Open Recommendations

Complete POA&Ms and/or RBDs to document and track the **2** overdue configuration compliance vulnerabilities.

The Chief Information Officer should reconcile the platform asset inventory to the new inventory management system to ensure its completeness and accuracy.

Require the Threat Assessment Team to assess threats identified in Assault Threat Specialty Reports as jacketed cases and document them in the Threat Assessment Case Tracking system.

Reiterate guidance to the Threat Assessment Team lead on responsibilities for reporting incidents in the Threat Assessment Case Tracking system.

Clarify and reiterate guidance to facility managers on timely reporting incidents of workplace violence to their Threat Assessment Team.

Develop and implement a process to verify outcome memos are timely provided to applicable facility managers and maintained accordingly.

We recommend that the Acting PBS Commissioner provide PBS project teams with annual training on the CMc project delivery method and any updated policies or guidance implemented in response to the audit findings. Training should provide PBS project teams with sufficient information to: 1. obtain adequate price competition for construction work under the GMP; 2. negotiate fees for contract modifications (overhead and profit) based on actual overhead rates and the degree of cost risk for each change; and 3. comply with FAR and GSAR accounting and auditing requirements to ensure that the government only pays actual costs under the GMP.

We recommend that the Acting PBS Commissioner update existing controls to ensure proper award and administration of CMc contracts. Revise the existing contract file checklist to include specific requirements for CMc contracts. Implement procedures to review, authorize, and monitor all contract changes that impact the GMP. Implement procedures to delegate Cost Accounting Standards administration responsibilities within PBS to a cognizant federal agency official. Implement procedures for interagency coordination when PBS is not the cognizant federal agency for a contractor. Develop and implement consistent monthly reconciliation procedures to ensure that contractors properly accumulate and record incurred project costs. PBS should also…

We recommend that the Acting PBS Commissioner implement a comprehensive review and approval process governing the use of the CMc project delivery method for new projects and those projects in the early stages of development (e.g., acquisition planning phase). At a minimum, the process should ensure that: 1. the assigned project teams clearly understand the requirements of the CMc project delivery method; and 2. effective internal controls are in place to properly award and administer the underlying CMc contracts.

We recommend that the Acting PBS Commissioner review PBS’s open CMc contracts to determine if PBS can make retroactive adjustments to recover the taxpayer dollars that have been used to pay excessive fees on CMc contracts.

Rec. 4: The DoD OIG recommended that the Principal Director, Defense Pricing, Contracting, and Acquisition Policy, in coordination with DoD stakeholders responsible for Berry Amendment compliance, implement a risk?based approach for contracting personnel to conduct inspections of covered goods to determine whether items received comply with the Berry Amendment.

We recommend the Commissioner of CBP establish clear, mandatory, and recurring fraudulent document training requirements for officers and agents. Such training should be updated periodically to keep pace with emerging tactics in fraudulent document methods.

We recommend the Commissioner of CBP develop and implement controls to ensure CBP officers and agents send documents to the Fraud Detection and Analysis Unit, as required.

We recommend the Senior Vice President, Transmission, evaluate Transmission’s budget and determine if there are other funds that could be reallocated to close the funding gap or consider escalating the request for additional funding.

Verify that Tech2Peace corrects the instance of material noncompliance detailed on pages 17 to 18 of the audit report

The Country Director establishes memoranda of understanding, or informal cooperative agreements with clear expectations, with the Madagascar ministries of health, education, and agriculture.

The Office of Volunteer Recruitment and Selection, the Office of Communications, and the post work together to develop and implement strategies that address applicant concerns specific to Madagascar to increase application and retention rates.

The Country Director develops post-specific procedures for receiving and responding to Safety and Security incidents, to include roles and responsibilities, and then trains staff in those procedures.

The Chief Information Officer should ensure that all existing legacy case management systems, and any new projects incorporated into the ECM platform, comply with the April 2025 legacy definition.

The Under Secretary for Health ensures that VA homeless program staff consistently document, in patients electronic health records, the clinical information from the Homeless Operations Management and Evaluation System.

The Under Secretary for Health makes certain that a suicide risk screening is completed with patients during intake into VA homeless programs, consistent with Veterans Health Administration policy.

The Under Secretary for Health ensures that staff complete suicide risk screening in response to danger of self-harm identified in the Homeless Operations Management and Evaluation System.

The Under Secretary for Health makes certain that homeless program staff provide and document care coordination to address patients mental health and substance use disorder treatment needs as identified in the Homeless Operations Management and Evaluation System.

Executive leaders ensure there are clear signs during construction projects, and maps at the main entrance information desk to help veterans navigate the facility.

The Medical Center Director ensures contractors inspect and test emergency generators and fire doors as required, and staff report compliance to an environment of care committee.

The Associate Director of Patient Care Services/Nurse Executive ensures nursing staff monitor proper food clean-up, storage, and disposal in the Mental Health Residential Rehabilitation Treatment Programs areas.

The Medical Center Director ensures staff refill hands-free sanitizer dispensers throughout the facility.

Executive leaders ensure staff develop service-level workflows for the communication of test results for each service.

The Medical Center Director ensures staff implement a process to monitor providers compliance with communicating abnormal test results to patients.

Executive leaders ensure staff complete improvement actions from root cause analyses within one year.

Executive leaders ensure there are clear signs during construction projects, and maps at the main entrance information desk to help veterans navigate the facility.

Executive leaders ensure staff develop service-level workflows for the communication of test results for each service.

Facility leaders ensure providers who order tests communicate the results to patients timely.

In coordination with the Vice President, Technology Applications, update policies and manuals related to condition reporting to include newly established categories and mail conversion rates in the Mail Condition Visualization system and Handbook M-32.

We recommend the CISA Director analyze and document the targeted categories of its cybersecurity employees in mission-critical positions that possess unusually high or unique qualifications and limit retention incentives to only those qualified individuals.

We recommend the CISA Director develop and implement consistent policy and guidance on the minimum percentage of time that an employee must perform assignments related to a primary and secondary National Initiative for Cybersecurity Education code to qualify for the Cybersecurity Retention Incentive.

We recommend the CISA Director develop and implement an accurate, reliable, and auditable methodology and process for approving and tracking Cyber Incentive recipients and program use, to ensure that the data tracking needs are adequately addressed.

We recommend the CISA Director consolidate and assign responsibilities for managing the Cybersecurity Retention Incentive program to an office with the authority to make program decisions.

We recommend the CISA Director develop, update, and implement its policies for the Cybersecurity Retention Incentive program to: • document if employees are likely to leave Federal service if they do not receive a retention incentive and have the completed approval on file; • annually review whether each employee is still eligible for the Cybersecurity Retention Incentive; • define unusual and extraordinary circumstances for back pay and ensure the reasons for back pay are documented; • update and publish the eligible cybersecurity certifications list annually; and • track internal transfers and resubmissions of Cybersecurity Retention Incentive eligibility forms in a…

We recommend the CISA Director conduct further analysis and evaluation to resolve the $1.41 million in unallowable back pay given to Cybersecurity Retention Incentive recipients.

We recommend the CISA Director determine whether it is appropriate to seek repayment of improper incentive payments to ineligible employees and recover those co

We recommend the DHS Office of the Chief Human Capital Officer periodically review and monitor CISA’s Cybersecurity Retention Incentive program to ensure it meets programs goals and is in compliance with DHS policy, DHS directives, and the DHS Cybersecurity Retention Incentive Plan.

We recommend the FEMA Region 2 Administrator provide Puerto Rico with additional technical assistance and guidance for submitting detailed scopes of work related to rebuilding fully Puerto Rico’s electric power grid.

We recommend the FEMA Region 2 Administrator provide Puerto Rico with additional technical assistance and guidance for submitting detailed scopes of work related to rebuilding fully Puerto Rico’s electric power grid.

We recommend the FEMA Region 2 Administrator identify lessons learned from the Puerto Rico electrical grid rebuild and incorporate the need for improved guidance and technical assistance to grant recipients into the Agency’s policies and procedures to ensure greater accountability for future permanent projects.

The VA Secretary should ensure the Palo Alto major construction project (project number 640-424) is brought into the Acquisition Lifecycle Framework.

The VA Secretary should ensure the activities and artifacts required during the conceptual phase of the Acquisition Lifecycle Framework are completed for the Palo Alto major construction project (project number 640-424)"including a business case with cost, schedule, and performance goals approved by the Secretary.

The VA Secretary should ensure a decision event to verify the need of the acquisition is conducted for the Palo Alto major construction project (project number 640-424) and a determination is made to terminate or continue this project based on VAs strategic needs and the VA Palo Alto Health Care Systems clinical needs.

Ensure processes and guidance are in place for the director of the Office of Construction and Facilities Management to provide appropriate oversight and management over minor construction projects consistent with the authority and responsibilities described in 38 U.S.C. 312A.

Revise the Veterans Health Administration directive on minor construction projects to incorporate 38 U.S.C. 312A requirements and develop a review process for confirming compliance with the Office of Construction and Facilities Managements guidance and any applicable industry standards.