Open Recommendations

We recommended the CIO: Enhance the validation process for the quarterly Chief Information Officer FISMA Metrics to ensure all metrics are reported accurately and are in accordance with applicable guidance and standards.

We recommended the CIO: Develop, implement, and track privacy-focused, role-based training for employees and contractors with significant privacy responsibilities.

Meet load and unload scan goals consistently at the Boston Processing and Distribution Center.

In order for senior leadership to be able to consider and decide matters potentially raising constitutional separation of powers issues, we recommend that the Department evaluate when advance notification to a senior Department official, such as the Deputy Attorney General or Attorney General, should be required before compulsory process is issued, and any corresponding NDOs are sought, for records of a Member of Congress or congressional staffers and establish, as necessary, implementing policies and guidance.

We recommend that the Department consider whether there are circumstances in which an exhaustion requirement should be a prerequisite for issuing compulsory process to obtain records of Members of Congress and congressional staffers.

Establish and implement an agency-wide resource committee to monitor and report on corporate resource needs, including existing recruiting strategies, staffing levels, and information technology resources in order to strengthen resource planning and response capabilities for large regional bank resolutions.

Establish a practice of regular interdivisional participation in the development and review of the Regional Resolution Framework procedural documents, as appropriate.

Develop and implement a resolution readiness training program for key personnel responsible for executing the Regional Resolution Framework and related procedures. The training program should address awareness, plan-specific, role-based, and functional training.

Establish and implement a process of periodic interdivisional exercises of large regional bank resolution activities, to test the ongoing effectiveness of agency-wide response and coordination.

Identify from after action review documents the recommendations that are the most critical for large
regional bank resolutions and prioritize them with formal tracking and monitoring.

Establish a plan for ensuring that CISR regularly conducts internal reviews of its large regional bank resolution planning activities, as appropriate based on risk.

Mint management should reinforce and monitor the policy related to access removal tickets for separated Mint employees to effectively remove/disable access within five business days of separation.

Mint management should ensure a thorough review of the obligations classified as "de-obligate" is performed to verify that the obligation is de-obligated timely.

We recommend that BIE develop and implement a plan to monitor identified deficiencies at Tate Topa Tribal School for resolution and correction in accordance with abatement plan timelines.

We recommend that BIE during each health and safety inspection, ensure the inspector verifies that deficiencies identified in the prior year's inspection were corrected or documents them as repeat deficiencies.

We recommend that BIE develop a plan focused on hiring additional maintenance and grounds staff at Tate Topa Tribal School.

We recommend that BIE provide all Tate Topa Tribal School facilities maintenance staff the necessary computer hardware, software, and training to access the facility management system.

We recommend that BIE review and analyze all Tate Topa Tribal School work orders in the Facility Management System and update work order status as needed to ensure accuracy.

We recommend that BIE develop an updated and accurate map of the Tate Topa Tribal School campus.

We recommend that BIE develop and deliver training to emphasize the importance of accurate and complete recordkeeping in the facility management system.

Update SALA’s Accounting Manual to include a specific, compliant method for charging support staff salaries directly to sponsored funding sources as well as policies and procedures to account for hours worked in excess of the SALA 35 hours per week requirement.

Once the Accounting Manual is updated, provide training to its accounting staff.

Update the SALA Accounting Manual with detailed second-party review procedures to ensure that unallowable expenses are not charged to the LSC grants.

Once the Accounting Manual is updated with detailed procedures, train applicable SALA staff on the timecard and second-party review procedures.

Develop detailed review procedures and/or checklists to be used in oversight reviews of records created to support accounting entries and/or compliance assessments.

FHFA should ensure proper staffing and train staff on existing consumer communications requirements as to: (a) timeliness of responses to consumers; and (b) completeness, accuracy, and timeliness in processing documentation.

FHFA should update existing consumer communications procedures as needed to include new controls, or improve existing controls, to ensure: (a) the timeliness of FHFA’s responses to consumers; and (b) the completeness, accuracy, and timeliness of the Agency’s processing of documentation.

FHFA should train staff on the updated consumer communications procedures as needed.

(U) Rec. 1: The DoD OIG recommended that the Under Secretary of Defense for Policy, in coordination with the Director of the Defense Security Cooperation Agency, work with the Director of the Department of State Bureau of Political?Military Affairs Office of Regional Security and Arms Transfers to develop and implement a policy stating that a single entity is responsible for notifying both the divesting and receiving security cooperation organizations of all approved, government?to?government third?party transfers of enhanced end?use monitoring"designated defense articles to a hostile environment. Additionally, the policy should require the divesting security cooperation organizations to notify the receiving security…

Fiscal Service finalize policies and procedures to review audit logs of production IBM Database 2 (DB2) servers.

Fiscal Service implement an oversight process to ensure that designated Fiscal Service management: (1) reviews the security logs for the UNIX and DB2 servers hosting the PIR, JFICS, and SPS applications on a pre-defined frequency, as indicated in the BLSR; (2) formally documents completion of their reviews and any escalations to the Information System Security Officer (ISS); and (3) retains the audit logs and documentation of its reviews for 18 months, as required by the BLSR.

Fiscal Service periodically review Fiscal Service management's implementation and operation of the review the security audit logs for the UNIX and DB2 servers hosting the PIR, JFICS, and SPS applications to determine that Fiscal Service management completes the reviews on a pre-defined basis, documents completion of the reviews and escalations, and maintains such documentation.

Fiscal Service establish an effective enforcement process or mechanism to ensure that (1) UNIX and DB2 events and monitoring controls are followed, and (2) Fiscal Service management has confidence it consistently reviews for potential unauthorized or inappropriate activity.

Fiscal Service develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.

Fiscal Service update existing UNIX and database configuration security baseline documents to ensure that these documents fully incorporate and enforce the components of the DISA STIGs. Management should document any deviations from the STIGs and note compensating controls that mitigate the security risk to an acceptable level.

Fiscal Service develop, document, and implement policies, procedures, and controls to conduct periodic reviews of actual UNIX and database settings against the security configuration baselines.

Fiscal Service provide logging and monitoring of security related events to include the retention of evidence of reviews performed.

Fiscal Service develop a baseline of essential security settings and specify that baseline as the standard to be observed.

Fiscal Service implement corrective actions to address all vulnerabilities associated with the baseline enforcement to include removing the three default user accounts on UNIX servers.

Fiscal Service perform a review of the current system environment against the CMDB.

Fiscal Service perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the CMDB.

Fiscal Service update policy and procedures related to the above recommendations and disseminate the documentation to enforce such policy and procedures.

We recommend the Assistant Secretary for Employment and Training to evaluate its authority to share data and develop fraud prevention resources and controls with other federal entities, including SBA, that include data sharing mechanisms to detect and mitigate fraud.

Ensure West Virginia JCS develops policies and procedures to ensure compliance with victim assistance priority areas funding requirements.

Require West Virginia JCS to: (1) reconcile and correct its SARs and its subaward list for the audited grants to ensure OVC has accurate information for those previously awarded VOCA subawards, and (2) implement procedures to ensure that West Virginia JCS' subaward list and SARs are accurate and submitted timely as well as periodically reviewed to make necessary updates.

Remedy $24,464 in unallowable questioned costs related to excess administrative expenditures beyond the 5-percent allowance charged to the 2018 award.

Require West Virginia JCS to develop and implement written policies and procedures to ensure compliance with the 5-percent administrative expenditure limit.

Remedy $16,168 in unsupported questioned costs related to non-personnel administrative costs.

Require West Virginia JCS to enhance its written drawdown policies and procedures to include: (1) an adequate system of internal controls over the disbursement of VOCA funds to ensure funds are only provided to subrecipients for allowable costs that were incurred, and (2) supervisory review (or another control) of the reconciliation process used to calculate drawdown amounts to ensure West Virginia JCS does not request funds in excess of its needs.

Remedy $196,776 in unallowable questioned costs related to excess drawdowns for the 2018 award.