure facility staff are aware of what criteria constitute a use of force event and reinforce the practice of documenting and reviewing such events.

Ensure paper forms for facility requests are available, collected, logged, and responded to within 3 business days of receipt.