Open Recommendations

Require the Maryland GOCPP to strengthen its annual state certification reporting practices to improve reporting accuracy.

Require the Maryland GOCPP to develop and implement controls to ensure adequate oversight and improve the accuracy of performance reporting.

Work with the Maryland GOCPP to strengthen procedures for its secondary review of payments and implement enhanced accounting controls to help mitigate the risk of duplicate payments.

Remedy $80,550 in duplicate victim compensation payments.

Remedy $66,653 in unallowable questioned costs associated with victim compensation payments.

Remedy the $4,400 in unsupported questioned cost associated with a victim compensation payment.

Ensure the Maryland GOCPP updates its CICB Manual to: (1) require that the supporting files for claims contain written justification for any deviation from the CICB's policy on processing decisions, and (2) reflect the applicable and accurate statutory award limits established by the state of Maryland.

Update policies, and procedures related to monitoring and oversight of internal controls related to journal entries, to ensure internal consistency with, and clear definition of, those journal entries that are processed by the service provider; and to define the required documentation to be maintained to evidence CPSC reviews of journal entries.

ML - 1: Design and implement a control to identify, analyze, and respond to risks related to the validity of open obligations.

ML - 2: Establish procedures and recurring communication with the appropriate stakeholders to assist in the identification and de-obligation of stale undelivered orders.

ML - 3: Design a control to identify, analyze, and respond to risks related to the reporting of leases.

ML - 4: Establish recurring communication with the appropriate stakeholders.

Work with the Illinois Department of Human Services to ensure it accurately charges expenditures related to Social Security Administration programs.

We recommend that management design and implement controls that respond to the risks associated with the reliability of key underlying data and code used in developing the subsidy re-estimates. Such review should be documented and maintained.

We recommend that management: 1. Evaluate, design, and implement security management controls to ensure that corrective actions remediate the risk and address the root cause of findings and quality reviews over the POA&M closure documentation are conducted to confirm that the noted deficiencies are fully addressed to prevent future reoccurrences.

We recommend that management evaluate, design, and implement logical access controls and provide training and oversight over access provisioning, removal and/or deactivation of access, periodic reviews and recertifications of access, and adherence to password and security setting requirements, segregation of duties, and least privileged principles.

We recommend that management evaluate, design, and implement change management controls to ensure the Department’s system change management process identifies and categorizes the types of changes that impact the system, data, and configurations in addition to defining and documenting the change descriptions and requirements for testing, approvals, documentation, audit trails, and retention for each system change.

We recommend that management evaluate, design, and implement computer operations controls to develop and implement formal procedures addressing controls over changes to production jobs and schedules and the monitoring of actions taken by the generic/shared job processing account in the job scheduling tool.

We recommend that management ensure that controls are operating effectively over the complete and timely review of SOC reports to ensure the scope adequately covers the controls in place at the service organization, including the CUECs presented in such reports. Furthermore, management should implement and execute controls designed to address those CUECs in a timely manner.

We recommend that management implement key monitoring controls to ensure that corrective action plans are implemented to remediate control deficiencies identified in a timely manner. In addition, increase oversight, review, and accountability over the process among various offices and directorates within the Department.

Embassy Phnom Penh should bring its fire protection program into compliance with Department standards.

Embassy Phnom Penh should bring its safety, health, and environmental management program into compliance with Department standards.

Embassy Phnom Penh should bring its property management program into compliance with Department standards.

Embassy Phnom Penh should follow the local configuration management protocol to monitor hardware lifecycles in accordance with Department standards.

Embassy Phnom Penh should carry out all information systems security officer responsibilities in accordance with Department standards.

Embassy Phnom Penh should manage its non-enterprise networks in accordance with Department standards.

Embassy Phnom Penh should use the Integrated Logistics Management System's loanable property module to loan or issue radios to individuals, sections, and agencies in accordance with Department standards.

Embassy Phnom Penh should manage its records management program in accordance with Department standards.

Develop and implement a formal, documented grant closeout process that includes clear policies and procedures aligned with federal requirements.

Provide training to relevant staffs on the new grant closeout policies and procedures to ensure consistent understanding and application across all grant programs.

Update the NARA 111, NARA Directives, for the development, approval, and maintenance of internal policies and SOPs.

Ensure a NARA executive oversees and monitors the periodic review and update of the policies and SOPs.

Update the travel policy and continue efforts to ensure that all written policies and procedures are reviewed and revised in a timely manner.

We recommend that FWS require the Department to resolve the $36,588 ($27,443 Federal share) in questioned costs related to inequitably allocated leave charges billed to the Wildlife and Sport Fish Restoration Program.

We recommend that FWS require the Department to develop an internal mechanism to ensure that all subawards over $30,000 are reported through SAM.gov, as required under 2 C.F.R. 170, Appendix A(a)

We recommend that FWS require the Department to develop and implement a written policy for leave allocation consistent with 2 C.F.R. 200.405(d) and 200.431(b).

We recommend that FWS require the Department to provide training to ensure employees charging to the Wildlife and Sport Fish Restoration Program understand the Federal requirements for allocating leave across multiple projects and activities.

We recommend that FWS require the Department to provide training on public reporting requirements to all employees responsible for the administration of subawards.

We recommend that ONRR update its policies and procedures to establish conditions that warrant or require a referral to ONRR Enforcement, such as the maximum number of informal compliance attempts or maximum number of days since an effort to obtain compliance was initiated, to provide sufficient time to resolve the case before expiration of the statute of limitations.

We recommend that ONRR update policies and procedures with clear instructions on the steps necessary to ensure that companies have achieved full compliance, including searching for collateral violations and coordination with other ONRR divisions for verification that there are no other related violations prior to closing the case.

We recommend that ONRR establish a process to periodically evaluate identified cases of noncompliance that have not been referred to enforcement to determine whether open cases may require additional actions, such as an enforcement referral or escalation.

We recommend that ONRR update its policies and procedures to prioritize referring cases related to unpaid royalties to the Office of Enforcement based on defined conditions, to include dollar thresholds, material significance, or when companies are repeat offenders.

We recommend that ONRR establish procedures to identify unpaid royalties related to missing reporting cases and issue Immediate Liability Civil Penalties unless an exception is warranted and adequately documented.

We recommend that ONRR provide training on updated procedures to ensure all investigators consistently pursue issuing penalties when warranted or document any exceptions.

We recommend that ONRR evaluate and report on the compliance of the responsible parties associated with the 25 cases of insufficient enforcement actions to determine if the entities corrected the identified violations.

We recommend that ONRR evaluate and report on the compliance of the responsible parties associated with the six closed reporting cases to ensure each company submitted all the required reports and payments or pursue appropriate enforcement actions.

The Commissioner, Small Business/Self-Employed Division, should take the necessary steps to provide FTP penalty relief to the 2,138 eligible taxpayers we identified, including but not limited to abating FTP penalties.

Implement standardized, written procedures to verify that applicable contract award and closeout contract file documentation requirements are met for each GLS contract.

Implement standardized, written procedures to verify that applicable Federal and Department independent government cost estimates and fair and reasonable price determination requirements are met prior to awarding a GLS contract. Implementing this recommendation could put up to $18.7 million in Federal funds to better use by improving GLS's ability to establish fair, reasonable, and realistic contract pricing.

Conduct an assessment of acquisition staff levels and needs, and based on this assessment, develop a plan to address shortages of critical acquisition personnel needed to carry out the Agency's contracting needs.