Open Recommendations

We recommend that the Peace Corps Office of Management establishes a process and procedure for all Peace Corps offices to record property on tracking spreadsheets and provide those spreadsheets to the Office of Management on a monthly basis, until Maximo is fully operational. Follow-up with any offices that are not adequately submitting the information.

We recommend that the Peace Corps Office of Management establishes a plan with milestones and timelines to fully implement Maximo as soon as possible and work with OCFO and the offices to ensure all applicable property data is transferred into the system.

We recommend that the Peace Corps OCFO perform monthly reconciliations of information entered on the property tracking spreadsheets with payable data in Odyssey and research any discrepancies to ensure the completeness and accuracy of the property tracking spreadsheets.

We recommend that the Peace Corps OCFO, once Maximo is operational, perform monthly reconciliations between Maximo and Odyssey and investigate any differences. Coordinate with the Compliance and Risk Office to review the initial reconciliations to ensure it is designed and operating effectively.

Agricultural Research Service Midwest Area Facility Condition and Security

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch determine the allowability of $1,389,642 in questioned costs USAID Office of Inspector General ($1,389,642 unsupported) on page 34 of the audit report and recover any amount that is unallowable.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that Pathfinder corrects the one material weakness in internal
control detailed on page 34 of the audit report.

We recommend that USAID/Tanzania verify that Christian Social Services Commission corrects the one material weakness in internal control detailed on page 40 of the audit report.

We recommend that USAID/Tanzania verify that Christian Social Services Commission corrects the two instances of material noncompliance detailed on pages 43 and 44 of the audit report.

We recommend that USAID/West Africa verify that ECOWAS Regional Agency for Agriculture and Food corrects the two instances of material noncompliance detailed on pages 13 and 14 of the audit report.

We recommend that USADF Department of Financial Management and Finance and Chief Financial Officer: Reassess the Funds Held Outside of Treasury reconciliation process for ways to improve the process to maximize the use of electronic records and bank access.

We recommend that USADF Department of Financial Management and Finance and Chief Financial Officer: Reassess the Funds Held Outside of Treasury reconciliation process for ways to improve the process to address inactive accounts and close accounts as necessary.

We recommend that USADF Department of Financial Management and Finance and Chief Financial Officer: Revisit the current policy and procedures related to the recording of financial transactions and reconciliation of bank accounts for the Funds Held Outside of Treasury accounts and make the appropriate changes to ensure that the trial balance and financial statements reflect the true course of events that occurred in their appropriate period.

Perform an assessment of employee resources in the Office of Financial Management, Planning, and Evaluation, and other relevant financial process areas to ensure an appropriate complement of resources are in place to manage accounting and reporting matters as they arise and through their normal course of business.

Provide training and supervision for personnel on financial management matters that affect the financial statements, including adhering to accounting policies and procedures, as appropriate, performing key internal control functions in support of financial reporting.

Develop desktop manuals to assist personnel in meeting their assigned responsibilities.

Improve the risk assessment process at the financial statement assertion and process level to ensure that CPSC management is appropriately capturing significant changes in the control environment and subsequently responding to those risks.

Implement key monitoring controls over the financial reporting process and develop robust policies and procedures to increase oversight, review, and accountability of accounting events at the process level to ensure the successful implementation of an effective internal control environment.

Improve the communication process between offices within the CPSC to ensure relevant and necessary financial reporting information requirements are communicated timely to achieve financial reporting requirements.

Enhance design, policies, and procedures related to monitoring and oversight of internal controls related to journal entries.

Review the existing roles for both journal entries and the compensating control of journal entry log recordation, and update as appropriate to ensure segregation of duties.

Provide training on the importance of internal control and segregation of duties based on updated policies and procedures.

Document their understanding of the acquisition process and determination of the appropriate recognition date of PP&E in order to update and enhance policies and procedures to align with the requirements of the applicable financial reporting standards.

Design and implement processes and controls in accordance with those updated policies and procedures to ensure PP&E balances are completely and accurately recorded in the general ledger.

Establish recurring communication with the appropriate stakeholders to ensure necessary information is available for analysis.

Design and implement processes and controls for accountable property to ensure accountable property is completely and accurately tracked.

Formalize and document a policy over prepaid expenses, including consideration of compliance with Generally Accepted Accounting Principles.

Design a control to identify, analyze, and respond to risks related to the reporting of pre-paid expenses.

We recommend that HHS update its enterprise architecture system inventory and software/hardware asset inventories to include the information systems and components that are active on the HHS network. HHS should utilize the inventories to continuously monitor assets and identify and remediate vulnerabilities timely to better manage the risks to these assets.

We recommend that HHS complete implementation of a cybersecurity risk management strategy to assess and respond to identified risks within the agency and identified across OpDivs, watch for new risks, and monitor risks and confirm implementation. The strategy should define a standardized process to accept and monitor risks that cannot be adequately mitigated.

We recommend that HHS require OpDivs incorporate analyses of security impacts of significant changes prior to implementation to measure its impacts to the organizations' security and enterprise architecture and confirm implementation.

We recommend that HHS require OpDivs to implement an effective SCRM program that meets the defined standards across HHS and confirm implementation is consistent with established standard. This should include requiring OpDivs to assess vendors and submit said monitoring results to HHS to assist with tracking and monitoring components on the network.

We recommend that HHS require OpDivs to establish oversight of background investigations performed for employees and contractors with logical access across the agency and perform continuous monitoring for new and existing users to ensure OpDivs are aware of the investigation status of their users.

We recommend that HHS confirm that OpDivs' policies require monitoring of privileged user accounts for both logging and activity reviews, in an automated manner.

We recommend that management design and implement additional controls that respond to the risks associated with the relevance and reliability of underlying data used in developing the assumptions related to the subsidy re-estimates. Such review should be documented and maintained.

We recommend that FSA work with the Department to evaluate, design, and implement controls to track and report all new and separated contractors to allow for timely onboarding or off-boarding, respectively.

We recommend that FSA work with the Department to provide training and oversight to the Department's personnel with access authorization and provisioning controls and ensure all requirements are met and documented prior to granting system and network service directory access.

We recommend that FSA work with the Department to update access review procedures to require the reviewers to verify the access lists received to be used in the performance and operation of the access reviews is complete and accurate and not modified prior to commencing the access reviews.

We recommend that FSA work with the Department to ensure the database, server layer, and network service directory controls comply and operate with the disabling of inactive accounts, PIV authentication, account lockout duration password setting requirements, as required by Department policy.

We recommend that FSA work with the Department to following established user access provisioning procedures detailed in the Federal and Department guidance to authorize access and assign roles that are commensurate with job functions and do not violate the least privilege principle.

We recommend that FSA work with the Department to oversee the Department's systems change management process to enforce adherence to the change management plan to ensure relevant documentation and approvals are properly completed prior to closing the change ticket.

We recommend that FSA work with the Department to update the Department's systems' change management plan to require program change supporting documentation, such as approvals, be retained.

We recommend that FSA work with the Department to develop and implement formal procedures addressing controls over the Department's systems': (a) Changes to production jobs, and schedules; and (b) monitoring of actions taken by the generic job processing account in the job scheduling tool, including management of the password for the generic account.

We recommend that FSA design and implement controls to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.

We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.