Open Recommendations

Update the DNA Accounting Manual and Employee Manual, as required, to include:
A policy prohibiting checks made payable to cash.
A local travel policy with the elements required by the LSC Financial Guide.
The LSC Financial Guide requirements for travel advances.

Implement controls to ensure that entries for transactions are adequately referenced in the general ledger, and source documents are traceable to the general ledger. Grant codes should be coded in the accounting system and included with supporting documentation.

Implement procedures to ensure that budgets are prepared and approved by the Board prior to the start of each fiscal year. Also, ensure that there is documentation of Board approval.

Ensure the budget is fully documented by location, funding source and program, as stipulated in the DNA Accounting Manual.

Castro recommends Treasury OIG follow-up with Guam's management to confirm the transactions noted as unsupported expenditures within the Direct Payments greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to Individuals can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Guam management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on the Government of Guam's responsiveness to Treasury OIG's requests and its ability to provide to provide sufficient documentation and/or replace unsupported and ineligible transactions charged…

Treasury OIG follow-up with Guam's management to 1) determine the feasibility of performing additional testing to verify if unsupported disaster relief payment errors identified were isolated errors or if it represents a systemic issue across other disaster relief payments claimed by Guam; and 2) determine the feasibility of performing additional testing on unsupported expenditures paid to hotels for quarantining to determine eligibility and reasonableness.

We recommend Treasury's Office of Capital Access should follow-up with Guam to obtain a copy of its fiscal year 2022 Single Audit report.

Treasury's Office of Capital Access to ensure that management decision letters are issued on the findings identified in the Single Audit Reports

We recommend that USAID/Tanzania verify that Tanzania Women Lawyers Association corrects the one material weakness in internal control detailed on page 23 of the audit report.

We recommend that USAID/Tanzania verify that Tanzania Women Lawyers Association corrects the one instance of material noncompliance detailed on page 27 of the audit report.

We recommend that CGS Administrators, LLC discontinue its practices that limit the reopening of prior years' cap calculations and start reopening all prior years' cap calculations.

We recommend that CGS Administrators, LLC revise its policies and procedures so that it meets the reopening deadlines established in Federal requirements.

We recommend that CGS Administrators, LLC conduct the prior years' hospice cap calculations for the five hospices with UPIC recoupments and collect any additional overpayments.

We recommend that OPM centralize its audit resolution process into one program structure, instead of the current audit resolution structure that delegates responsibilities to multiple programs within OPM.

We recommend that OPM implement a plan to develop an agency-wide audit tracking system with all of the functionality needed to facilitate resolution workflows and which acts as a repository for all resolution and closure documentation.

We recommend that Federal Employee Insurance Operations work with all appropriate stakeholders to update the MOUs to reflect the Federal Employee Insurance Operations' current resolution process and implement a plan to regularly review and update the MOUs.

We recommend that Internal Oversight Compliance design a system of controls to track recommendations requiring monetary recoveries, including the five recommendations identified in this finding, to ensure that OPM has recovered all monies.

We recommend that Internal Oversight and Compliance immediately track the three recommendations described in our finding and begin the resolution process to resolve and close the recommendations.

We recommend that the audit follow-up official provide the OIG with corrective actions for the 10 open recommendations identified in this finding.

We recommend that Federal Employee Insurance Operations communicate any new or updated MOUs to the appropriate stakeholders.

We recommend that IOC and ARC develop and implement the necessary internal controls to ensure that all recommendations are resolved within a maximum of 6 months after issuance of a final report and that completed final action on each management decision occurs within 12 months after the date of the Inspector General's report.

We recommend that ARC work with IOC to develop work or corrective action plans, which include timeliness milestones, to resolve any outstanding recommendations directed toward OPM program offices reported in carrier audits.

We recommend that ARC work with the Office of the Chief Financial Officer to develop a process to verify that questioned funds identified in final reports and agreed to be returned to the FEHBP are fully returned to the FEHBP.

We recommend the Vice President, Contracts and Rates Strategy, Pricing and Contracts formalize and update the cost of service study internal guidance, and develop a cadence for review and approval.

We recommend the Vice President, Contracts and Rates Strategy, Pricing and Contracts evaluate the inclusion of Valley Investment Initiative and Performance Grant credits, as well as any other local power company or customer specific costs going forward, as part of the cost of service study.

The Chief, FMSS, should ***************************************************************************************************************************************************************************.

The Chief, FMSS, ****** ***** *** *** ************** ** ********* * **** ** *** *********** *********** ***** ****** **** **** ** **** *** ******* **** *** ************** ** **********

The Chief, FMSS, ****** ****** **** *** ** ********* ** ******* ******** ** *** *** ******** ******** *** ***** ** ******** **** **********

Complete efforts to document and implement an enterprise-wide risk management strategy that incorporates the review and approval processes set forth in agency policy.

[REDACTED]

[REDACTED]

[REDACTED]

Develop and implement a mechanism to enforce recurring privileged user training for applicable personnel.

Update its business impact analysis template to ensure that the SEC assesses all systems using a correct and comprehensive set of mission-essential functions.

Incorporate assessments of system recovery time objectives into future disaster recovery exercises.

We recommend that the Puerto Rico Health Department (the Health Department) update its policies and procedures to conform to Federal procurement standards—including policies and procedures related to contracts for leases, goods, and nonprofessional services—and to address the role of the Oversight Lead and the certification process.

We recommend that the Puerto Rico Department of Health (the Health Department) provide training to staff on policies and procedures.

OCIO to develop and implement a plan to remediate all identified critical, high, and medium vulnerabilities identified on OCIO devices providing services to Federal Highway information technology infrastructure within organization defined time periods required by DOT's Security Weakness Management Guide.

OCIO to work with DOT's Operating Administrations and components to ensure least privilege and boundary protection controls are in place to restrict the logical access to only users authenticated to the IT systems and services for which they are authorized.

OCIO to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including IT shared services/common operating environment network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

OCIO to establish a cybersecurity process to comply with NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment and the Department Cybersecurity Incident Response Plan requirements to effectively communicate and coordinate with OIG any planned significant changes that could impact an OIG security assessment and penetration testing audit before the audit begins and when taking action to implement said changes, to ensure coordination as per the Rules of Engagement requirements and to prevent interruption of OIG penetration testing activities.

OCIO to establish a cybersecurity process to enforce the Department Cybersecurity Incident Response Plan requirements for departmental officials impacted by an incident to review audit logs and follow containment procedures to adequately support after-the-fact investigations of potential security incidents.

OCIO to enforce DOT policy for audit log retention for the proper timeframe of 12 months.

FHWA to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including FHWA network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

FHWA to conduct incident response exercises with appropriate personnel that test the retrieval of security audit logs in the event of an incident.

Examine existing Job Corps data regarding its drug control activities to identify appropriate data that aligns with the President's Strategy and the Office of National Drug Control Policy's reporting timelines and identify or develop appropriate and relevant performance measures that demonstrate the effectiveness of its drug control activities as they relate to the President's Strategy.

Coordinate with the Office of the Assistant Secretary for Administration and Management and the Office of National Drug Control Policy to establish reporting timelines for any performance measures that cannot be submitted before the Office of National Drug Control Policy's reporting deadline.

Establish targets for all performance measures reported by Job Corps in the National Drug Control Assessment.

We recommend the Assistant Secretary for Employment and Training capture lessons learned from the pandemic and use the information to develop performance standards for prompt payment of UI benefits under temporary UI programs.

We recommend the Assistant Secretary for Employment and Training establish policy that requires officials to issue guidance timely for ETA regional offices to monitor and measure the effectiveness of states' use of staffing to support the implementation of temporary UI programs.