Open Recommendations

Continue to educate the States about their responsibility to report overpayments on the correct line of the CMS-64 to improve oversight of the reporting process

To improve the DOT's information security continuous monitoring program, DOT Chief Information Officer needs to update the department's federal information security modernization act standard operating procedures to include steps for verifying the accuracyand completeness of the Federal Aviation Administration's (FAA) CrossAgency Priority (CAP) goal metrics.

To improve the accuracy and completeness of the data FAA uses to report on its CAP goal metrics, the Federal Aviation Administrator needs to implement procedures that: define the requirements for selecting the operating systems to be monitored; criteria for determining which tools should be used to collect data for the CAP goal metrics; and verify the accuracy and completeness of the CAP goal metrics.

We recommend the Executive Assistant Commissioner of the Office of Field Operations: a) Develop and implement performance measures for the advanced searches of electronic devices pilot program. b) Evaluate the effectiveness of the pilot program to determine whether the advanced searches are achieving the program's intended purpose. c) Work with the Commissioner of U.S. Customs and Border Protection to evaluate the performance of Office of Field Operations in the advanced searches of electronic devices pilot program and, based on the results of such evaluation, decide whether to discontinue or establish it as a permanent program of record.

Develop an implementation plan for deploying a scheduling system for controllers that includes schedule milestones, system requirements, risk assessment and mitigation, and funding requirements.

Assess and quantify the expected benefits of a customized controller scheduling tool.

We recommend that the Penobscot Nation establish a preventative maintenance program for the facility and medical equipment to ensure that it provides a safe, clean, and accessible environment.

We recommend that Penobscot Nation implement Federal and Tribal preemployment screening controls for employees who have not been fully screened prior to employment and for new staff hired at PNHD, including the performance of fingerprinting and FBI background checks for all staff currently working with Indian children, and maintain complete employee personnel files that include current licensing information when applicable.

(3) We recommend that the Penobscot Nation conduct annual program evaluations in accordance with Federal requirements, review the results of the program evaluations, and take corrective actions as appropriate.

(6) We recommend that Penobscot Nation work with the Penobscot Nation’s Tribal government to ensure that its emergency preparedness program is reviewed, updated, and tested annually, in accordance with Federal requirements, and review and update PNHD’s standard operating procedures in accordance with Tribal requirements.

(2) We recommend that the Penobscot Nation develop, approve, and implement written medical policies and procedures, with the advice of the required group of professional medical staff, that include: - pain-management treatment prioritization requirements for opioid prescription and compliance monitoring, and - requirements for timely completion, signature, and review of patient health records.

(1) We recommend that the Penobscot Nation ensure that PNHD is under the medical direction of a physician who performs all of the duties required in the job description and in accordance with Federal and Tribal requirements.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to allocate appropriate resources to the Compliance Office based on the stated priority of reducing or eliminating the investigation backlog so that FERPA complaints are resolved in a timely manner.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to work with the Office of General Counsel to resolve outstanding policy issues that impede the Compliance Office's ability to investigate certain FERPA complaints.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to implement an effective FERPA complaint tracking system that allows the Compliance Office to account for and track all complaints it receives, including the status and outcome of each complaint, and that provides an effective mechanism for reliable performance measurement and reporting.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to use reliable performance data to design and implement appropriate performance standards for the Compliance Office as a whole and for individual personnel responsible for handling complaints.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to investigate all complaints that meet the criteria requiring investigation and do not place complaints into an "inactive" status.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to revise processes for resolving FERPA complaints to ensure effective and appropriate communication with the complainant, to include providing dismissal notifications, updates, and responses to inquiries in a timely manner and recording all communication in the tracking system.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to design and implement a risk-based approach to processing and resolving FERPA complaints, where complaints deemed highest risk are prioritized. Risk can be evaluated based on the subject matter of the complaint, the severity of risk to student privacy, the number of students affected, or other relevant factors.

We recommend that the Acting Assistant Secretary of the Office of Management require the Privacy Office to review and evaluate its current policies and procedures for processing FERPA complaints to ensure they are complete and appropriate.

Grant Thornton recommends that OPM establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that OPM ensures policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM establish a means of documenting all users who have access to systems.

Grant Thornton recommends that OPM establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Grant Thornton recommends that OPM develop interface/data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

We recommend that DHS develop and implement monitoring controls to ensure Components properly apply allocation methodologies for the Statement of Net Cost.

We recommend that DHS establish a process to ensure accounting for non-routine material transactions impacting the financial statements is appropriate.

We recommend that USSS develop and implement policies and procedures over the review of journal entries

We recommend that USSS establish new, or improve existing, policies, procedures, and related internal controls over the valuation of its pension liability to ensure: a. adequate understanding of the pension estimate; b. oversight of assumptions used in significant estimates is maintained and the validity of those assumptions is routinely evaluated; c. the annual pension checklist developed by USSS is completed; and d. the underlying census data is reviewed at least annually.

We recommend that USSS provide sufficient training to personnel responsible for accounting related activities, including the processes resulting from the system transformation and the monitoring of obligations.

We recommend that USSS design and implement controls over the preparation and review of accounting checklists.

We recommend that USCG improve and reinforce existing policies, procedures, and related internal controls to ensure that: a. journal entries and manual adjusting entries are adequately researched, supported, and reviewed before and after recording in the general ledger; b. manual adjusting entries are recorded at the transaction level in the correct underlying general ledger systems in order to generate accurate beginning balances in each system; c. design and implement control procedures to ensure that assumptions are sufficiently reviewed on a timely basis with an appropriate level of precision, and that the results of these reviews are properly documented; and d…

We recommend that FEMA develop specific controls over material accounting transactions that are not part of FEMA's routine business operations.

We recommend that DHS consider the identified system deficiencies and prior system implementation challenges to ensure that improvements in ITGC and application controls are designed, implemented, and sustained in new systems.

Risk assessments should be enhanced at both the headquarters level by DHS management, and individual Components annually, and updated during the year as needed. Examples of areas that should be analyzed and responded to accordingly to enhance the risk assessments include: procedures to expand fraud risk assessments to include processes with higher risk and a known deficiency in control design, implementation, and effectiveness throughout DHS.

We recommend that DHS establish an effective internal control process to ensure that financial accounts and transactions that are susceptible to error due to IT systems functionality issues and inability to rely on application controls supported by deficient ITGCs are compensated for with manual controls until system deficiencies are remediated.

We recommend that USSS design and implement controls over the capitalization thresholds established for property, plant, and equipment.

We recommend that USCG design and implement real property inventory controls to ensure the completeness and existence of all real property assets.

We recommend that USCG design and implement real property inventory controls to ensure the completeness and existence of all real property assets.

We recommend that USCG reinforce controls over the timely recording of asset addition and retirement activity to ensure they operate effectively.

We recommend that NPPD design and implement sufficient controls to properly record items that should be capitalized in a timely fashion.

We recommend that CBP (related to refunds and drawbacks) continue implementing requirements of TFTEA, which will take full effect beginning on February 24, 2019.

We recommend that CBP (related to refunds and drawbacks) revise current policies and procedures to ensure appropriate personnel review and approve all refunds prior to disbursement.

We recommend that CBP (related to refunds and drawbacks) revise policies and procedures to ensure effective review of the interest calculation for refund disbursements.