Open Recommendations

Rec. B.1.c.4: The DoD OIG recommended that the Under Secretary of Defense (Comptroller)/Chief Financial Officer, DoD, require the Military Departments, in coordination with the Assistant Deputy Commandant for Programs and Resources of the Marine Corps, to perform a comprehensive review to identify excess replenishment funding in an unexpired account that cannot be returned to the originating account. Upon identification, the Military Departments should evaluate whether the funds can be used to procure items from the Ukraine replenishment backlog and obtain approvals to use the excess funds consistent with the current General Business Rules. The Military Department officials should also design…

We determined that the State of North Carolina paid out ERA1 funds in the amount of $803,160 in violation of the ERA1 statute because the funds were disbursed loan ineligible household. On August 12, 2025, Treasury's Bureau of the Fiscal Service issued an invoice for $803,160 to the State of North Carolina, establishing a debt to the Federal Government.

Develop and provide to State Safety Oversight (SSO) program audit participants a methodology-the steps the FTA Audit Team will take and the indicators the audit team will look at to determine whether or not the SSOA is in compliance with the regulation.

Develop and implement quality control procedures to address identified oversight gaps. The procedures should include a process to ensure findings specify suitable criteria, minimum documentation requirements, examples of model evidentiary documentation, and a requirement that the rationale for compliance and audit methodology decisions be included in the audit documentation.

Develop and implement a plan for how OTrak will accommodate future changes to the SSO audit structure, such as those anticipated as a result of the implementation of risk-based inspections.

Establish and implement supervisory review of OTrak data entries to identify un- or mis-recorded entries and improve the reliability of OTrak data.

Update OTrak to enable the complete text of findings and recommendations to be captured in database fields.

We recommend SSA include terms or conditions in all contracts that require that contractors identified as having significant security responsibilities complete role based security training before they perform their assigned duties and, at least, each fiscal year thereafter.

We recommend SSA implement data validation controls before it processes the role based privacy training assignments to prevent errors and avoid confusion between different components.

We recommend SSA develop and implement a process to send stakeholders routine reminders to update personnel information and periodically validate that all stakeholder information is accurate.

The Chief, Taxpayer Services, should educate IRS representatives about the fraud scheme and require them to properly authenticate callers before providing tax account information, including tax deposit and tax transcript information.

Evaluate its monitoring practices in consideration of its needs and resources, establish appropriate plans to achieve the necessary oversight of its programs, and institute a risk mitigation strategy to address any shortfalls in meeting its monitoring plans. This strategy should consider active grant recipients deemed to be high-risk, as well as those receiving multiple grant extensions on the same award, from all program offices each fiscal year.

Review relevant DOJ and internal OVW guidance and practices regarding extensions to award performance periods and develop written policies to enhance extension-related controls for the appropriate administration of grant programs and fulfillment of OVW's fiduciary responsibilities.

We recommend that OJP work with LEAP to ensure it implements procedures to report accurate performance data and maintain proper support documentation for the reported performance.

We recommend that OJP work with LEAP to ensure it complies with its approved funding structure or seeks approval and any necessary assistance to pursue a different structure to administer the program.

We recommend that OJP work with LEAP to ensure it properly documents the approval of timesheets so that LEAP is compliant with its existing policy.

We recommend that OJP work with LEAP to identify the amount needed for office space and modify its budget to ensure it reflects bona fide grant-related needs for rental costs.

We recommend that OJP work with LEAP to remedy the $2,682 in unallowable software costs that were not approved in the grant budget.

We recommend that OJP work with LEAP to develop and implement policies and procedures to ensure it charges to the grant only approved items in the budget.

We recommend that OJP work with LEAP to establish a policy for confirming the receipt of goods or services.

Conduct a study to establish minimum loan thresholds for performing site visits, implement policies and procedures based the results of that study, and perform site visits to help facilitate appropriate liquidation of collateral on defaulted COVID-19 EIDLs in an effort to maximize collections.

Verify all delinquent COVID-19 EIDL obligors are reported to credit bureaus in a timely manner.

Confer with the DOJ to establish a reasonable standard for referral of delinquent COVID-19 EIDLs to the DOJ for litigation.

Complete efforts to develop and implement program-level goals and metrics for both the Regional and Significant Service Provider Examination Programs. This should include finalizing and implementing the Inherent Risk Methodology Analysis.

Develop a plan to verify supervisors are monitoring scanning to improve compliance with load and unload scan goals at the St. Louis Processing and Distribution Center.

Develop and implement a plan to verify extra trips are properly recorded in the Surface Visibility Web system at the St. Louis Processing and Distribution Center.

Analyze and realign processing operations at all four St. Louis processing facilities to improve efficiency.

Develop a plan to verify employees attach accurate placards on mail transportation equipment and follow first in, first out order at the St. Louis Processing and Distribution Center.

Fill Postal Service driver vacancies at the St. Louis Processing and Distribution Center.

Fill the vacant Postal Vehicle Service driver positions needed and hold employees accountable for attendance and performance issues at the St. Louis Network Distribution Center.

We recommend that USAID/Ukraine request that the State Service of Special Communications and Information Protection
of Ukraine assess which USAID-delivered Starlink terminals are at high risk of misuse or
theft, and coordinate with SpaceX to suspend service for those terminals.

The Chief, Taxpayer Services, should perform a study to determine whether a new kiosk program that uses updated technology, or deploys laptops to TACs, would provide effective and efficient self-service options to taxpayers.

We recommend that the Office of Acquisition and Assistance, Cost, Audit and Support Division, Contract Audit Management Branch verify that Creative Associates corrects the one material weaknesses in
internal control detailed on pages 15, 16 and 17of the audit report.

Evaluate which staff should have access to and should update the Consult Toolbox when records are requested or received and update the Consult Business Rules and Uses of the Consult Package Standard Operating Procedure to reflect necessary changes.

Include controls within the Consult Toolbox to prevent errors and improve data quality, including controls on administrative closure of low-risk consults and documenting the records-retrieval method.

Update consult closure policies and procedures to clarify requirements for administrative closure and determine whether metrics for the percentage of records received should be a requirement and included in policy.

Determine whether Veterans Health Administration facilities community care offices should continue to be required to use the administrative closure report for oversight of administratively closed consults, and if not, determine what reports should be required.

Evaluate the workload of community care staff to determine the most efficient way to structure and execute their duties.

Determine if there are mechanisms to identify standardization opportunities and increase efficiency for improving records return processes.

Ensure community care staff follow procedures to reduce duplicate records received.

Evaluate ways to increase use of provider electronic records portals to reduce reliance on electronic fax when retrieving medical records.

Consider increased implementation of technologies to improve records processing once received to reduce the manual renaming of electronic files and uploading of records into the electronic health record.

Ensure records from the Joint Longitudinal Viewer are uploaded into the electronic health record.

The Medical Center Director ensures staff store clean and soiled utility items separately, maintain cleanliness, and dispose of expired items.

Ensure YouthBuild develops and implements written policies for the preparation of performance and progress reports

Require YouthBuild to comply with the personally identifiable information (PII)-related special condition and enhance its existing information security policies to include procedures on how to respond and report an actual or imminent breach of PII.

Ensure YouthBuild develops and implements written subrecipient monitoring policies and procedures to: (1) review background checks for individuals with close contact with minors, (2) validate subrecipient performance data to source documentation, and (3) include documentation of corrective actions and resolution on all significant developments that negatively affect the subaward.

Ensure YouthBuild enhances its existing conflict of interest policies to include the necessary procedures, including satisfying the requirement to disclose in writing any potential conflicts of interest to OJP.

Ensure YouthBuild develops and implements: (1) a control to help ensure that its files contain adequate documentation to support its sole source procurement activities as required and (2) policies and procedures for documenting its price reasonableness determinations.

Finalize and implement policies and procedures for creating and maintaining current and target cybersecurity profiles in alignment with National Institute of Standards and Technology Cybersecurity Framework Guidance.