Open Recommendations

Track training completion to ensure PAOs and property custodians meet the annual recertification requirement outlined in NARA Directive 600.

We recommend that the Office of Information Technology update training for all employees on identifying and reporting suspected phishing emails, and establish a process to periodically remind employees of these responsibilities.

Develop and implement an agency-wide IP risk assessment standard operating procedures
(SOP). This SOP should include risk assessment procedures to be performed by each
identified significant program. These procedures should be based on OMB Circular A-123
guidance found in Appendix C.

For each identified significant program, the responsible program official (or office) should
review and approve the program-specific risk assessment. This review and approval should
be documented.

Leverage the existing risk-assessment tool and add FLRA specific reviews, as well as the
above-mentioned employee pay and benefits section.

Revise policies and procedures for financial reporting to ensure costs are tracked and reported accurately and timely.

Work with ARC to resolve the questioned cost of $36,547 for non-ARC matching equipment cost.

Work with ARC to resolve the questioned cost of $276 of ARC funded equipment cost.

Establish and implement internal controls to review expenditures for allowability in accordance with the Uniform Guidance and exclude unallowable cost from the amounts reported.

Work with ARC to resolve the questioned cost totaling $1,060 of ARC funded equipment cost.

Establish policies and procedures for granting procurement system access to users provisioned outside of the recurring new user process, including documented justification and approval by a system administrator.

Provide additional resources or training for appropriately assessing and recording lease terms with similar circumstances in accordance with existing policies and procedures.

Consider designing modified financial reporting controls as part of government furlough planning and reassess the nature of journal vouchers requiring the Director of Financial Management review.

Communicate to journal voucher preparers and reviewers a reminder regarding their responsibility to review supporting documentation for indicators of intragovernmental transactions and ensure trading partner attributes are included as appropriate while preparing and reviewing manual journal vouchers.

Ensure that documentation that evidences the performance of revenue reconciliations is complete and accurate.

Update policies and procedures to specify how the completion of the reconciliation process is evidenced.

Develop specific procedures to ensure that program managers, Contracting Officer's Representatives, and/or Human Resources personnel notify the Access Control Officers for service organization systems used by the agency when an employee or contractor separates from the agency or no longer needs access.

Implement and document a second-level review of the accounting information assigned to vendor-initiated payments to ensure that payments are assigned to the correct contracts and option years and that payments are assigned to the correct Treasury Account Symbol.

Create and enforce agency-specific written policies and procedures that specify how personnel actions should be initiated, reviewed, and submitted. These policies and procedures should specify the roles and responsibilities of Human Resources personnel relating to this process and the required elements and documentation of management's review of personnel actions prior to submission.

Perform and document routine reviews on a monthly or more frequent basis to ensure that all personnel actions processed during the period were appropriately reviewed and approved by a second, authorized Human Resources official and the information reported on the Standard Form 50 is accurate in all respects.

Enforce existing policies and procedures requiring all employees to submit a leave request for all annual leave used.

Require timekeepers or other appropriate personnel to verify that all employee leave requests have been submitted and properly approved by the certifying officials and that all leave hours taken agree with the leave type that was requested and approved.

Revise policies and procedures to ensure that supervisors are reviewing employee timesheets at a level of precision that ensures that leave requests have been submitted and approved for all leave hours taken.

Perform its annual physical inventory at a higher level of precision, including identifying and following up on items that have been reported as lost or stolen or for which the stated location is not accurate.

Correct and then regularly update all listings of STB's assets to enable the agency to quickly and accurately locate all items issued to STB personnel.

Work with the service provider to identify, at least quarterly, upward adjustments that have been offset by downward adjustments in the general ledger or perform an independent review of the general ledger activity of both accounts so that manual adjustments can be recorded to properly state the ending balances of both accounts, if needed.

Design and implement policies and procedures which enhance the internal review process for upward and downward adjustment transactions and include a reconciliation of the undelivered orders balances with the supporting documentation to ensure that transactions have been recorded correctly.

Perform a review of all employees' leave balances to ensure they are accurate and comply with 5 U.S. Code 6304 requirements.

Enforce standard operating procedures to require a second Human Resources Specialist or the Human Resources Director to review all employee transfer and onboarding documents to ensure that the documentation is complete and agrees with the information that was entered into the payroll and personnel system before the information is submitted to the payroll service provider.

Perform and document STB's assessment of the recoverability of excess taxes that were paid in error by the agency in matching Old-Age, Survivors, and Disability Insurance and Medicare contributions and the conclusion that was reached.

Research the impacted employee's payroll records to confirm the error and determine why the error occurred. Appropriate action should then be taken to identify any other affected employees and to correct the root cause of the error.

FHWA management enforce the FHWA Configuration and Change Management Process to ensure that approvals and documentation related to application changes ae completed in accordance with the National Institute of Standards and Technology (NIST) 800-53, DOT and system requirements.

FHWA management enforce the change management requirements per the DOT Compendium and the FHWA Configuration and Change Management Process policy to ensure testing and approvals are appropriately performed and documented for each change.

User access application management implement and enforce the password complexity requirements in accordance with NIST 800-53, Office of the Chief Information Officer (OCIO) Cybersecurity Compendium Workbook, and the application's System Security Plan (SSP).

OCIO management enforce required policies and procedures to ensure that roles and permissions are clearly identified, documented and approved within a new access request form/ticket prior to provisioning administrator access within grant management system's operation system.

FHWA and OCIO management implement a quarterly access review of user access configured within the FHWA grant management system and user access application databases and the FHWA grant management system operating system in accordance with the DOT OCIO, Cybersecurity Compendium Workbook.

FTA management implement a quarterly access review process over all integrated Appian platform access reviews in accordance with the DOT Compendium.

FHWA management further refine and enhance their estimation methodology to ensure it remains responsive to future expense fluctuations, including conducting a timely comprehensive risk assessment as a result of their quarterly lookback process.

FTA enhance and finalize the FTA Grant Accrual Standard Operating Procedure (SOP) to more clearly outline the historical day calculation methodology used in the accrual calculation.

FTA ensure the review process is sufficient to identify any deviations from the outlined policy.

FTA communicate the finalized SOP to preparers of the grant accrual workbook to ensure appropriate understanding of the enhanced methodology and review requirements.

Facility leaders direct staff to conduct a risk assessment on liquid nitrogen storage, to include the small devices stored in examination rooms, and implement changes if needed.

Facility leaders determine appropriate supply storage locations and, for any supplies stored outside of the defined locations, implement a process to ensure staff identify and remove expired supplies.

Facility leaders ensure staff label opened multidose medications with expiration dates.

Facility leaders ensure staff store clean and dirty items separately.

The Director ensures staff implement processes to prevent repeat environment of care findings.

The OIG recommends facility leaders ensure the facility has a policy for the communication of test results and staff develop service-level workflows that align with VHA requirements.

Veterans Integrated Service Network 19 leaders assess the staffing needs for the facility’s radiology service and provide additional resources to ensure services are readily available to patients.

Veterans Integrated Service Network 19 leaders evaluate the reasons for delays in uploading images and reporting test results and assist the facility’s community care leaders to mitigate future delays.

Executive leaders monitor root cause analysis improvement actions through completion, monitor outcome measures, and ensure staff implement processes to sustain the improvements.