Open Recommendations

We recommend the FEC integrate policy governance with internal control and ERM processes to ensure outdated or noncompliant policies are identified, tracked, and addressed as part of the Agency’s risk management and internal control monitoring activities.

We recommend the FEC establish and implement a formal, risk-based methodology for evaluating internal control deficiencies, including defined criteria for assessing magnitude, likelihood, and impact, and require consistent application of this methodology to assess deficiencies identified through the ICR process and determine their significance and impact on agency objectives.

We recommend the FEC redesign the ICR template to improve clarity, completeness, and usability by ensuring a logical linkage between control objectives, associated risks (including fraud risks), control activities, and the evaluation of control effectiveness. The revised template should also require documentation of identified control deficiencies and planned corrective actions to support consistent, risk-based internal control assessments in accordance with OMB Circular A-123 and GAO Green Book.

We recommend the FEC implement a quality assurance review process over ICR submissions to ensure documentation is sufficient, complete, and in compliance with OMB Circular A 123 and GAO Green Book requirements, prior to acceptance.

We recommend the FEC provide formal training and detailed guidance to assessable unit staff on how to properly document internal control assessment worksheets in accordance with OMB Circular A-123 and GAO Green Book requirements.

Revise policies and procedures to track and maintain supporting documentation to ensure expenditures are adequately supported prior to reporting financial information to ARC.

Work with ARC to resolve the questioned costs totaling $44,989 for unsupported ARC funded Contractual and Other cost.

Work with ARC to resolve the questioned costs totaling $15,000 for unsupported non-ARC matching Contractual cost.

Revise policies and procedures for financial reporting to ensure costs incurred under a federal award are tracked within the GL, regularly reconciled against previously reported amounts and the approved budget, and reviewed prior to submission.

Work with ARC to resolve the questioned costs of $3,857 for non-ARC Matching cost share.

Revise policies and procedures to ensure the timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

Develop formal subrecipient agreement procedures to ensure that all subrecipient agreements are reviewed for completeness and include all required elements in accordance with 2 CFR 200.332 prior to execution.

Develop standardized subrecipient agreement templates that incorporate all required Uniform Guidance data elements, including Federal award identification, required disclosures, access to records provisions, and subaward closeout requirements.

The Chief Information Officer should work with the Treasury Department to ensure that privileged Enterprise Data Platform user accounts are fully integrated with the PUMAS.

The Chief Information Officer should ensure that the responsible unit with the authority to remove Enterprise Data Platform user access is timely notified when appropriate e.g., entitlements are changed or accounts are inactive.

The Chief Information Officer should coordinate with the Treasury Department to resolve the infrastructure issue between IRS and Treasury networks and ensure that systemic processes are incorporated into the platform user account management process once the infrastructure limitations are resolved.

The Chief Information Officer should establish a corrective action plan or an RBD to address the lack of automated provisioning of user accounts.

Remediate servers that are not compliant with configuration standards and ensure periodic compliance scanning of servers.

Remediate databases that are not compliant with configuration standards and ensure quarterly compliance and vulnerability scanning of databases.

Define intervals for review of database audit logs and vulnerability scan results and ensure regular collection and review of database audit logs in accordance with policy.

Determine: (a) whether its use of FSA funds to pay for telephone minutes for inmates not participating in or on a waitlist for FSA programs was consistent with the purpose for which the FSA funds were appropriated and (b) whether its transfer of time-limited funds to the Trust Fund in excess of its cost for providing telephone minutes for inmates inappropriately extended the period of availability of these funds. Depending on the outcome of these determinations, make appropriate notifications to the Office of Management and Budget and take remedial action as necessary.

Actively monitor Department of Labor grantees' use of FSA-derived grant funds, to include ensuring that grant-funded instruction is not duplicative of BOP offerings and is supporting FSA implementation.

Determine how the Department of Labor has used and plans to use the $15 million in FSA funds transferred to it for grant program administrative costs, including funds that were allocated to pay for an evaluation of the grant program, and ensure that the use of these funds supports FSA implementation.

Issue clear guidance defining how FSA funds can be used.

Ensure that similar purchases are categorized consistently in the BOP's financial management system so the BOP can rely on system data to oversee its use of FSA funds.

Collect accurate programming data that will allow the BOP to determine the frequency with which FSA programs are offered at each of its institutions.

Update the FSA Approved Programs Guide, or develop complementary reporting, to more accurately convey the institutions where each FSA program is actually available.

The Chief, Taxpayer Services, should review procedures and system programming specific to tax compliance to ensure that initial and continuous suitability reviews function as intended.

The Chief, Taxpayer Services, should Identify individuals with either an incomplete or ineligible citizenship
status and ensure that follow-up to verify their status has been completed.

The Chief, Taxpayer Services, should review programming specific to citizenship verification and consider
including this check in continuous suitability reviews.

The Chief, Taxpayer Services, should continue to identify and request that participants who are subject to fingerprinting requirements, and are not under continuous monitoring, submit their fingerprints and are enrolled in the FBI’s Rap Back Service.

The Chief, Taxpayer Services, should establish a systemic method of identifying IRS employees during initial and continuous suitability checks.

We recommend the Chief Information Officer (CIO): Develop and implement a process to create and maintain target and current cybersecurity profiles.

We recommend the CIO: Develop and implement controls to validate information within the Cybersecurity Assessment Management tool.

We recommend DOL OIG: Implement a control to help ensure that all interconnection service agreements or related documents are reviewed in accordance with the DOL Cybersecurity Policy Portfolio.

We recommend DOL OIG: Implement a baseline deviation monitoring process for its general support
system.

We recommend the CIO: Ensure all systems comply with the Cybersecurity Policy Portfolio requirements for session timeouts.

We recommend the CIO: Ensure the adherence to DOL logical access policies and procedures.

We recommend the CIO: Establish mechanisms to ensure that logical access controls are implemented and effective.

We recommend the CIO: Design and implement a process to ensure identity and access management internal control documentation is retained to support its system of internal controls and operational needs, as required by Government Accountability Office’s Standards for Internal Control in the Federal Government.

We recommend the CIO: Develop and implement effective data exfiltration controls to ensure unauthorized data does not leave the DOL network.

Develop and communicate guidance that explains what detail should be included in a valid justification for every Veterans Benefits Management System for Rating override.

Develop and implement a plan to reestablish an overrides quality review process that provides individualized feedback for claims processors.

Develop and implement a plan to monitor the effectiveness of override reviews and continue to address areas and trends that are found to need improvement.

Identify the business need for the override review tab and, if there is one, develop and implement requirements for updating and using it.

Develop and implement a plan that addresses the limitations of the aggregate dashboard.

(a) Update its policies and training (including the LEOSA memorandum, the Standards of EmployeeConduct, and related training materials) to clarify the appropriate and prohibited uses of employeecredentials ; and (b) Either (1) ensure that only employees who are authorized by the BOP to carry afirearm receive credentials with law enforcement markings, or (2) for BOP employees who are noteligible or authorized by the BOP to carry a firearm, add to their credential that limitation to theirLEO status by, for example, including an endorsement on the credential that the holder is notauthorized by BOP to carry a firearm.

(a) Update its Badge Accountability Memorandum to clarify that with respect to their ability to carrya firearm, staff are prohibited from using their badges other than to establish a staff member'sauthorization to carry a firearm while on duty and/or carrying out responsibilities that are part ofthe employee's normal BOP duties; (b) Update its LEOSA memorandum to clarify that staff areprohibited from using the BOP-issued badges to demonstrate eligibility to carry a concealed firearm;and (c) Determine whether it is necessary to issue badges to BOP employees who are not authorizedto carry firearms.

Take appropriate actions to monitor the collection of the remaining 11 restitutions identified in our audit and the 3 restitutions from our prior audit, as appropriate.

Review the remaining 1,440 restitutions in the restitution tracking tool and the remaining 15 restitutions reported as errors in our prior audit to determine whether the Agency is monitoring the collection of the restitution as required and take corrective actions when appropriate.