Open Recommendations

FHFA should encrypt all backup data-at-rest at FHFA’s alternate site and update the existing plans of action and milestones to include compensating controls until the plans of action and milestones has been closed.

We recommend that DFC's Chief Information Officer fully implement event logging requirements in accordance with Office of Management and Budget, Memorandum M-21-31.

Update and implement the POA&M Management and Acceptance of Risk Process document to clearly define requirements of when vulnerabilities must be documented within a POA&M, and what the remediation timeline for POA&Ms must be.

Enforce existing policies and procedures to consistently perform reviews and analyze system audit records, and document and maintain those reviews and analysis for privileged users and actions taken on [redacted] devices in accordance with FDIC policy.

Update DOT Orders 4410.4 and 4600.2B to incorporate the requirements of Public Law Number (Pub. L. No.) 115-419.

Update DOT Order 2700.13 to direct Operating Administrations to develop and implement a process to validate and reconcile capitalized equipment listings with DOTs Delphi financial system and provide confirmation of completion.

Update DOT Order 2700.13 to clarify when Operating Administrations deviations from established DOT capitalization thresholds must be approved by the Office of the Secretary and implement a requirement for documentation justifying higher or lower thresholds.

Direct the Federal Highway Administration (FHWA), National Highway Traffic Safety Administration (NHTSA), Maritime Administration (MARAD), and Federal Railroad Administration (FRA) to update the relevant orders or guidance to incorporate the requirements of Pub. L. No. 115-419 and require confirmation of completion. These orders and guidance are FHWA Order 4300.1; NHTSA Order 440-1D; MARADs Property, Plant, and Equipment Desk Guide; and FRA Order 4601.1E.

Direct FRAs Office of the Chief Financial Officer to capitalize FRAs eligible equipment in accordance with DOT Order 2700.13 and provide confirmation of completion.

Direct the Federal Motor Carrier Safety Administration (FMCSA) to implement policies and procedures for the management of capitalized equipment that incorporate the requirements of Pub. L. No. 115-419 and provide confirmation of completion.

Develop and implement standard operating procedures to identify and calculate reliable drug control-related obligations.

Develop and implement a methodology that can be applied to data in NHTSAs financial system to track drug control-related obligations, by budget decision unit and drug control function.

Develop a budget formulation methodology that provides a reasonable basis for consistent estimation of NHTSAs drug control budget that fairly quantifies its financial commitment to drug control activities and provides the methodology to the Office of National Drug Control Policy for approval.

1. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST revise MEP's economic impact reports for FYs 2022 and 2023 and other references to economic impacts on MEP's website attributable to the Centers we reviewed; in addition, disclose MEP's reported economic impacts may be based on inaccurate data and therefore their reliance and use should be limited.

2. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures for NIST personnel to ensure data reliability (reasonably free from error and bias), including but not limited to (1) formal policies requireing staff to diligently review significant impacts for accuracy and connection to services provided by Centers and (2) techniques to analyze survey data for anomalies before it is finalized.

3. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish and implement procedures for Centers and subrecipients to (1) comply with NIST guidelines and (2) ensure data reliability (reasonabley free from error and bias), including but not limited to techniques that hold Centers accountable, such as including consequences for noncompliance and certification of Center executives confirming integrity, independence, and due diligence that the reported economic impacts represent what they are intended to: actual economic benefits realized over the last 12 months that are attributable to the services provided.

4. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures that hold Centers accountable for monitoring subrecipient compliance with NIST survey guidelines and ensuring data reliablility (reasonably free from error and bias), including consequences for noncompliance.

5. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST revise MEP's economic impact reports for FYs 2020 through 2023 to (1) accurately reflect NIST's return on investment and (2) clearly articulate that total federal invistment does not include other federal funding sources that may contribute to reported ecomonic impacts.

6. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures for NIST personnel to ensure future economic impact reports accurately reflect NIST's return on investment.

7. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST direct MEP to immediately remove from NIST reporting guidelines statements that currently direct Centers to write the expection of completing the MEP survey into contracts.

8. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST direct MEP to immediatley direct Centers and their subrecipients to remove contract clauses requiring clients to take the MEP survey.

We recommend that CBP’s Office of Facilities and Asset Management establish and implement a CBP-wide policy to include designated roles and responsibilities for managing and overseeing the facility condition assessment program.

We recommend that CBP’s Office of Facilities and Asset Management establish and implement a CBP-wide process for conducting facility condition assessments that aligns with DHS’ policy; identifying, prioritizing, and resolving deficiencies identified during facility condition assessments; and reporting and monitoring deficiencies.

We recommend that CBP’s Office of Facilities and Asset Management implement a quality control process to ensure facility condition assessment data within TRIRIGA is accurate and complete.

Develop its own internal program to recover unclaimed assets instead of remaining dependent upon Fiscal Service.

We recommend the Senior Vice President, Generation Projects and Fleet Services, work with Power Operations to confirm that all Tennessee Valley Authority specifications (1) are included in solicitation documentation, (2) have been updated, and (3) are applicable to the type of project being bid.

We recommend the Senior Vice President, Generation Projects and Fleet Services and Vice President, Supply Chain, work with Transmission Planning and Power Operations personnel to (1) assess the Cumberland and Kingston procurement for cybersecurity risk and take appropriate actions, if necessary, and (2) establish and/or clarify responsibilities related to Supply Chain cybersecurity compliance with standards for equipment covered in procurements.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity update protocols to promote consistent expectations for timely supervisory, legal, and headquarters reviews of complex cases.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update the MOUs with OGC for each region to identify and remove inefficiencies that can lead to longer FHEO investigation times and OGC review times and identify best practices that can be implemented across all regions.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update investigative processes followed by each regional office to identify best practices that can be implemented across all regions and identify and remove inefficiencies that can lead to longer investigation times.

The Chief Tax Compliance Officer and Chief, Taxpayer Services should develop a coversheet to be included with and/or revise the CP161 notice to clearly inform business taxpayers that they are in a Federally declared disaster area, they have been automatically granted payment relief, and the payment of their balance due taxes is not due until the end of the postponement period shown on the coversheet and/or notice as the due date. If a coversheet is included with the CP161 notice, ensure that taxpayers are informed to disregard the payment due date shown on the CP161 notice.

(U) Establish requirements for regularly soliciting input from judges eligible to participate in the HIDS program, evaluating the judges' input, and assessing the feasibility of implementing changes that will increase HIDS program enrollment and help ensure current participants remain enrolled in the program.

(U) Track alarm monitoring participation rates, consider feedback from judges about why they choose not to obtain monitoring services, and make any necessary changes to the HIDS program to maximize the number of judges electing to include alarm monitoring in their HIDS configuration.

(U) Require district JSls to conduct residential security surveys of the home of all HIDS participants upon their enrollment in the program, unless the participant specifically declines.

(U) Update the HIDS Program Guide to identify and define the authorities, qualifications, roles, and responsibilities of all individuals tasked with facilitating, executing, and overseeing the HIDS program.

(U) Update the HIDS Program Guide to require all appropriate JSD personnel to complete periodic HIDS training and track the completion of any HIDS training for all attendees.

(U) Reevaluate its appeal policy and process and implement any necessary changes to ensure the timeliness of appeal decisions, such as tracking the date all documentation is received.

Complete a review of transportation schedules and identify and implement actions to address transportation needs at the Denver Processing and Distribution Center.

Coordinate with the Denver Network Distribution Center to determine and implement optimal transportation schedules and reduce the number of canceled outbound trips.

Consistently meet load and unload scan goals at the Denver Processing and Distribution Center.

Should the Navigator program continue, establish performance targets to assess recipient’s progress towards assisting underserved small business owners and entrepreneurs.

Should the Navigator program continue, enhance guidance for grant recipients to use acceptable methods to collect more complete client information reported to program officials.

Enhance the data validation procedures to ensure program officials check for accuracy and completeness of the performance data grant recipients upload to the system.

Establish and implement a risk-based process to compare performance results for Navigator program grant recipients and partner organizations that are also SBA resource partners to ensure performance is separate and discrete.

Should the Navigator program continue, update the programmatic compliance checklist to include a separate step to identify changes in partner organizations and ensure the grant recipient received proper prior approval; and implement procedures to promptly update the public website for approved partner organization changes.

Establish measurable targets and timeframes for all performance measures to ensure compliance with GPRAMA and OMB Circular A-11 requirements.

Perform an analysis of data and develop an approach to identify intended outcomes for the Climate Hubs’ goals. Based on this approach, develop outcome-based measures to adequately assess the Climate Hubs’ progress in meeting its strategic goals.

Develop KPI(s) that clearly align(s) with the strategic goals to encompass the Climate Hubs’ performance measures.

Revise the performance reporting process to follow Federal requirements on informing stakeholders how the Climate Hubs’ strategic goals are accomplished.

Determine the allowability of the questioned unsupported costs of $86,856 ($76,458 costs incurred, and $10,398 cost share contribution), on pages 1 and 5 of the audit report and recover any amount that is unallowable.