Open Recommendations

Mandate standardized training for SharePoint administrators and owners to clarify and reinforce data security requirements.

Take corrective actions to ensure that facilities and programs remove unauthorized sensitive information from collaborative application sites.

Implement automated tools and policies, supported with training, to enable the timely and routine detection and correction of improper sharing and unauthorized content throughout VA.

Expand roles and responsibilities of facility and program information system security officers and privacy officers to include the routine review of SharePoint and Teams site permissions and content.

Restrict users from connecting to SBA systems from international IP addresses as required by SOP 90 47 6.

Implement or enhance current real-time continuous monitoring of mobile phone and personal computer data with rules-based automated response and analysis capabilities as required by OMB M-22-01.

USAID/Indonesia determine the allowability of $42,764 ineligible questioned costs, as detailed on pages 25 to 37 of the audit report and recover any amount that is unallowable.

USAID/Indonesia verify that Yayasan Project HOPE corrects the seven instances of material noncompliance detailed on pages 25 to 37 of the audit report.

3. We recommend that the Under Secretary of Commerce for Intellectual Property and USPTO Director direct the Commissioner for Patents and the Chief Information Officer to revise project management policies and practices to encourage increased engagement, as appropriate, with end users and others affected by the system, such as the public, earlier in the project lifecycle.

We recommend the Senior Vice President, Grid, update configuration management processes to improve periodic reviews.

The Chief, Taxpayer Services, should ensure that TAC managers enforce procedures for providing CSS cards at TACs.

The Chief, Taxpayer Services, should Ensure that TAC managers enforce procedures for wearing name tags at TACs.

The Chief, Taxpayer Services should ensure that TAC managers enforce procedures for treating non-English speaking customers properly at TACs.

Establish a plan of when and how it will implement the remaining deliverables provided under the contract, as well as how SSA will track progress of the implementation to determine whether the analyses, prototypes and recommendations provided in those deliverables improve SSA’s disability programs.

The VA Eastern Kansas Healthcare System Director ensures the chief of primary care reviews, strengthens, and implements system Patient Aligned Care Team processes for tracking and following up on community care consults ordered, particularly diagnostic consults, to verify patients receive care and to review and act upon consult results, as clinically indicated.

The VA Eastern Kansas Healthcare System Director reviews institutional disclosures conducted by the system over the past 12 months, including the patient’s institutional disclosure, and ensures these disclosures fully adhere to Veterans Health Administration Directive 1004.08, Disclosure of Adverse Events to Patients, October 31, 2018, including documenting the details of the adverse event and discussion points of the disclosure, and takes action needed to remediate disclosures that do not meet these standards.

The VA Eastern Kansas Healthcare System Director ensures community care staff make the required three attempts to obtain patients’ community care records within 90 days of completed appointments, and monitors for compliance.

The VA Eastern Kansas Healthcare System Director collaborates with the Kansas City VA Medical Center Director to review the frequency and circumstances of community care records being sent to the incorrect VA facility, develops, and implements a process for ensuring community care records are delivered to the correct ordering VA facility, educates staff on the process, and monitors for compliance.

The Under Secretary for Health establishes and monitors compliance with a process that ensures the Veterans Health Administration ordering provider receives urgent non-life-threatening abnormal test results from care obtained in the community, such as the diagnostic positron emission tomography scan results described in this report, within a time frame that allows timely attention and appropriate action to be taken.

The Veterans Integrated Service Network Director, in conjunction with the Veterans Health Administration National Center for Lung Cancer Screening Program Office, evaluates the VA Eastern Kansas Healthcare System’s Lung Cancer Screening Program to ensure operational adherence to the Lung Cancer Screening Program requirements, and takes action as needed.

The VA Eastern Kansas Healthcare System Director ensures the chief of primary care reviews, strengthens, and implements system Patient Aligned Care Team processes for tracking and following up on community care consults ordered, particularly diagnostic consults, to verify patients receive care and to review and act upon consult results, as clinically indicated.

The VA Eastern Kansas Healthcare System Director reviews institutional disclosures conducted by the system over the past 12 months, including the patients institutional disclosure, and ensures these disclosures fully adhere to Veterans Health Administration Directive 1004.08, Disclosure of Adverse Events to Patients, October 31, 2018, including documenting the details of the adverse event and discussion points of the disclosure, and takes action needed to remediate disclosures that do not meet these standards.

The VA Eastern Kansas Healthcare System Director collaborates with the Kansas City VA Medical Center Director to review the frequency and circumstances of community care records being sent to the incorrect VA facility, develops, and implements a process for ensuring community care records are delivered to the correct ordering VA facility, educates staff on the process, and monitors for compliance.

The Under Secretary for Health establishes and monitors compliance with a process that ensures the Veterans Health Administration ordering provider receives urgent non-life-threatening abnormal test results from care obtained in the community, such as the diagnostic positron emission tomography scan results described in this report, within a time frame that allows timely attention and appropriate action to be taken.

The Veterans Integrated Service Network Director, in conjunction with the Veterans Health Administration National Center for Lung Cancer Screening Program Office, evaluates the VA Eastern Kansas Healthcare Systems Lung Cancer Screening Program to ensure operational adherence to the Lung Cancer Screening Program requirements, and takes action as needed.

The VA Eastern Kansas Healthcare System Director ensures community care staff make the required three attempts to obtain patients community care records within 90 days of completed appointments, and monitors for compliance.

We recommend that CFTC implement a training framework that ensures all travel cardholders complete mandatory training requirements prior to card issuance and that purchase card AOs complete mandatory training requirements prior to performing AO task approvals.

We recommend that CFTC enforce the use of centrally billed accounts for travel cards used for international travel.

We recommend that CFTC develop and implement a comprehensive policy that mandates the immediate deactivation of all purchase and travel cards upon notification by HR of an employee’s separation or transfer. Additionally, instituting a regular monitoring system to track and validate the deactivation status of charge cards for all separated employees is recommended. Monthly reviews of charge card activity reports should also be conducted to identify any lapses in the deactivation process to prevent unauthorized use.

We recommended that CFTC review, revise, and update all travel policies to align with the current requirements of the Federal Travel Regulations, OMB directives, and the Government Charge Card Abuse Prevention Act.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that GiveDirectly, Inc., corrects the material weaknesses in
internal control over financial reporting detailed on pages 32 to 34 of the audit report.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that GiveDirectly, Inc., corrects the instances of material
noncompliances detailed on pages 32 to 34 of the audit report.

We recommend that USAID/Mozambique verify that Centro de Aprendizagem e Capacitao da Sociedade Civil corrects the one material weakness in internal control identified on pages 25 and 28 of the audit report.

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to identify all critical and non-critical software on the DoD Information Network that is subject to Office of Management and Budget-required self-attestation requirements.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to obtain Office of Management and Budget-required self-attestations from software providers or implement an Office of Management and Budget'approved alternative solution for all identified third-party software on the DoD Information Network.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to establish a plan of action and milestones to obtain all remaining Office of Management and Budget-required third-party provider self-attestations and request an extension from the Office of Management and Budget deadline.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to implement a process, such as periodic reviews of the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are accurately reporting the system authorization status for non'national security systems in accordance with DoD guidance.

(U) Rec. 1.e: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to update the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that it captures compliance information for all controls associated with Inspector General Federal Information Security Modernization Act of 2014 reporting metrics for their non-national security systems.

(U) Rec. 1.f: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to develop and implement a process, such as periodic reviews of the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials implemented the necessary National Institute of Standards and Technology information system controls and accurately reported the status for all non-national security systems.

(U) Rec. 1.g: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to require officials to develop a plan of action and milestones for non-national security systems that have not implemented all Inspector General Federal Information Security Modernization Act of 2014 reporting metrics-related controls or those systems with a low implementation percentage (for example, below 75 percent), and track the completion of the plans until such controls are implemented or have elevated to an acceptable level…

(U) Rec. 2: The DoD OIG recommended that the DoD Chief Information Officer direct the Army Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer direct the Navy Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 4: The DoD OIG recommended that the DoD Chief Information Officer direct the Air Force Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 5: The DoD OIG recommended that the DoD Chief Information Officer direct the Coast Guard Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 6: The DoD OIG recommended that the DoD Chief Information Officer direct the Defense Security Cooperation Agency Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

Correct all processing errors on cases identified by the review team and report the results to the Office of Inspector General.

Correct all processing errors on cases identified by the review team and report the results to the Office of Inspector General.

(U) Rec. 1.a: The DoD OIG recommended that the Director of the Navy Culture and Force Resilience Office N17 develop and implement a plan with milestones to ensure all Navy commands have a completed local crisis response plan, as required by Office of the Chief of Naval Operations Instruction 1720.4B, Suicide Prevention Program.

(U) Rec. 1.b: The DoD OIG recommended that the Director of the Navy Culture and Force Resilience Office N17 update Office of the Chief of Naval Operations Instruction 1720.4B, Suicide Prevention Program, to assign an office with oversight and annual reporting responsibilities for Naval commanding officers compliance with having a completed crisis response plan that contains the elements required by the Instruction.

The Director, Submission Processing, should lead a review that includes the Directors of Accounts Management, Field Assistance, Media and Publications, and Online Services to add cautionary language to the appropriate forms and publications instructing taxpayers not to use a third-party carrier when paying a balance due that is addressed to a P.O. Box address (Lockbox).