Open Recommendations

Update SALA’s Accounting Manual to include a specific, compliant method for charging support staff salaries directly to sponsored funding sources as well as policies and procedures to account for hours worked in excess of the SALA 35 hours per week requirement.

Once the Accounting Manual is updated, provide training to its accounting staff.

Update the SALA Accounting Manual with detailed second-party review procedures to ensure that unallowable expenses are not charged to the LSC grants.

Once the Accounting Manual is updated with detailed procedures, train applicable SALA staff on the timecard and second-party review procedures.

Develop detailed review procedures and/or checklists to be used in oversight reviews of records created to support accounting entries and/or compliance assessments.

FHFA should ensure proper staffing and train staff on existing consumer communications requirements as to: (a) timeliness of responses to consumers; and (b) completeness, accuracy, and timeliness in processing documentation.

FHFA should update existing consumer communications procedures as needed to include new controls, or improve existing controls, to ensure: (a) the timeliness of FHFA’s responses to consumers; and (b) the completeness, accuracy, and timeliness of the Agency’s processing of documentation.

FHFA should train staff on the updated consumer communications procedures as needed.

(U) Rec 1: The DoD OIG recommended that the Under Secretary of Defense for Policy, in coordination with the director of the Defense Security Cooperation agency, work with the director of the Department of State Bureau of Political-Military Affairs office of Regional Security and Arms Transfers to develop and implement a policy stating that a single entity is responsible for notifying both the divesting and receiving security cooperation organizations of all approved, government-to-government third-party transfers of enhanced end-use monitoring-designated defense articles to a hostile environment. Additionally, the policy should require the divesting security cooperation organizations of all initiated transfers and…

FHFA’s Office of General Counsel should seek Freddie Mac legal counsel’s formal position regarding the privacy issues the Enterprise raised with respect to personally identifiable information contained in appraisals that are submitted to state licensing authorities.

FHFA’s Office of General Counsel should assess Freddie Mac legal counsel’s formal position and issue guidance to both Enterprises to ensure a consistent approach.

If FHFA’s assessment in recommendation No. 2 warrants, the Division of Public Interest Examinations should ensure that Freddie Mac resubmits complaints from our sample to the relevant state authorities and include copies of the full appraisal report without duplicating complaints previously submitted by Fannie Mae.

FHFA's Division of Public Interest Examinations should ensure that Freddie Mac updates its existing complaint submission practices so that future complaints filed against appraisers follow the instructions of state appraiser licensing authorities for each complaint, consistent with FHFA’s legal position and guidance to the Enterprises in conjunction with recommendation No. 2.

FHFA's Division of Public Interest Examinations should update its fair lending examination procedures to establish examination performance and documentation standards for ongoing monitoring of remediation activities that are no less rigorous than the standards established for examiners by the Division of Enterprise Regulation and require examiners to document the basis for determinations regarding completed corrective actions taken by the Enterprises to remediate time-sensitive examination findings.

Work with ARC to resolve the reporting discrepancies and revise the Final SF 270 to exclude the questioned cost of $52,706 for ARC funded cost and $14,650 for non-ARC match costs.

Work with ARC to resolve the questioned cost totaling $25,849 for ARC funded equipment costs.

Establish and implement policies and procedures for determining the allowability and allocability of costs, record retention, safeguarding of equipment, timekeeping, and procurement standards as required under the Uniform Guidance.

The IPA recommended that Departmental Offices (DO) management review DO-910 and FARS SSP password setting requirements to determine if they apply to all layers of system technologies (e.g., application, database, and operating system). If necessary, consider specifying distinct password setting requirements for the different layer.

The IPA recommended that DO management implement password authentication controls at the FARS database in accordance with the minimum requirements set by DO-910 and the FARS SSP, to include the number of failed login attempts allowed.

The IPA recommended that DO management: Develop policies and procedures for performing the quarterly review and reauthorization of privileged OS access, which specify: How to document the review of user access for continued appropriateness and the resulting determinations. Assignment of individual(s) responsible for performing the review(s) across the various privileged OS domains/groups/accounts, who are independent of the access they review and are of the appropriate authority. Identification/Inventory of the privileged OS domains/groups/accounts that are subject to review, to include any privileged OS service groups/accounts.

The IPA recommended that DO management disseminate said policies and procedures to control performers and re-perform a review and reauthorization of privileged OS access that enforces independence from an individual reviewing their own access, includes OS service groups/accounts, and is documented/retained, in accordance with the established policies and procedures.

The IPA recommended that Fiscal Service management reinforce policy requirements (through training or other means) for removing logical access of terminated and transferred Fiscal Service employees and contractors within 2 business days of their separation date.

The IPA recommended that Fiscal Service management perform ongoing monitoring to hold responsible control performers accountable for timely completion of such control activities.

The IPA recommended that Fiscal Service implement policies and controls for performing a user access review and recertification of AS Splunk Administrators supporting CAIA on a quarterly basis.

Fiscal Service management implement proper segregation of duties to ensure that an independent review of all user's access is performed as part of the semi-annual PAM Mainframe privileged user access review.

Fiscal Service management enforce accountability of individuals performing user access review control responsibilities in accordance with policies and procedures.

Fiscal Service finalize policies and procedures to review audit logs of production IBM Database 2 (DB2) servers.

Fiscal Service implement an oversight process to ensure that designated Fiscal Service management: (1) reviews the security logs for the UNIX and DB2 servers hosting the PIR, JFICS, and SPS applications on a pre-defined frequency, as indicated in the BLSR; (2) formally documents completion of their reviews and any escalations to the Information System Security Officer (ISS); and (3) retains the audit logs and documentation of its reviews for 18 months, as required by the BLSR.

Fiscal Service periodically review Fiscal Service management's implementation and operation of the review the security audit logs for the UNIX and DB2 servers hosting the PIR, JFICS, and SPS applications to determine that Fiscal Service management completes the reviews on a pre-defined basis, documents completion of the reviews and escalations, and maintains such documentation.

Fiscal Service establish an effective enforcement process or mechanism to ensure that (1) UNIX and DB2 events and monitoring controls are followed, and (2) Fiscal Service management has confidence it consistently reviews for potential unauthorized or inappropriate activity.

Fiscal Service develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.

Fiscal Service update existing UNIX and database configuration security baseline documents to ensure that these documents fully incorporate and enforce the components of the DISA STIGs. Management should document any deviations from the STIGs and note compensating controls that mitigate the security risk to an acceptable level.

Fiscal Service develop, document, and implement policies, procedures, and controls to conduct periodic reviews of actual UNIX and database settings against the security configuration baselines.

Fiscal Service provide logging and monitoring of security related events to include the retention of evidence of reviews performed.

Fiscal Service develop a baseline of essential security settings and specify that baseline as the standard to be observed.

Fiscal Service implement corrective actions to address all vulnerabilities associated with the baseline enforcement to include removing the three default user accounts on UNIX servers.

Fiscal Service perform a review of the current system environment against the CMDB.

Fiscal Service perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the CMDB.

Fiscal Service update policy and procedures related to the above recommendations and disseminate the documentation to enforce such policy and procedures.

We recommend the Assistant Secretary for Employment and Training to evaluate its authority to share data and develop fraud prevention resources and controls with other federal entities, including SBA, that include data sharing mechanisms to detect and mitigate fraud.

We recommend the Assistant Secretary for Employment and Training collaborate with SBA to conduct a joint study to assess and identify the UI claim data elements that should be shared for data matching with disaster program data elements for the purpose of detecting potentially fraudulent activities under both the UI and SBA disaster assistance programs.

Ensure West Virginia JCS develops policies and procedures to ensure compliance with victim assistance priority areas funding requirements.

Ensure West Virginia JCS: (1) updates its VOCA Administrative Manual with applicable VOCA Fix and federal award requirements, and (2) periodically reviews and makes necessary updates to the document to ensure compliance with federal statutes, regulations, and the award terms and conditions.

Work with West Virginia JCS to establish a monitoring mechanism that will ensure that it adheres to the frequency of on-site monitoring visits, as required by its policies.

Coordinate with West Virginia JCS to establish procedures, such as staff instructions and control mechanisms, to: (1) maintain a comprehensive schedule of monitoring activities, (2) ensure monitoring actions effectively assess subrecipients' implementation of VOCA-funded programs, (3) develop and provide to subrecipients reports of monitoring activities complete with required signatures in accordance with West Virginia JCS policies, and (4) pursue and close out monitoring report findings and recommendations.

Remedy $198,099 in unsupported subaward expenditures.

Require West Virginia JCS to establish adequate controls to ensure its monitoring staff performs monthly financial reviews in compliance with the West Virginia JCS policies and that it maintains evidence to support all claimed subrecipient expenditures reviewed as part of monitoring activities.

Work with West Virginia JCS to develop and implement written policies and procedures to ensure compliance with the Uniform Guidance requirements for pass-through agency action on subrecipient single audit reports.

Ensure West Virginia JCS updates its policies and procedures to implement a process to collect, verify, and maintain monthly progress reports and their respective support.

Ensure West Virginia JCS updates its policies and procedures to implement a process to collect, verify, maintain, and provide accurate data to the OVC that measures the performance and effectiveness of activities funded by the VOCA awards.