Open Recommendations

Coordinate with the Office of the Chief Risk Officer (OCRO) to properly identify the National Service Trust Fund’s financial reporting risks and incorporate those risks into the OCRO’s annual testing of key controls. (modified repeat)

Develop a succession plan to ensure the required expertise is available in anticipation of planned employee turnover, particularly with respect to the complex trust calculations. CNCS needs to: (a) Train, mentor, and work to retain qualified employees; (b) Cross-train employees so that knowledge of the model will reside with multiple staff rather than with one person; and (c) Implement a peer review process to carry out the necessary quality control reviews of the Trust Obligation and Liability Model and the Monthly Obligation and Liability Calculator.

Implement all detailed recommendations in the FY 2019 FISMA Evaluation report. (repeat)

We recommend that DHS Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and Component IT and financial management, complete a comprehensive risk analysis and develop a mitigation plan to reduce risks related to ITGC and application control deficiencies.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

We recommend that the Centers for Medicare & Medicaid Services: take action to ensure that all registered nurses’ supervisory visits of hospice aides are documented in accordance with applicable CMS regulations and interpretive guidelines.

We recommend that the Centers for Medicare & Medicaid Services: promote hospices’ compliance with the condition-of-participation standard that requires registered nurses to visit hospice beneficiaries’ homes at least once every 14 days to assess the quality of care and services provided by hospice aides, which could include: o working with State survey agencies and accreditation organizations to increase emphasis on oversight of this requirement, o educating hospices about the requirements associated with this standard, and o making this standard a quality measure.

Calculate and recover the questioned Federal costs, match costs, and related administrative costs. Also, determine the impact on Federal costs due to questioned match costs.

Correct identified safety-critical technical issues before the crewed test flights, including parachute and propulsion systems testing, to ensure sufficient safety margins exist.

We recommend that the BOR determine the cost and benefit of continued operation of the Demo-Plant.

We recommend that the BOR establish specific goals or outcomes if it determines that there is a benefit to continued operation of the Demo-Plant at the conclusion of the cooperative agreement.

We recommend that the BOR establish firm criteria for evaluating the Demo-Plant's future operational performance if the BOR continues Demo-Plant operation.

We recommend that the California Department of Public Health conduct more frequent site surveys at nursing homes to follow up on deficiencies.

The Bureau of Overseas Buildings Operations, in coordination with Embassy NDjamena and the Bureau of African Affairs, should develop and implement a strategy that prioritizes the disposal of Embassy NDjamenas excess real property, in order to put funds estimated at $7.1 million to better use.

The random moment sampling methodology used by the State agency to claim Medicaid school-based administrative costs did not meet Federal requirements. Specifically, the State agency did not correctly design, conduct, and document the timestudies and disregarded CMS’s efforts to ensure that the timestudies would produce valid results.

The random moment sampling methodology used by the State agency to claim Medicaid school-based administrative costs did not meet Federal requirements. Specifically, the State agency did not correctly design, conduct, and document the timestudies and disregarded CMS’s efforts to ensure that the timestudies would produce valid results. The State agency’s failure to meet Federal requirements for statistical sampling and follow its cost allocation plan requirements resulted in $63,786,406 in improper Federal Medicaid payments.

Instruct grant management personnel to provide an appropriate award description for all awards in the Executive Summary field in the grant application screen of eGrants. Monitor staff compliance with those instructions and take corrective action as needed (Pending since FY 2019).

We recommend that the Centers for Medicare & Medicaid Servicesreview the 37,124 outpatient claims totaling $1,162,562 in potential overpayments to determine whether the outpatient facilities met the requirement to bill for CCM services and o recoup any overpayments from outpatient facilities and o instruct the outpatient facilities to refund corresponding overcharges to beneficiaries

We recommend the Bureau of Actuary and Research ensure financial assistance awards containing personally identifiable information are reported in accordance with Office of Management and Budget Memorandum M-17-04.

We recommend the Bureau of Actuary and Research ensure DATA Act file assistance award preparers obtain training over the reporting of financial assistance awards containing personally identifiable information. For example, financial assistance award should be reported at the most granular level practicable while protecting personally identifiable information. The Railroad Retirement Board and Bureau of Actuary and Research should consider the different available Record Types as described in Appendix V of the report.

We recommend the Bureau of Fiscal Operations develop a plan to obtain an automated interface between the Railroad Retirement Board’s benefit paying systems and the Railroad Retirement Board’s financial system that would ensure the Railroad Retirement Board is in compliance with Office of Management and Budget Management Performance Memorandum 2016-03 and Office of Management and Budget Memorandum M-17-04.

Update DOT Order 4410.4 to include: a. Defining roles and responsibilities of DOT offices and personnel with respect to management of WCF laptop computers. b. Requiring hand receipts or a similar form whenever an accountable property asset (e.g., laptop) is assigned or unassigned to/from a user. c. Requiring record retention of records from hand receipts or a similar control with the appropriate property official. d. Establishing a timeframe for submitting Reports of Survey to OFIAM.

Develop and implement procedures for conducting the annual property inventory to include obtaining missing hand receipts or similar control and timely resolution of discrepancies for WCF laptops. Implementation of this recommendation could result in $2.9 million in funds put to better use.

If all of the Medicare contractors had received the postpayment edit's automatic notifications of improperly billed claims and had properly taken action since CY2013, Medicare could have saved $70,011,503

Work with the Federal Reserve System to ensure that the data loss protection replacement solutiona. functions consistently across the Board's technology platforms. b. supports rulesets that limit the exfiltration weaknesses we identified, to the extent practicable.

Develop and implement a Boardwide process to incorporate the review of data loss protection logs into employee and contractor offboarding processes to identify any potential unauthorized data exfiltrations or access.

Develop and implement procedures within FTA's Triennial and State Management Reviews to assess the necessary data to affirm that each grantee undergoing a comprehensive review carries flood insurance that complies with the FDPA. FTA's suggested corrective actions for any grantee deficiency in this area should include, at a minimum, requiring the grantee to submit to FTA documentation showing proof of flood insurance in the aggregate amount of the maximum available NFIP insurance or the amount of the Federal investment (whichever is less) for all structures required to have it.

USAID/Bosnia and Herzegovina's agreement officer determine the allowability of $272, 885 in questioned costs ($241 ineligible and $272,644 unsupported) on pages 10 and 14 of the audit report and recover any amount that is unallowable.

We recommend that OPM perform a gap analysis to identify the monitoring, inventory, and management tools that it needs to implement automated infrastructure management as required by the DCOI and OMB.

We recommend that OPM install automated power metering in all of its data centers in accordance with the requirements in the DCOI.

We recommend that OPM assess the current state of its infrastructure to accurately report data center metrics, including the correct number of data centers (including non-tiered spaces), the correct operational status of data centers, and accurate energy usage.

Perform a review of all Plans of Action and Milestone (POA&M) items closed during the audit period to include supporting documentation and re-approve their closure.

Work with the OA CIOs to review current assessment and authorization processes and implement a validation process to ensure updated security plans, ATOs and risk assessments are reviewed and updated to reflect all system (including privacy) controls, vulnerabilities, and that current risks are clearly presented to the authorizing officials.

Work with the OA CIOs to develop mechanisms to ensure updated system security plans and assessments of security controls (that were previously assessed as not satisfied or partially satisfied) reflect current operational environments, including an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

Document OA subnets and OA responsibilities for devices and systems operating on the Common Operating Environment.