Open Recommendations

that the Director develop a strategy and structure that integrates information security into the agency’s business operations. This should include an established responsibility for assessing information security risks in all agency programs and operations and providing this analysis to senior leadership, including the ERM Council, for decision-making.

OIG recommended that the Director appoint the chief information security officer to serve on the Enterprise Risk Management Council as a voting member

OIG recommended that that the Director further define and implement the Enterprise Risk Management program to ensure information security risks are communicated and monitored at the system, business process, and entity levels.

OIG recommended that the Chief Information Officer perform a full security assessment of the General Support System to obtain a complete understanding of system weaknesses

OIG recommended that the Peace Corps consistently improve and implement its inventory management process to ensure information system, hardware, and software inventories are accurate, complete, and up-to-date.

We recommend the Acting Assistant Secretary for Employment and Training: Use data collected from monitoring and BAM reports to identify the areas of highest improper payments including fraud and create a plan to prevent similar issues in future temporary UI benefit programs.

We recommend the Acting Assistant Secretary for Employment and Training: Work with NASWA to update the IDH Participant Agreement to require state to submit the results of their UI fraud investigations.

We recommend the Acting Assistant Secretary for Employment and Training: Work with NASWA to ensure the IDH cross matches are effective at preventing the types of fraud that were detected during the pandemic and regularly update using the results of state fraud investigations.

Ensure that risks are appropriately categorized and prioritized on the Board’s cybersecurity risk register.

Ensure that an enterprisewide software inventory is conducted and maintained.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to
a. quantify and aggregate security risks,
b. normalize cybersecurity risk information across organizational units, and
c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Fully establish a process to collect and analyze customer feedback.

Explore alternative means of collections for PPP loans with an outstanding balance of $100,000 or less.

Conduct an initial and periodic cost benefit analysis on PPP purchase guarantees with comprehensive estimates to sufficiently assess whether the cost of collecting loans of $100,000 or less is more than the recovery amount and pursue collections based on results of the analysis.

We recommend that Humana, Inc. refund to the Federal Government the $34,414,828 of estimated overpayments.

We recommend that Humana, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Humana, Inc. examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

Establish a timeliness goal for resolution of Numident death alerts.

Establish management controls to periodically ensure Numident death alerts are resolved in a timely manner.

Consider working with the States to expand access to electronic vital records.

Update quality control reviews to include comparison of SSNAP inputs to an applicant-submitted Form SS-5 and evidentiary documents, and provide feedback to the technicians who made input errors (such as race and ethnicity) or did not use the appropriate evidentiary documents.

Revise enumeration policy to include clear instructions for when Form SSA-5002 is required and how to properly document the form.

Create and implement automated tools to assist staff in navigating through enumeration evidentiary document requirements.

Complete the privacy assessments for the WorkTrack application.

Take the necessary and progressive steps needed to hold the contractor accountable for obtaining a staffing level of at least 85 percent of the contractually obligated amount, including the medical department.

Ensure each detainee receives both an intake dental screening as well as an initial dental screening.

Evaluate and amend the dental referral process to ensure a timely response for dental pain cases, including timely evaluation of quarantined patients by dentists.

Ensure required documentation is promptly added to detainee medical files and that the documentation includes: notes from intake dental screening and follow-up dental evaluation(s);records of medication administration; and • lab test results.

Ensure cabinets with controlled substances are locked when not in use and that only personnel needing access to the controlled substances have access.

Ensure our other medical observations are addressed, including that: • detainees have access to water and restrooms while they are in the medical waiting area; • appropriate testing is provided for all asthma patients; • medical evaluations match complaints submitted by detainees; • appropriate medication is provided to detainees with high cholesterol; and • expired medication is disposed of according to the disposition schedule and in a timely manner.

Update classification procedures to require an ICE Custody Classification Worksheet be completed and added to each detainee’s file at admission.

Provide timely responses to detainee requests and keep a log of detainee requests submitted via paper forms.

Allow detainees access to legal calls as required.

We recommend the FEMA Associate Administrator for Response and Recovery develop a process to ensure FEMA components comply with FEMA’s Mission Assignment Guide, requiring the formulation of comprehensive cost estimates during initiation and throughout the performance period for mission assignments.

We recommend the FEMA Associate Assistant Administrator for Response and Recovery evaluate the resources and other process improvements needed to ensure unliquidated obligations financial data are obtained, reviewed, and reported, as required per FEMA guidance.

We recommend the FEMA Deputy Administrator develop a risk-based process for reviewing documentation that supports mission assignment expenditures and apply this process to COVID-19 mission assignments to ensure eligibility of claimed costs.

We recommend the Federal Emergency Management Agency Region II Administrator establish internal controls to ensure properseparation of duties related to the review, approval, and disbursement of Disaster Case Management Program funds to prevent potential fraud, waste, and abuse.

We recommend the Federal Emergency Management Agency Administrator establish policies and procedures for the Disaster CaseManagement Program when the program is not awarded to the State or Territory. The policies should address how FEMA will perform oversight and monitoring and how FEMA will ensure that standards for financial management systems and compliance with the Uniform AdministrativeRequirements, Cost Principles and Audit Requirements for Federal Awards (2C.F.R. Pt. 200) are met.

We recommend the Federal Emergency Management Agency Region II Administrator review all documentation supporting the $65million Disaster Case Management Program reimbursements to the Providers and ensure the documentation is adequate and in accordance with 2 C.F.R. § 200.302(b)(3), 200.400(d), and 200.403(g).

We recommend the Under Secretary for the Office of Strategy, Policy, and Plans: Develop and implement DHS-specific guidance on lines of authority for future UCGs formed for events requiring government-widecoordination.

Update the additionality guidelines and checklist to: a) explicitly state the minimum documentation requirements for establishing additionality whether that be source documentation or contemporaneous memos with the required elements of source, timing, and context

We recommend that the BIE work with the Turtle Mountain Band of Chippewa Indians to resolve the questioned costs of $216,878.

We recommend that the BIE require the Turtle Mountain Band of Chippewa Indians to develop and implement internal controls that will ensure administrative costs claimed support school operations.

Use the fraud risk inventory to enhance program-specific fraud risk assessments for the TBRA and Operating Fund programs.

Use the fraud risk inventory to enhance program-specific fraud risk assessments for the HOME program.

Implement a policy identifying criteria for the inclusion of a service within the Working Capital Fund (WCF); once the criteria are formalized, JMD should evaluate and ensure that the services currently included in the WCF are appropriate, meet the documented criteria, and are clearly presented to the WCF Board for discussion of any necessary changes.

Review the Office of the Chief Information Officer's (OCIO) cost allocation methodology and update as necessary to ensure that component cost allocations are sensible, equitable, and commensurate with benefits of the services provided.