Open Recommendations

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including developing, documenting, and fully implementing NARA 162, NARA’s Enterprise Risk Management Program.  Within NARA 162, roles and responsibilities for ERM activities should be clearly identified.

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including Developing, documenting, and fully implementing NARA 163, NARA’s Issues Management.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to identify and prioritize risks within the organization. Risks should be tied directly to NARA’s strategic plan and mission and prioritized based on their overall importance to the agency.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to prioritize risk management activities including the use of limited resources based on key risks within the organization. Management’s prioritization should be clearly documented and include formal steps to ensure risks are maintained at an appropriate level.

We recommend that the Chief Operating Officer\Chief Risk Officer Provide additional resources to the Office of Accountability to ensure ICP activities are effectively carried out.

We recommend that the Chief Operating Officer\Chief Risk Officer develop and implement a formal process to review and evaluate the completeness and accuracy of ICP documentation submitted. Validation procedures should include a formal review: To ensure all required documentation has been submitted by the due date. Where documentation has not been provided, NARA should have a formal process in place to follow up and obtain the required documentation. Of ICP documentation submitted to ensure it is both complete and accurate. Where discrepancies are identified, NARA should have a formal process in place to follow up with management so corrections can…

We recommend that the Chief Operating Officer\Chief Risk Officer develop and fully implement a formal ICP training program. NARA’s ICP training program should identify and require individuals who are involved with NARA’s ICP to complete initial training and refresher training periodically thereafter. Further, management should track completion of ICP training to ensure all individuals involved in the ICP process have received adequate training.

Issue a change to regulations at 24 CFR Part 203, which would avoid unnecessary costs to the FHA insurance fund, allowing an estimated $2.23 billion to be put to better use. These changes include (1) a maximum period for filing insurance claims and (2) disallowance of expenses incurred beyond established timeframes.

Status

Establish policy and controls for the use of maintenance data terminals to reduce the incidence of malware on these terminals.

Require OAs to provide their network maps to the Cyber Security Management Center.

Reimburse its program $28,199 ($19,771 $7,793 $635) from non-Federal funds for the overpayment of housing assistance and ineligible administrative fees it received for the deficiencies cited in this report.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to develop and implement policies and procedures to document and perform detailed review and testing to establish eligibility, existence, disaster event qualifications, reasonableness of cost estimates, prioritization, and fund allocation, both retroactively and prospectively, which would put $81,982,712 to better use.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to support or properly obligate $11,717,288 in unsupported obligations.

We recommend that Indian Affairs identify BIA-owned school facilities that are not on the BIE school listings, including the Todd County School District schools, and ensure facility responsibilities are clearly delineated and upheld.

We recommend Indian Affairs take immediate action to correct the health and safety issues identified in this report or ensure that the students and staff are adequately protected until these problems are resolved.

We recommend that DOI's Chief Information Officer incorporate and enforce the following items into its newly evolving vulnerability management program- a. enterprise-level monitoring and reporting of all devices and software packages; b. enterprise-level enforcement of consistent assessment, detection, prioritization and remediation techniques; c. required elevated account credential usage for testing; d. enterprise-level monitoring and bureau accountability for patch deployment; and e. enterprise-level quarantining for critically vulnerable systems that are not patched in a pre-defined timeframe.

Continue to pursue ways to make the business records process more efficient, particularly for applications related to cyber cases.

We recommend that USBR promptly notify the Klamath Irrigation District of its obligation to repay the cost to design, construct, and operate and maintain the A-Canal head gates and fish screens and the total amount that must be repaid, as determined by USBR in Recommendations 1 and 2.

We recommend that USBR negotiate and establish a repayment contract with the Klamath Irrigation District to secure timely repayment of USBR's cost to design, construct, and operate and maintain the A-Canal head gates and fish screens, as determined by USBR in Recommendations 1 and 2.

Require New Mexico HSD verify enrollment and/or exemption, as applicable, for the four student cases identified, and if it is determined the students were ineligible, require HSD to determine if payments were improper and warrant establishment of a claim.

Require HSD to review the four cases identified to determine if payments were improper and warrant establishment of a claim.

The five cases identified above be reconciled with other State/Territory eDRS queries performed during the coverage gap period to identify disqualified individuals who may have attempted to receive benefits in another State/Territory.

Require New Mexico HSD review the two identified cases and verify income to determine if payments were improper and warrant establishment of a claim.

Require HSD to review the case identified to determine if payments were improper and warrant establishment of a claim.

Require HSD review the two cases identified to determine if payments were improper and warrant establishment of a claim.

Require HSD review the case identified to determine if payments were improper and warrant establishment of a claim.

Collect data on the Plan to Achieve Self-Support (PASS) program participation, costs, and outcomes.

Evaluate the PASS program’s impact on disability rolls periodically.

Promptly design and implement a plan that ensures that its law enforcement and detention components comply with the Rehabilitation Act of 1973.

Establish a standardized list of courses, covering at least the Release Preparation Program's core categories, as designated by the BOP, to enhance the consistency of Release Preparation Program curricula across BOP institutions.

Explore the use of incentives and other methods to increase inmate participation and completion rates for the Institution Release Preparation Programs.

Provide documentation to support program accomplishment data related to disbursements totaling $292,611 or repay HUD from non-Federal funds for any amount that it cannot support.

Complete the implementation of the new accounting system and ensure it tracks program funds to a level that supports compliance with HUD requirements.

Provide support that $944,687 (Footnote 2: Emergency funds of more than $1.1 million drawn between July 1, 2011, and December 31, 2015, were adjusted to consider $158,800 questioned in recommendation 1C and $38,164 questioned in recommendation 1D.) in Emergency funds drawn from HUD is reconciled with the accounting records and that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes or reimburse the Emergency programs from non-Federal funds.

Reimburse $189,227 to the Emergency programs from non-Federal funds for ineligible charges made to the programs.

Submit supporting documentation showing the eligibility, reasonableness, and allocability of $38,164 charged to the Emergency programs for unsupported drawdowns and equipment cost allocations or reimburse the programs from non-Federal funds.

The Executive Committee should perform a time study of Medicare work performed by all agency staff.

The Bureau of Fiscal Operations should work with the Centers for Medicare and Medicaid Services to update the Medicare interagency agreement and establish procedures for maintaining and updating the agreement.