Open Recommendations

Review Allied's requested amount for unallowable expenses under PSP3 and seek reimbursement for the overpayment.

The Acting Commissioner of Fiscal Service should update the PAM Access Management standard operating procedure to include procedures for modifying users' access to the PAM database.

The Acting Commissioner of Fiscal Service should ensure Fiscal Service personnel adhere to Treasury policy and follow Fiscal Service onboarding procedures to ensure all users sign a Rules of Behavior form before granting them access to Fiscal Service's systems and infrastructure.

The Acting Commissioner of Fiscal Service should evaluate the existing configuration of the DLP solutions to determine whether additional security controls are necessary to mitigate the risk of unsecured external transmission of low-risk PII and implement any additional identified security controls.

The Acting Commissioner of Fiscal Service should update Fiscal Service's Email and Instant-Messaging Policy to provide clarity on when low-risk PII constitutes Controlled Unclassified Information and disseminate the updated policy to all applicable Fiscal Service personnel.

The Acting Commissioner of Fiscal Service should implement a control to ensure all eligible Treasury Disbursing Offices payments disbursed through ITS.gov are matched against the TOP database.

The Acting Commissioner of Fiscal Service should implement a control for ITS.gov payments to ensure that a NonTreasury Disbursing Office cannot enter duplicate payment schedule numbers into ITS.gov within the same fiscal year.

The Acting Commissioner of Fiscal Service should implement a control to reject any payments with clearly invalid TINs and make the agencies resubmit the payments with valid TINs.

The Acting Commissioner of Fiscal Service should issue guidance to agencies explaining the importance of inputting TINs accurately, and include in the guidance a requirement that agencies notify Fiscal Service of the need to use clearly invalid TINs.

The Acting Commissioner of Fiscal Service should implement a supervisory control to ensure Fiscal Service personnel adhere to policy and validate only complete payment authority delegation and designation forms.

Work with Georgia Vocational Rehabilitation Agency (GRVA) to ensure it obtains formal approval from the cognizant Federal agency on the indirect cost rate proposal.

Ensure GVRA’s policies reflect compliance with Federal indirect cost requirements.

The West Palm Beach VA Healthcare System Director ensures 3C leaders are aware of and comply with Mental Health Environment of Care Checklist requirements on the inpatient mental health unit.

The West Palm Beach VA Healthcare System Director reviews the inpatient mental health patient safety observation practices to ensure compliance with VHA SOP 1160.06.1, Standard Operating Procedure for Maintaining Safety and Security on Inpatient Mental Health Units Under VHA Directive 1160.06, and Facility Medical Center Policy 118-01, Enhanced Observation Level requirements.

The West Palm Beach VA Healthcare System Director ensures staff performing patient safety observation on 3C receive recurring training on conducting observation practices, including face-to-face visualization, in alignment with VHA SOP 1160.06.1, Standard Operating Procedure for Maintaining Safety and Security on Inpatient Mental Health Units Under VHA Directive 1160.06, requirements.

The West Palm Beach VA Healthcare System Director develops and implements an oversight process for ongoing monitoring of inpatient mental health patient safety observation practices and documentation to ensure compliance with VHA SOP 1160.06.1, Standard Operating Procedure for Maintaining Safety and Security on Inpatient Mental Health Units Under VHA Directive 1160.06 requirements.

The West Palm Beach VA Healthcare System Director develops a plan to reassess the effectiveness of the oversight process.

The West Palm Beach VA Healthcare System Director ensures that when 3C leaders identify incongruencies between patient safety observation practice and documentation, 3C leaders conduct a review of the incident and take corrective action, as warranted.

The VA Caribbean Healthcare System Director ensures that facility leaders make decisions regarding the need for institutional disclosures independent of the peer review process in alignment with VHA Directive 1190 (1), Peer Review for Quality Management.

The OIG recommends that the Executive Director for Operations develop and issue supplemental guidance clarifying the expected implementation of cybersecurity controls, the interpretation of requirements, and methods for evaluating control effectiveness.

The OIG recommends that the Executive Director for Operations update Inspection Procedure 71130.10 to clarify the Cyber Security Issues Forum process and its potential impacts on findings and violations.

The OIG recommends that the Executive Director for Operations update Inspection Manual Chapter 1245, Appendix D-1, to include periodic refresher training requirements for cybersecurity-qualified inspectors.

The OIG recommends that the Executive Director for Operations define a schedule for contractor-led training (in-person or virtual), and ensure sessions are recorded and accessible.

The OIG recommends that the Executive Director for Operations revise the request for information guidance to require inspectors to identify the most current cybersecurity program documents already in the NRC’s possession before issuing the initial request, and to clearly communicate target dates for both issuing requests and receiving licensee responses.

The OIG recommends that the Executive Director for Operations train staff on the correct Cost Activity Codes for reporting fee-billable and non-billable cybersecurity inspection activities within the Human Capital Management Cloud System.

The OIG recommends that the Executive Director for Operations finalize the Cyber Security Issues Forum Draft Charter to include the Cost Activity Codes used by staff members when participating in or observing meetings.

The OIG recommends that the Executive Director for Operations develop clear guidance on the appropriate use of security oversight Cost Activity Codes.

The OIG recommends that the Executive Director for Operations develop and implement Enterprise Project Identifier codes for inspection oversight activities to improve tracking of safety and security related oversight activities.

Ensure compliance with environmental health and safety standards by establishing and implementing a plan to correct all environmental health and safety issues, including leaking pipes and vents.

Ensure compliance with use-of-force standards by ensuring facility staff follow all use-of-force standards, including documenting their initial use-of-force notifications to ICE, using appropriate force for each situation, and documenting remedial training and/or disciplinary action, where applicable.

Ensure compliance with voluntary work program standards by developing a process to track current and historical hours that detainees work as part of the Voluntary Work Program.

Ensure compliance with law libraries and legal material standards by: a. posting all required information uniformly across the facility and in accordance with standards; and b. providing detainees with a secure and private means of saving legal documents.

Ensure compliance with staff-detainee communication standards by: a. either removing the U.S. Postal Service mailboxes or covering up images and references to the Postal Service; b. ensuring detainees are aware that the decommissioned U.S. Postal Service mailboxes are not for communication with ICE; c. completing ICE electronic logs of detainee communications with all required information; and d. distinguishing between requests and grievances in the required log.

Establish policies and implement procedures that provide specific guidance to program managers for the identification of scientific information products that are influential. These procedures shall include a process for determining whether a scientific information product is a principal basis for a decision by a federal decision maker.

Train appropriate employees on the established policies and implement procedures for the identification of scientific information products that are influential.

Based on the lack of evidence that such an assessment was previously performed, perform an analysis on rulemakings conducted after the issuance of OMB’s M-19-15 and determine if a scientific assessment was the principal basis for a decision by a federal decision maker.

Based on the results of the analysis performed for recommendation 3, perform appropriate administrative corrective actions, if necessary.

Perform a risk assessment that covers compliance with the Information Quality Act.

Review account access permission levels in the agency clearance workflow so that only users with a valid business purpose have appropriate access.

Establish policies and procedures for monitoring activities of the agency clearance workflow, to include the review of master data, access authorizations, and system access.

Establish policies and procedures for monitoring activities for compliance with both OMB and agency-specific policies for performing pre-dissemination review of scientific information.

We recommend that USAID provide the program irregularities tracker for Sudan to cognizant officials at the Department of State.

We recommend that USAID provide the country monitoring plan for USAID's former humanitarian response in Sudan to cognizant officials at the Department of State.

We recommend that USAID ensure that humanitarian assistance award files for Sudan transferred to the Department of State are complete and include key monitoring information.

We recommend the FEC formally designate a COO role in accordance with the statutory requirements of GPRAMA and the implementing guidance in OMB Circular A‑11, Part 6. This includes ensuring that the COO is the deputy agency head or equivalent.

We recommend the FEC formally document the COO designation through an internal directive, organizational order, memorandum, or leadership charter, and notify OMB of the designations as required by OMB Circular A‑11. Documentation should clearly define the responsibilities, reporting relationships, and authority of the role to ensure compliance with federal performance governance requirements.

We recommend the FEC ensure the COO role is integrated into the agency’s enterprise performance framework, including participation in strategic planning, development of Annual Performance Plans and Reports, leadership of data‑driven performance reviews, and coordination of performance improvement activities. This integration should support effective execution of GPRAMA and OMB Circular A‑11 performance requirements and strengthen accountability for agency‑wide performance.

We recommend the FEC establish and implement a formal fraud risk assessment process aligned with OMB Circular A-123 and the GAO Green Book. The process should include identifying and assessing fraud risks, evaluating related control activities, assessing residual fraud risk, documenting results within the annual ICR, establishing formal governance and recurring assessment procedures, and providing fraud risk management training to responsible personnel.

We recommend the FEC establish and document an enterprise-wide policy governance framework that defines ownership, accountability, and requirements for periodic review and updating of directives, policies, and procedures, including mandatory review upon significant legal or regulatory changes.

We recommend the FEC update the identified directives, policies, and procedures to align with current statutes, regulations, OMB guidance, and National Archives and Records Administration approved records schedules.