Open Recommendations

Related to Refunds and Drawbacks: We recommend that CBP implement relevant provisions of TFTEA, which will take effect on February 24, 2018.

Related to Refunds and Drawbacks: We recommend that CBP implement policies and procedures to ensure supporting documentation related to accelerated filer status is maintained.

Related to Refunds and Drawbacks: We recommend that CBP Update and redistribute guidance to necessary personnel regarding the appropriate CBP directives to ensure consistent performance of controls across all locations.

We recommend that the Deputy Secretary, Department of Homeland Security establish a formal entity at the Department level to oversee component use of force activities. Once established, the responsible personnel at the Department level should work with the components to: a. establish minimal requirements for what each component should report as a use of force incident and develop a process to collect and report the accurate number of incidents; b. develop a formal mechanism by which components can share lessons learned regarding use of force policies, training, and oversight; c. collaborate with the components and conduct a review or study…

Work with the Chief Information Officer Officer to perform a risk assessment to determine which aspects of an insider threat program are applicable to other types of sensitive Board information and develop and implement an agency-wide insider threat strategy for sensitive but unclassified Board information, as appropriate.

Take action to work with FAA, FHWA, FMCSA, FTA, MARAD, NHTSA, and OST to develop risk acceptance memos for the expired systems identified in this report.

The Deputy Secretary, or his designee, take action to work with OST COE, FTA, and FAA, the common control providers, to report and update risk acceptance for shared controls that are not implemented in DOT's Repository (e.g., CSAM) per FISMA, OMB, and DOT requirements.

The Deputy Secretary, or his designee, take action to identify and document OST COE compensating controls when used to address security weaknesses in CSAM and system authorizations.

The Archivist implement or upgrade current internal control software or utilize other mechanisms to enhance and improve the agency’s ability to track and report on internal controls.

The Archivist address outstanding recommendations from OIG Audit Report No. 13-01, including:  Revisiting his decision on the placement and role in the organization of the Chief Risk Officer.

NARA Executives ensure:  Monitoring and testing plans are sufficiently reported in the ICP Tool.

NARA Executives ensure:  Results of monitoring and testing plans are achievable within the reporting timeframe.

NARA Executives ensure:  All information is up-to-date and reflects the current control environment.

NARA Executives identify, develop, and include in ICP reports measurable indicators to evaluate functions.

The ICP Official develop and implement a consistent risk assessment process and format for risk ranking, analysis of effect or impact, and risk reporting.

The ICP Official review the ICP reports and make and document  any revisions necessary to the format to ensure all necessary information is obtained in the reports.

We recommend that HUD's Acting Deputy Assistant Secretary for Grant Programs instruct City officials to repay the Program from non-Federal funds $32,107 in overpaid grants to homeowners whose grant amounts (1) were not revised to show recalculated duplication of benefits and (2) exceeded the Program's 60 percent reimbursement rate.

We recommend that HUD's Acting Deputy Assistant Secretary for Grant Programs instruct City officials to reimburse $101,398 in additional grants owed to the 11 homeowners whose grant amounts should have been materially increased as a result of recalculated duplication of benefits.

We recommend that HUD's Acting Deputy Assistant Secretary for Grant Programs coordinate with the Office of Healthy Homes and Lead Hazard Control to provide technical assistance and instruct City officials to provide supporting documentation that lead-based paint testing was performed, identified hazards were removed, and clearance was achieved for the 41 properties for which homeowners received $833,199 in CDBG-DR assistance. If supporting documentation is not provided, City officials should repay the $833,199 from non-Federal funds.

We recommend that HUD's Acting Deputy Assistant Secretary for Grant Programs coordinate with the Office of Healthy Homes and Lead Hazard Control to provide technical assistance and instruct City officials to advise homeowners of their obligation under the terms of the reimbursement grant agreement to allow the Program to perform lead-based paint testing or hazard removal. Homeowners who refuse to allow the Program to complete lead hazard work or provide evidence that the property achieved clearance must repay the grant.

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including developing, documenting, and fully implementing NARA 162, NARA’s Enterprise Risk Management Program.  Within NARA 162, roles and responsibilities for ERM activities should be clearly identified.

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including Developing, documenting, and fully implementing NARA 163, NARA’s Issues Management.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to identify and prioritize risks within the organization. Risks should be tied directly to NARA’s strategic plan and mission and prioritized based on their overall importance to the agency.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to prioritize risk management activities including the use of limited resources based on key risks within the organization. Management’s prioritization should be clearly documented and include formal steps to ensure risks are maintained at an appropriate level.

We recommend that the Chief Operating Officer\Chief Risk Officer Provide additional resources to the Office of Accountability to ensure ICP activities are effectively carried out.

We recommend that the Chief Operating Officer\Chief Risk Officer develop and implement a formal process to review and evaluate the completeness and accuracy of ICP documentation submitted. Validation procedures should include a formal review: To ensure all required documentation has been submitted by the due date. Where documentation has not been provided, NARA should have a formal process in place to follow up and obtain the required documentation. Of ICP documentation submitted to ensure it is both complete and accurate. Where discrepancies are identified, NARA should have a formal process in place to follow up with management so corrections can…

We recommend that the Chief Operating Officer\Chief Risk Officer develop and fully implement a formal ICP training program. NARA’s ICP training program should identify and require individuals who are involved with NARA’s ICP to complete initial training and refresher training periodically thereafter. Further, management should track completion of ICP training to ensure all individuals involved in the ICP process have received adequate training.

Issue a change to regulations at 24 CFR Part 203, which would avoid unnecessary costs to the FHA insurance fund, allowing an estimated $2.23 billion to be put to better use. These changes include (1) a maximum period for filing insurance claims and (2) disallowance of expenses incurred beyond established timeframes. Status

Rec. A.1: The DoD OIG recommended that the Secretaries of the Military Departments annually perform at least two comprehensive, independent inspections of installations. The purpose of these inspections is to verify compliance with all applicable health and safety requirements.

Rec. C: The DoD OIG recommended that the Under Secretary of Defense for Acquisition, Technology, and Logistics, establish a permanent policy for the sustainment of facilities, including standardized facility inspections. This policy should incorporate the requirements in the September 10, 2013, "Standardizing Facility Condition Assessments," and in the April 29, 2014, "Facility Sustainment and Recapitalization Policy," memorandums.

Establish policy and controls for the use of maintenance data terminals to reduce the incidence of malware on these terminals.

Require OAs to provide their network maps to the Cyber Security Management Center.

Reimburse its program $28,199 ($19,771 $7,793 $635) from non-Federal funds for the overpayment of housing assistance and ineligible administrative fees it received for the deficiencies cited in this report.

Acknowledge that the attached settlement agreement for $510,000 represents an amount due HUD.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to develop and implement policies and procedures to document and perform detailed review and testing to establish eligibility, existence, disaster event qualifications, reasonableness of cost estimates, prioritization, and fund allocation, both retroactively and prospectively, which would put $81,982,712 to better use.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to support or properly obligate $11,717,288 in unsupported obligations.

We recommend that Indian Affairs identify BIA-owned school facilities that are not on the BIE school listings, including the Todd County School District schools, and ensure facility responsibilities are clearly delineated and upheld.

We recommend Indian Affairs take immediate action to correct the health and safety issues identified in this report or ensure that the students and staff are adequately protected until these problems are resolved.

We recommend that DOI's Chief Information Officer incorporate and enforce the following items into its newly evolving vulnerability management program- a. enterprise-level monitoring and reporting of all devices and software packages; b. enterprise-level enforcement of consistent assessment, detection, prioritization and remediation techniques; c. required elevated account credential usage for testing; d. enterprise-level monitoring and bureau accountability for patch deployment; and e. enterprise-level quarantining for critically vulnerable systems that are not patched in a pre-defined timeframe.

Continue to pursue ways to make the business records process more efficient, particularly for applications related to cyber cases.

Develop training on the proper use of Religious Compensatory Time and require all managers approving, and employees using, Religious Compensatory Time to complete the course.