Open Recommendations

Update the quality assurance checklist for sprint planning to review low-level tasks for multiple owners if they occur frequently. This does not apply to other product backlog item types, such as user stories.

VHA chief financial officer establish and implement guidance for quality assurance measures over the data used to develop and justify the ambulatory care budget estimate.

The under secretary for health ensure the deputy under secretary for health provides oversight and holds the Office of Finance accountable for developing, documenting, and implementing standard operating procedures to include defining roles and responsibilities and requirements for oversight and quality assurance for development of the ambulatory care budget estimate.

The under secretary for health implement the Veterans Health Administration Data Governance Council, to include developing policies and processes for data management across the Veterans Health Administration.

The under secretary for health ensure Veterans Health Administration Data Governance Council identifies authoritative data sources and nominates data stewards for approval by the VA Data Governance Council.

Recover approximately $3.7 million from the contractor for transportation overcharges.

Develop a training for all sorting and delivery center supervisors specific to the network changes/impacts, including techniques to properly supervise route performance, and require all sorting and delivery center supervisors to complete.

We recommend the Natural Resources Conservation Service, in coordination with the EnterpriseGeospatial Management Office, develop and use an applicable geospatial data standard for the National Cooperative Soil Survey Soil Characterization database dataset.

Verify that Tomorrow Youth Organization corrects the instance of material noncompliance detailed on page 23 of the audit report

Develop policy and procedures for the Offices of Retirement and Disability Policy and Chief Information Officer to coordinate systems changes to prevent the use of obsolete or temporarily prohibited non-payment status codes. If unable to make systems change, SSA should identify and review records placed into suspension or denied using prohibited non-payment status codes to ensure they are corrected timely.

Complete the implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5.

Identify and assign the senior accountable official for risk management.

Include the organizational risk tolerance and make explicit the threats, assumptions, constraints, and trade offs used for making investment and operational decisions in the Risk Management Strategy.

Document and implement procedures for conducting and updating an organization and system-level risk assessment.

Update policies and procedures to require that the senior accountable official for risk management, or other designated official, review and approve the continuous monitoring strategy and retain evidence of the review and approval.

Update Agency policy to comply with Federal regulations for SA&A. Specifically, complete a system-level continuous monitoring strategy.

FHFA should update the disaster recovery procedures document to ensure it includes (a) up to date time periods for the recovery time objective and the recovery point objective for resumption of the general support system operations consistent with the business impact analysis, (b) database procedures, and (c) steps to validate successful failover and failback of the remote access infrastructure system.

FHFA should ensure the After Action Report is consistent with the Recovery Exercise Test Results by documenting all actions taken during the failover and failback of the disaster recovery exercise including all correct dates for when testing was conducted.

FHFA should perform annual testing of the contingency plan in accordance with the recovery procedures document to ensure failover and failback are conducted as planned.

FHFA should ensure Office of Technology and Information Management officials communicate planned disaster recovery exercises and any scheduled changes with all parties involved, including auditors and other independent observers.

FHFA should encrypt all backup data-at-rest at FHFA’s alternate site and update the existing plans of action and milestones to include compensating controls until the plans of action and milestones has been closed.

We recommend that DFC's Chief Information Officer fully implement event logging requirements in accordance with Office of Management and Budget, Memorandum M-21-31.

Enforce existing policies and procedures to consistently perform reviews and analyze system audit records, and document and maintain those reviews and analysis for privileged users and actions taken on [redacted] devices in accordance with FDIC policy.

Update DOT Orders 4410.4 and 4600.2B to incorporate the requirements of Public Law Number (Pub. L. No.) 115-419.

Update DOT Order 2700.13 to direct Operating Administrations to develop and implement a process to validate and reconcile capitalized equipment listings with DOT's Delphi financial system and provide confirmation of completion.

Update DOT Order 2700.13 to clarify when Operating Administrations deviations from established DOT capitalization thresholds must be approved by the Office of the Secretary and implement a requirement for documentation justifying higher or lower thresholds.

Direct the Federal Highway Administration (FHWA), National Highway Traffic Safety Administration (NHTSA), Maritime Administration (MARAD), and Federal Railroad Administration (FRA) to update the relevant orders or guidance to incorporate the requirements of Pub. L. No. 115-419 and require confirmation of completion. These orders and guidance are FHWA Order 4300.1; NHTSA Order 440-1D; MARAD's Property, Plant, and Equipment Desk Guide; and FRA Order 4601.1E.

Direct FRA's Office of the Chief Financial Officer to capitalize FRA's eligible equipment in accordance with DOT Order 2700.13 and provide confirmation of completion.

Direct the Federal Motor Carrier Safety Administration (FMCSA) to implement policies and procedures for the management of capitalized equipment that incorporate the requirements of Pub. L. No. 115-419 and provide confirmation of completion.

Develop and implement standard operating procedures to identify and calculate reliable drug control-related obligations.

Develop and implement a methodology that can be applied to data in NHTSA's financial system to track drug control-related obligations, by budget decision unit and drug control function.

Develop a budget formulation methodology that provides a reasonable basis for consistent estimation of NHTSA's drug control budget that fairly quantifies its financial commitment to drug control activities and provides the methodology to the Office of National Drug Control Policy for approval.

2. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures for NIST personnel to ensure data reliability (reasonably free from error and bias), including but not limited to (1) formal policies requireing staff to diligently review significant impacts for accuracy and connection to services provided by Centers and (2) techniques to analyze survey data for anomalies before it is finalized.

3. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish and implement procedures for Centers and subrecipients to (1) comply with NIST guidelines and (2) ensure data reliability (reasonabley free from error and bias), including but not limited to techniques that hold Centers accountable, such as including consequences for noncompliance and certification of Center executives confirming integrity, independence, and due diligence that the reported economic impacts represent what they are intended to: actual economic benefits realized over the last 12 months that are attributable to the services provided.

4. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures that hold Centers accountable for monitoring subrecipient compliance with NIST survey guidelines and ensuring data reliablility (reasonably free from error and bias), including consequences for noncompliance.

5. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST revise MEP's economic impact reports for FYs 2020 through 2023 to (1) accurately reflect NIST's return on investment and (2) clearly articulate that total federal invistment does not include other federal funding sources that may contribute to reported ecomonic impacts.

6. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures for NIST personnel to ensure future economic impact reports accurately reflect NIST's return on investment.

7. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST direct MEP to immediately remove from NIST reporting guidelines statements that currently direct Centers to write the expection of completing the MEP survey into contracts.

8. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST direct MEP to immediatley direct Centers and their subrecipients to remove contract clauses requiring clients to take the MEP survey.

We recommend that CBP’s Office of Facilities and Asset Management establish and implement a CBP-wide policy to include designated roles and responsibilities for managing and overseeing the facility condition assessment program.

We recommend that CBP’s Office of Facilities and Asset Management establish and implement a CBP-wide process for conducting facility condition assessments that aligns with DHS’ policy; identifying, prioritizing, and resolving deficiencies identified during facility condition assessments; and reporting and monitoring deficiencies.

We recommend that CBP’s Office of Facilities and Asset Management implement a quality control process to ensure facility condition assessment data within TRIRIGA is accurate and complete.

Develop its own internal program to recover unclaimed assets instead of remaining dependent upon Fiscal Service.

We recommend the Senior Vice President, Generation Projects and Fleet Services, work with Power Operations to confirm that all Tennessee Valley Authority specifications (1) are included in solicitation documentation, (2) have been updated, and (3) are applicable to the type of project being bid.

We recommend the Senior Vice President, Generation Projects and Fleet Services and Vice President, Supply Chain, work with Transmission Planning and Power Operations personnel to (1) assess the Cumberland and Kingston procurement for cybersecurity risk and take appropriate actions, if necessary, and (2) establish and/or clarify responsibilities related to Supply Chain cybersecurity compliance with standards for equipment covered in procurements.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity update protocols to promote consistent expectations for timely supervisory, legal, and headquarters reviews of complex cases.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update the MOUs with OGC for each region to identify and remove inefficiencies that can lead to longer FHEO investigation times and OGC review times and identify best practices that can be implemented across all regions.

We recommend that HUD's Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update investigative processes followed by each regional office to identify best practices that can be implemented across all regions and identify and remove inefficiencies that can lead to longer investigation times.

(U) Establish requirements for regularly soliciting input from judges eligible to participate in the HIDS program, evaluating the judges' input, and assessing the feasibility of implementing changes that will increase HIDS program enrollment and help ensure current participants remain enrolled in the program.

(U) Track alarm monitoring participation rates, consider feedback from judges about why they choose not to obtain monitoring services, and make any necessary changes to the HIDS program to maximize the number of judges electing to include alarm monitoring in their HIDS configuration.