Open Recommendations

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

Develop and communicate an organization wide Supply Chain Risk Management strategy and implementation plan to guide and govern supply chain risks.

Undertake a strategic analysis of the Inspector General FISMA Metrics and the weaknesses identified in the audit, to develop a multi-year strategy and approach to include objective milestones, and resource commitments by the Department and the CIO that address the corrective actions
necessary to show steady, measurable improvements towards an effective information security program.

Work with the Federal Aviation Administration's CIO and Federal Motor Carrier Safety Administration's Information Security System Manager (ISSM), to investigate and remediate cross-site scripting vulnerabilities identified in public facing web applications.

Work and coordinate with system owners to identify and remediate weak and default authentication mechanisms within their systems and the Common Operating Environment.

Develop and implement a process to facilitate centralized monitoring, oversight (by ISSMs and their alternates) and escalation efforts to ensure the timely completion of required security awareness training and role based training for all DOT personnel leveraging an automated integrated solution(s) and dashboards.

OIG recommends that the Bureau of Administration develop and implement internal controls to ensure Contracting Officers comply with Federal Acquisition Regulation Subpart 6.305, Office of the Procurement Executive Procurement Implementation Bulletin 2014-11, and Office of Acquisitions Management Memorandum 16-16 regarding providing public notice of noncompetitive contracts and maintaining proof of public notice in contract files.

OIG recommends that the Bureau of Administration issue a directive to the Office of Acquisitions Management to update its Quality Assurance Plan to expand the steps necessary to ensure compliance with Federal Acquisition Regulation provisions regarding preparing fair and reasonable price determinations for noncompetitive awards. The steps should include requiring that Contracting Officers use the sample template for price negotiation memoranda and retain evidence of the analysis conducted in support of such determinations in the contract files.

OIG recommends that the Bureau of Administration develop and implement guidance directing all price negotiation memoranda-approving officials certify that price negotiation memoranda address all required elements in compliance with Federal Acquisition Regulation Subpart 15.406-3 before approving them.

OIG recommends that the Bureau of Administration issue a directive to the Office of Acquisitions Management to update its Memorandum 15-09, Contract File Documentation, regarding price negotiation memoranda. The updated memorandum should include instructions for Contracting Officers to verify that all price negotiation memoranda packages are properly approved and placed in the contract file.

OIG recommends that the Bureau of Administration develop and implement additional internal control procedures for monitoring compliance with Federal Acquisition Regulation requirements and Department policy regarding determining and documenting fair and reasonable price determinations and maintaining complete contract files.

Develop and implement root cause analysis training for inspectors more in line with training in the aviation industry.

Develop and implement a management control to ensure inspectors require air carriers to provide written root cause analyses and that these analyses do not specifically identify human factors issues as root causes.

Sensitive information redacted

We recommend that the Tennessee State Medicaid Agency refund to the Federal Government $397,341,616 in overpayments representing the Federal share of CPEs that the State agency claimed in excess of the allowable amount.

We recommend that the Tennessee State Medicaid Agency provide support for or refund to the Federal Government $370,119,499 for the net costs of caring for uninsured IMD patients for which the State agency did not provide detailed supporting documentation.

We recommend that the Tennessee State Medicaid Agency establish additional policies and procedures to ensure compliance with the STCs including policies and procedures for adjusting the CPE estimates to actual costs on the CMS-64s upon determining that hospitals have been overpaid or underpaid.

We recommend that the Tennessee State Medicaid Agency establish additional policies and procedures to ensure compliance with the STCs including policies and procedures for collecting and maintaining patient-level detail data for the uninsured population for the IMDs.

We recommend that the Tennessee State Medicaid Agency establish additional policies and procedures to ensure compliance with the STCs including policies and procedures for ensuring that the State agency identifies and excludes from its actual CPE calculations the net costs of caring for IMD patients between the ages of 21 and 64.

We recommend that the Tennessee State Medicaid Agency establish additional policies and procedures to ensure compliance with the STCs including policies and procedures for reviewing the actual CPE calculations of its contractor.

OMB should engage with Congress to consider legislating amendments to extend independent oversight of USAspending.gov data submissions, including developing new requirements in consultation with CIGIE and the PRAC for the review of agency award descriptions.

OMB should conduct a feasibility study, in coordination with relevant federal and non-federal stakeholders, as to how to better track and report subrecipient funding.

OMB should engage with Congress to consider legislating amendments to extend independent oversight of USAspending.gov data submissions, including developing new requirements in consultation with the CIGIE and the PRAC for the review of subrecipient reporting.

CMS should monitor national EPSDT performance data for blood lead screening tests and target efforts toward low-performing States to develop action plans for increasing tests, according toMedicaid's schedule

CMS should ensure consistency across CMS guidance related to actionable blood lead reference values and blood lead screening test definitions.

CMS should coordinate with partners to develop and disseminate to State Medicaid agencies educational materials that reaffirmrequirements and schedules for blood lead screening tests

We recommend ICE’s Records Officer, in conjunction with the Executive Assistant Director for Enforcement and RemovalOperations, update all policies, guidance, and contracts for detention facilities to ensure compliance with the National Archives and Records Administration’s record retention schedules.

Complete a program-specific fraud risk assessment and risk profile for the CDBG and ESG programs, with emphasis on CARES Act funding, and replicate this process to create program-specific fraud assessments and risk profiles for other CPD programs.

Consider OIG's fraud risk inventory to improve CPD's own fraud risk assessments and develop a program-specific fraud risk map and compendium.

Implement efforts to increase the awareness of fraud at all levels (headquarters, field offices, grantees, subrecipients, etc.), including but not limited to regularly publishing articles on known fraud schemes and identified instances of fraud in periodic newsletters or on CPD's intranet website, providing recurring fraud risk trainings to HUD employees and grantees and working with OIG to develop materials to support fraud awareness.

Develop and implement a fraud risk checklist or other instrument as part of CPD's monitoring oversight requirements, to be completed as part of each remote and onsite monitoring review.

Develop and implement a fraud analytics strategy using available data, including but not limited to data and information collected during the grantee risk assessment and monitoring processes, to begin conducting data analyses to identify potential fraud risks for further review.

We recommend the Administrator direct the Associate Administrator for Disaster Assistance to• review the applications of sole proprietors and independent contractors that included numbers of employees but no Employer Identification Number; and• remedy the $3.5 billion disbursed to sole proprietors and $1 billion disbursed to independent contractors that exceeded the amount allowed by SBA’s policy.

Develop an enterprise architecture that includes information security considerations and the resulting risk to the Agency, as well as incorporates STB's existing cyber security architecture.

Implement documented processes for collecting and reporting performance metrics at the organization and system level to assess the effectiveness of Information Security Continuous Monitoring program.

Develop a process to make improvements to the effectiveness of its ISCM program through the collection and reporting of quantitative and qualitative performance metrics, and lessons learned.

We recommend that the Substance Abuse and Mental Health Services Administration update its policies and procedures to require verification that accreditation bodies maintain records that contain sufficient detail to support each accreditation decision.

We recommend the Acting Administrator for the Wage and Hour Division develop a mechanism to enable the agency to determine how effective conciliations are at getting back wage payments to workers, and address any weaknesses identified in ensuring complainants received owed back wages prior to closing conciliations.

We recommend the Deputy Secretary Ensure the CIO is a lead member with voting rights of DOL’s executive strategy and management boards and committees including but not limited to the MRB, ESS Governance Board, COVID-19 Coordination team, and ERMC.

We recommend that the Acting Assistant Secretary for Occupational Safety and Health implement a policy for future emphasis programs, that minimizes the lapse in enforcement between canceled, revised or new programs.

We recommend that the Acting Assistant Secretary for Occupational Safety and Health establish meaningful goals and processes to assess whether OSHA’s outreach events are achieving the desired results, in reaching a targeted number of workers at risk of exposure to silica.

We recommend the following to the Principal Deputy Assistant Secretary of Employment and Training: Examine the effectiveness of Benefit Accuracy Measurement’s contact verification process to ensure it reflects the current methods claimants use to seek work.

We recommend the following to the Principal Deputy Assistant Secretary of Employment and Training: Provide guidance to states notifying them that formal and informal warnings are not permissible under Federal work search law.

We recommend the following to the Principal Deputy Assistant Secretary of Employment and Training: Include in the UI improper payment estimate: (1) overpayments related to work search formal and informal warnings; and (2) payments to claimants who provide no or insufficient documentation to support eligibility with respect to work search, consistent with the Middle Class Tax Relief and Job Creation Act and OMB guidance that defines improper payments.

Implement a plan that brings the five new noncompliant land use agreements into compliance with the West Los Angeles Leasing Act of 2016, the draft master plan, and other federal laws, allowing reasonable time to correct deficiencies noted in this report.

Review unreimbursed official travel conference expenses identified during the audit and reimburse those employees for eligible expenses.

Review, update, and implement revised NARA 601, NARA Travel Policy, and NARA Travel Card Management Plan to reflect current practices, and the current versions of Federal Travel Regulation and Appendix B to OMB A-123, A Risk Management Framework for Government Charge Card Programs.

(U) Rec. 3: The DoD OIG recommended that the Commander, Naval Air Forces, assess the actions implemented to address corrosion and determine whether these actions resulted in fewer instances of corrosion that should have been identified at the organizational level during the service life extension process, reduced costs associated with corrosion prevention or correction, or improved readiness measured in either operational availability or mission capability. If the actions have not reduced the number of instances of corrosion that should have been identified at the organizational level, reduced costs, or improved readiness, then the Commander should identify alternate initiatives to address…