Open Recommendations

We recommend that EAC management ensure that all management and personnel, directly and indirectly responsible for performing processes outlined, have read, and understand the documented policies and procedures.

We recommend that EAC management perform periodic review of policies and procedures, and policies and procedures are updated in a timely manner.

We recommend that EAC management develop process narratives to assist new and transitioning personnel in understanding their scope of responsibilities and job function as well as help management perform review.

The assistant secretary for information and technology and chief information officer improve vulnerability management processes to ensure all vulnerabilities are identified and that plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

We recommend that USAID/Uganda verify that The AIDS Support Organization Uganda Limited provides Uganda Protestant Medical Bureau with a copy of the audit report for their review and to take any corrective action regarding the one instance of material noncompliance identified on pages 37 and 38 of the audit report related to the subawards.

We recommend that USAID/West Africa verify that West African Health Organisation corrects the two material weaknesses in internal control detailed on pages 17 and 18 of the audit report.

We recommend that the Washington State Department of Social and Health Services' Aging and Long-Term Support Administration work with the 20 adult family homes to correct the 214 instances of noncompliance identified in this report.

Treasury Office of Inspector General (OIG) should request West Virginia management to provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance for the $20,917,332 of ineligible costs charged to the Direct Payments greater than or equal to $50,000 payment type. If support is not provided, Treasury OIG should recoup the funds. Based on West Virginia's responsiveness to Treasury OIG's requests and West Virginia's ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Castro recommends Treasury OIG determine the feasibility of conducting an audit for the Direct…

Treasury Office of Inspector General should follow-up with West Virginia's management to confirm if the transactions noted as unsupported expenditures of $657,742 within Aggregate Payments to Individuals can be supported. If support is not provided, Treasury OIG should recoup the funds or request West Virginia management to provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Based on West Virginia's responsiveness to Treasury OIG's requests and West Virginia's ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an…

Treasury’s Office of Capital Access disallow the questioned cost amount of $74,160 and instruct the State of Washington to refund that amount to its ERA2 program from non-Federal funds.

Treasury’s Office of Capital Access should disallow the questioned cost amount of $341,994.05 and instruct Thurston County to refund that amount to its ERA2 program from non-Federal funds.

GLS should amend its procedures relating to the annual count and valuation of operating materials and supplies to include verification of unit and total costs. This should include locating or reconstructing source documentation for the total quantity on hand for each item and matching the costs entered in the system to the source documents.

GLS should determine how average costs are calculated within the inventory tracking system. If the average cost in the system for specific inventory items does not represent the average cost of inventory on hand, the average cost in the system should be periodically adjusted when the annual inventory is performed or at year-end.

GLS should continue executing its corrective action plan and complete the review of the unit and total costs of inventory items.

Proactively and independently initiate discussions with Legal Counsel on an at least quarterly basis in order to identify contingent liabilities which should be recognized and/or disclosed in the Corporation's financial statements and footnotes so that appropriate entries can be recorded, and/or notes disclosures prepared, prior to the finalization of the financial statements and footnotes.

Document the actions taken to verify that the information received is complete and whether information is needed from other sources to complete the financial reporting process.

Update the Corporation's standard operating procedures to incorporate timely inquiries of legal counsel during the preparation of the financial statements and footnotes.

STB management should amend its existing policy regarding the review and approval of journal vouchers to include a review of all non-reversing entries recorded during the fiscal year and to review all year-end journal vouchers before they are recorded in the agency's general ledger.

STB management should perform and document a review of all manual journal entries that includes a before and after analysis which illustrates the effect of the entry on the principal financial statements using the current year Treasury United States Standard General Ledger (USSGL) Section V Crosswalks to the financial statements. If accounts are presumed to offset, then they must offset within the same line of the same financial statement within the same fiscal year reporting period (i.e., before closing entries are recorded following the end of the fiscal year).

At least quarterly, STB management should initiate and document a review of all entries and account balances for which a manual correcting entry may be needed to address potential misstatements due to system posting logic, such as offsetting upward and downward adjustments of prior year obligations, and record the appropriate entries to prevent misstatement of financial statement accounts and line items.

During the review of manual journal vouchers, STB management should verify and document that the authoritative guidance and internal tools used to support the entry are valid and current.

The STB Finance Team should complete training relating to adjusting entries, including the selection of USSGL accounts, to improve the quality and precision of the review and approval process.

STB management should independently review the most current version of OMB Circular A-136 and the USSGL Treasury Crosswalks to identify changes in data elements, classification, and presentation and ensure that these changes are incorporated into financial statement and footnote templates for current year reporting. A search for new versions of the USSGL Crosswalks and OMB Circular A-136 should be performed each time the financial statements are prepared.

STB management should review the current version of OMB Circular A-136 to independently verify that all required footnotes are included and bring any omissions to the service provider's attention so that errors or omissions can be corrected.

STB management should review the service provider's Financial Statement and Notes Review Checklist to verify that the checklist is up to date and includes all required elements per OMB and Treasury guidance and then complete the checklist independently. Alternatively, STB management should develop and complete its own review checklist based on current Treasury and OMB reporting requirements.

STB management should request its financial management service provider to:
Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or
Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the balance sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

STB management's review and certification of the financial statements and footnotes should be clearly documented and indicate what was reviewed, when the review was performed, and who performed the review for each reporting period.

STB financial management should complete training relating to the preparation and/or review of financial statements and footnotes to improve management's understanding of Federal reporting requirements and to ensure that the financial statements and footnotes are complete, accurate, and appropriately presented.

STB should perform a review of 100 percent of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should develop policies and procedures that include the performance of periodic reviews of employees' OPFs to ensure that they are complete and accurate.

STB should address missing or unavailable supporting documentation with its shared service provider to ensure that document retrieval tools are available and are working properly to allow retrieval of all stored documents.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

STB management should implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

Clearly identify and publicly publish MSHA's jurisdiction, including obtaining any needed legal opinion from the U.S. Department of Labor Office of the Solicitor on the U.S. territories and the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, requesting any needed legislative changes.

Revise MSHA's implementation plan for when it will begin inspecting mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands and begin implementing the plan. The revised plan should address: (1) when enforcement of the Mine Act and MSHA regulations will begin; (2) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field office nearby); (3) whether additional training will occur and how (e.g., in-person, virtual, hybrid, via grants, et cetera); and (4) how funding will be obtained to conduct required MSHA activities in FY 2025

Develop and implement a plan to enforce the Mine Act in the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, having first obtained legal authority verifying they are still under MSHA's jurisdiction. If the legal authority opines MSHA has jurisdiction over them, MSHA's plan should address: (1) whether future legislative changes to the Mine Act are needed and requests to Congress; (2) when enforcement of the Mine Act and MSHA regulations will begin; (3) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field…

Verify mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands have properly submitted their Part 50 data to MSHA.

Update the status history for all mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands, including to reflect the periods for which they were operational. This should include adjustments needed after verifying the mines properly submitted their Part 50 data.

Update the mine status criteria to address the types of support (e.g., mine visit observation, closure notice submitted by operator, MSHA analysis of Part 50 data, et cetera) needed to put a mine in "abandoned" status and require support be documented in the related mine file.

Develop guidance for what to do with mines that have been issued a mine identification number and remained in "new mine" status for long periods of time because they never started operations.

Correct mine statuses for any mines that do not adhere to guidance and criteria updates made in response to this alert memorandum, which includes updating the mine status criteria requirements and developing guidance for mines remaining in "new mine" status for long periods of time.

Develop guidance on when mine identification numbers can be deactivated and reactivate any mine identification numbers in MSHA's system that do not adhere to that guidance.

Remove the exclusion of CAVs limitation from the public "inspections" dataset or transparently state any existing limitation(s) on the download description section of MSHA's website.

Develop and implement a culture transformation plan to ensure the integrity and ethical values expected are enforced throughout MSHA.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Enforce existing policies to ensure that all users are included within quarterly user access reviews.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Enforce independent review of personnel’s system access and redesign existing policies and procedures in order to perform the review of all personnel’s access each fiscal year.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.