Open Recommendations

The assistant secretary for information and technology and chief information officer improve vulnerability management processes to ensure all vulnerabilities are identified and that plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

We recommend that the Washington State Department of Social and Health Services' Aging and Long-Term Support Administration work with the 20 adult family homes to correct the 214 instances of noncompliance identified in this report.

Treasury Office of Inspector General (OIG) should request West Virginia management to provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance for the $20,917,332 of ineligible costs charged to the Direct Payments greater than or equal to $50,000 payment type. If support is not provided, Treasury OIG should recoup the funds. Based on West Virginia's responsiveness to Treasury OIG's requests and West Virginia's ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Castro recommends Treasury OIG determine the feasibility of conducting an audit for the Direct…

Treasury Office of Inspector General should follow-up with West Virginia's management to confirm if the transactions noted as unsupported expenditures of $657,742 within Aggregate Payments to Individuals can be supported. If support is not provided, Treasury OIG should recoup the funds or request West Virginia management to provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Based on West Virginia's responsiveness to Treasury OIG's requests and West Virginia's ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an…

GLS should amend its procedures relating to the annual count and valuation of operating materials and supplies to include verification of unit and total costs. This should include locating or reconstructing source documentation for the total quantity on hand for each item and matching the costs entered in the system to the source documents.

GLS should determine how average costs are calculated within the inventory tracking system. If the average cost in the system for specific inventory items does not represent the average cost of inventory on hand, the average cost in the system should be periodically adjusted when the annual inventory is performed or at year-end.

GLS should continue executing its corrective action plan and complete the review of the unit and total costs of inventory items.

Proactively and independently initiate discussions with Legal Counsel on an at least quarterly basis in order to identify contingent liabilities which should be recognized and/or disclosed in the Corporation's financial statements and footnotes so that appropriate entries can be recorded, and/or notes disclosures prepared, prior to the finalization of the financial statements and footnotes.

Document the actions taken to verify that the information received is complete and whether information is needed from other sources to complete the financial reporting process.

Update the Corporation's standard operating procedures to incorporate timely inquiries of legal counsel during the preparation of the financial statements and footnotes.

STB management should amend its existing policy regarding the review and approval of journal vouchers to include a review of all non-reversing entries recorded during the fiscal year and to review all year-end journal vouchers before they are recorded in the agency's general ledger.

STB management should perform and document a review of all manual journal entries that includes a before and after analysis which illustrates the effect of the entry on the principal financial statements using the current year Treasury United States Standard General Ledger (USSGL) Section V Crosswalks to the financial statements. If accounts are presumed to offset, then they must offset within the same line of the same financial statement within the same fiscal year reporting period (i.e., before closing entries are recorded following the end of the fiscal year).

At least quarterly, STB management should initiate and document a review of all entries and account balances for which a manual correcting entry may be needed to address potential misstatements due to system posting logic, such as offsetting upward and downward adjustments of prior year obligations, and record the appropriate entries to prevent misstatement of financial statement accounts and line items.

During the review of manual journal vouchers, STB management should verify and document that the authoritative guidance and internal tools used to support the entry are valid and current.

The STB Finance Team should complete training relating to adjusting entries, including the selection of USSGL accounts, to improve the quality and precision of the review and approval process.

STB management should independently review the most current version of OMB Circular A-136 and the USSGL Treasury Crosswalks to identify changes in data elements, classification, and presentation and ensure that these changes are incorporated into financial statement and footnote templates for current year reporting. A search for new versions of the USSGL Crosswalks and OMB Circular A-136 should be performed each time the financial statements are prepared.

STB management should review the current version of OMB Circular A-136 to independently verify that all required footnotes are included and bring any omissions to the service provider's attention so that errors or omissions can be corrected.

STB management should review the service provider's Financial Statement and Notes Review Checklist to verify that the checklist is up to date and includes all required elements per OMB and Treasury guidance and then complete the checklist independently. Alternatively, STB management should develop and complete its own review checklist based on current Treasury and OMB reporting requirements.

STB management should request its financial management service provider to:
Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or
Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the balance sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

STB management's review and certification of the financial statements and footnotes should be clearly documented and indicate what was reviewed, when the review was performed, and who performed the review for each reporting period.

STB financial management should complete training relating to the preparation and/or review of financial statements and footnotes to improve management's understanding of Federal reporting requirements and to ensure that the financial statements and footnotes are complete, accurate, and appropriately presented.

STB should perform a review of 100 percent of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should develop policies and procedures that include the performance of periodic reviews of employees' OPFs to ensure that they are complete and accurate.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

STB management should implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

Clearly identify and publicly publish MSHA's jurisdiction, including obtaining any needed legal opinion from the U.S. Department of Labor Office of the Solicitor on the U.S. territories and the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, requesting any needed legislative changes.

Revise MSHA's implementation plan for when it will begin inspecting mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands and begin implementing the plan. The revised plan should address: (1) when enforcement of the Mine Act and MSHA regulations will begin; (2) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field office nearby); (3) whether additional training will occur and how (e.g., in-person, virtual, hybrid, via grants, et cetera); and (4) how funding will be obtained to conduct required MSHA activities in FY 2025

Develop and implement a plan to enforce the Mine Act in the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, having first obtained legal authority verifying they are still under MSHA's jurisdiction. If the legal authority opines MSHA has jurisdiction over them, MSHA's plan should address: (1) whether future legislative changes to the Mine Act are needed and requests to Congress; (2) when enforcement of the Mine Act and MSHA regulations will begin; (3) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field…

Verify mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands have properly submitted their Part 50 data to MSHA.

Update the status history for all mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands, including to reflect the periods for which they were operational. This should include adjustments needed after verifying the mines properly submitted their Part 50 data.

Update the mine status criteria to address the types of support (e.g., mine visit observation, closure notice submitted by operator, MSHA analysis of Part 50 data, et cetera) needed to put a mine in "abandoned" status and require support be documented in the related mine file.

Develop guidance for what to do with mines that have been issued a mine identification number and remained in "new mine" status for long periods of time because they never started operations.

Correct mine statuses for any mines that do not adhere to guidance and criteria updates made in response to this alert memorandum, which includes updating the mine status criteria requirements and developing guidance for mines remaining in "new mine" status for long periods of time.

Develop guidance on when mine identification numbers can be deactivated and reactivate any mine identification numbers in MSHA's system that do not adhere to that guidance.

Develop and implement a culture transformation plan to ensure the integrity and ethical values expected are enforced throughout MSHA.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Enforce existing policies to ensure that all users are included within quarterly user access reviews.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Enforce independent review of personnel’s system access and redesign existing policies and procedures in order to perform the review of all personnel’s access each fiscal year.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by establishing formal written estate recovery policies and procedures, to include policies and procedures regarding documentation to support its performance of estate recovery procedures for deceased Medicaid enrollees.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by implementing formal procedures to periodically review open cases and establish a timeframe for doing so.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by verifying that system edits are functioning properly and improving those system edits as necessary, and by verifying that caseworkers perform and document all applicable estate recovery procedures (including determining the amount of Medicaid paid claims, determining whether the enrollee had a surviving spouse or child(ren), and performing asset research) for deceased Medicaid enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Improve system edit processes to help reduce improper payments for outpatient services provided by acute-care hospitals to hospice enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to understand that each hospice enrollee's hospice election statement addendum is available on request, and educate hospices to provide the addendum if requested to help an acute-care hospital assess whether…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Continue to educate hospices that they should be providing to enrollees virtually all necessary services that palliate or manage terminal illnesses and related conditions either directly or through arrangements.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to analyze not only whether outpatient services palliated or managed enrollees' terminal illnesses but also whether outpatient services palliated or managed a condition related to a terminal illness.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Clarify the language in the Manual (chapter 11, section 50), and in other CMS or MAC guidance documents or educational initiatives, if necessary, to specifically mention "related conditions" so that the language is…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Direct MACs or other appropriate contractors, such as Recovery Audit Contractors, to: (1) analyze Medicare claims data to identify acute-care hospitals that have aberrant billing patterns for condition code 07, and conduct Targeted…