Open Recommendations

Treasury OIG follow-up with Utah and request Utah to perform an analysis over all of their GrantSolutions portal reported balances to determine if there were other instances of subscription costs included in the CRF reported expenditures and review those expenditures to determine if there were other instances of subscription costs that extended past September 30, 2022.

Treasury OIG determine the feasibility of performing additional follow-up with Utah to determine if there were other instances of unsupported costs within the other two awards issued under the Thrive 125 program.

Treasury OIG determine the feasibility of performing additional follow-up with Utah to determine if there were other instances of unsupported grants within the amount of $1,790,107 not tested by Castro.

Treasury OIG determine the feasibility of performing additional follow-up to determine if there were other instances of unsupported costs and ineligible bonuses within the remainder of the amount categorized as non-substantially dedicated payroll.

Treasury OIG should follow-up with North Dakota's management to confirm the transactions noted as unsupported or ineligible expenditures within the Contracts greater than or equal to $50,000, Direct Payments greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to Individuals payment types are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Based on North Dakota management's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than…

Treasury's Office of Capital Access should ensure that management decision letters are issued on the findings identified by the auditor in the Single Audit Report for fiscal years 2021/2022 (combined report). Treasury's Office of Capital Access should follow-up on any CRF specific questioned costs reported in the fiscal year 2021-2022 Single Audit report.

We recommend that BLM develop and implement procedures to update its bankruptcy tracking tool to include claim amounts for each case and entity and other key bankruptcy information such as case status, mitigation steps taken, post-bankruptcy amounts, and outcomes of bankruptcy cases, including identifying wells orphaned due to a bankruptcy.

We recommend that BLM update, finalize, and implement bankruptcy policies and standard operating procedures to include all bankruptcy requirements for proofs of claims.

We recommend that BLM develop and implement a training program for all personnel involved in bankruptcy processes on the bankruptcy policies and standard operating procedures developed under Recommendation 9.

We recommend that BOEM identify existing or develop and implement new internal controls to address identified risks related to Federal oil and gas leaseholder bankruptcies.

We recommend that the Centers for Medicare & Medicaid Services require the States to correct the reported Federal share of collections that were subject to the increased COVID-19 FMAP by recouping $62,504,429 from the 11 States that underreported the Federal share of Medicaid collections and refunding $711,715 to 1 State that overreported the Federal share of Medicaid

We recommend that the Centers for Medicare & Medicaid Services emphasize to States that they should consistently follow their procedures for calculating the Federal share of collections, including during periods of increased FMAPs.

We recommend that the Centers for Medicare & Medicaid Services reinforce with reviewers that they should verify that the increased Federal share for TPL collections was properly supported.

We recommend that the Centers for Medicare & Medicaid Services revise its policies and procedures for reviewing States' reported collections to include review of States' calculations of the Federal share for all collections.

We recommend that the Indiana Family and Social Services Administration refund $39,432,556 (Federal share) to the Federal Government for FFS Medicaid ABA payments that did not comply with Federal and State requirements.

We recommend that the Indiana Family and Social Services Administration provide additional guidance to ABA facilities for documenting ABA, including services that must be provided to support the use of CPT codes 97155 and 97156, State signature requirements, the detail in session notes needed to support ABA provided, and what the State agency considers billable ABA time.

We recommend that the Indiana Family and Social Services Administration periodically perform a statewide postpayment review of Medicaid ABA payments, including reviewing medical records, to educate providers on requirements and to recover payments that did not comply with Federal and State requirements.

We recommend that the Indiana Family and Social Services Administration periodically review its prior authorization contractor's procedures for verifying ABA facilities' compliance with requirements for State diagnostic evaluations and treatment referrals for ABA.

We recommend that the Indiana Family and Social Services Administration exercise reasonable diligence to review and determine whether any of the estimated $53,236,026 (Federal share) in potentially improper ABA payments complied with Federal and State requirements and refund the Federal share of any improper payment amount to the Federal Government.

We recommend the chief operating officer of Federal Student Aid identify compliance audit reporting requirements contained in auditing standards, Department regulations, and OIG audit guidance and determine those reporting requirements necessary for program oversight.

We recommend the chief operating officer of Federal Student Aid ensure that the contractor’s compliance audit acceptability review process includes those reporting requirements that FSA determines are necessary for program oversight.

We recommend the chief operating officer of Federal Student Aid reassess the sampling methodology for the quality control review process for non-flagged and non-deficient audits to ensure the process remains relevant and effective in assessing the acceptability of such audits.

We recommend the chief operating officer of Federal Student Aid update and implement processes for reviewing audit reporting requirements for non-flagged and non-deficient audits to ensure that annual proprietary institution audits meet audit reporting requirements specified in the auditing standards, Department regulations, and OIG audit guidance and which are necessary for program oversight.

We recommend the chief operating officer of Federal Student Aid develop and implement processes at FSA for reviewing audit reporting requirements for flagged and deficient audits to ensure that proprietary institution audits meet audit reporting requirements specified in the auditing standards, Department regulations, and OIG audit guidance and which are necessary for program oversight.

Revise HUD's Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD's Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Review whether potential violations of the Antideficiency Act took place because of implementing or enforcing any nondisclosure policies, forms, or agreements that do not include the anti-gag provision as required by law. If it is determined that a violation occurred, the Chief Financial Officer should take disciplinary actions as appropriate and report the identified violations to the oversight authorities, including the HUD Secretary, the President, the Office of Management and Budget, Congress, and the Comptroller General.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce existing information security continuous monitoring (ISCM) requirements for detecting, preventing, and reporting the installation of unauthorized software across OpDivs referenced in HHS Policy for Information Security and Privacy Protection (IS2P) and enforce the new ISCM policy once approved.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce HHS's continuous monitoring policy for detecting, preventing, and reporting unauthorized or suspicious network activity across OpDivs.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer update the HHS IS2P to require OpDivs to implement NIST 800-53, Revision 5, CA-8 (2) Red Team Exercises at least every 2 years and RA-10 Threat Hunting yearly for high and moderate Federal Information Processing Standards Publication 199 impact systems.

Prioritize filling key senior management vacancies as soon as practical. In addition, prioritize filling key program team vacancies, as appropriate, including those requested for FY 2025.

Update the program’s risk register to include contingency plans for high impact risks.

Establish and implement a method to track the amount of CALR S&E funds expended separately from other IIJA NFS S&E funds.

The CDO should coordinate with HUD's Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD's Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.

That the FBI assess the processes and procedures it uses to prepare for events that it determines present potential domestic security issues-but have not been designated as NSSE or SEAR events by DHS-to ensure that its processes and procedures set forth with clarity the division of responsibilities between and within the relevant FBI field office and FBI headquarters; clearly define a mechanism for making a formal determination whether and what kind of a nationwide intelligence and CHS canvass is necessary and appropriate under FBI policies; and provide sufficient guidance to ensure that relevant intelligence can be timely shared among the…

BEP management should update LAN WAN password configuration settings to comply with policy requirements or formally document a risk acceptance with mitigating controls.

Treasury Office of Capital Access follow-up on any CRF specific questioned costs reported in the fiscal year 2020 and 2021 Single Audit Act reports.

Castro also recommends that Treasury's Office of Capital Access to ensure that management decision letters are issued on the CRF specific findings identified by the auditor in the Single Audit Act reports noted in the finding.

For the Fiscal Year 2021 Single Audit report, Treasury Office of Inspector General should follow-up with Treasury's Office of Capital Access to ensure that management decision letters are issued on the findings identified by the auditor in the Single Audit report and should follow-up on any CRF related questioned costs.

Treasury's Office of Capital Access follow-up on the CRF-specific questioned costs reported in the fiscal year 2021 report.

Castro recommends Office of Inspector General (OIG) follow-up with Arizona's management to confirm if the $135,747,413 noted as unsupported expenditures within the Transfers greater than equal to $50,000 and Aggregate Payments to Individuals payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request Arizona's management to provide support for replacement expenses, not previous charges, that were eligible during the CRF period to performance. In addition, Castro recommended that Treasury OIG request the Arizona management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance for…

Treasury's Office of Capital Access ensure that management decision letters are issued on the findings identified by the auditor in the fiscal years 2020 and 2021 Single Audit reports.

Treasury's Office of Capital Access should follow up with Arizona to obtain a copy of its fiscal year 2023 Single Audit Act report.

Treasury OIG request that Arizona's management completes a reconciliation of its Transfers greater than or equal to $50,000. Additionally, Castro recommends Treasury OIG determine the feasibility of performing additional testing over Transfers greater than or equal to $50,000.

Treasury OIG request Arizona's management perform and assessment over whether there were any additional indirect costs, above those identified by Castro, claimed withing its Grants greater than or equal to $50,000 CRF submission, and identify those for removal and repayment to Treasury, as applicable.

Treasury OIG request that Arizona's management performs and assessment of whether it had any additional annual leave payouts that were earned prior to the covered period and claimed as CRF expenses, above those identified by Castro, and identify those for reversal and repayment to Treasury.