Open Recommendations

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD's Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.

That the FBI assess the processes and procedures it uses to prepare for events that it determines present potential domestic security issues-but have not been designated as NSSE or SEAR events by DHS-to ensure that its processes and procedures set forth with clarity the division of responsibilities between and within the relevant FBI field office and FBI headquarters; clearly define a mechanism for making a formal determination whether and what kind of a nationwide intelligence and CHS canvass is necessary and appropriate under FBI policies; and provide sufficient guidance to ensure that relevant intelligence can be timely shared among the…

Rec. A.1.a: The DoD OIG recommended that Deputy Assistant Secretary of the Navy for Civilian Personnel ensure the Office of Civilian Human Resources reviews the circumstances for the 120 entry level engineers we identified who received an accelerated promotion before the Office of Personnel Managements approval of the Accelerated Promotion Program on December 22, 2016, and determines the appropriate actions to take regarding those circumstances.

BEP management should update LAN WAN password configuration settings to comply with policy requirements or formally document a risk acceptance with mitigating controls.

Department of the Treasury (Treasury) Office of Inspector General (OIG) follow-up with Fresno's management to confirm the transactions noted as unsupported expenditures within the Contracts greater than or equal to $50,000 and Aggregate Payments to Individuals payment types are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Based on Fresno's responsiveness to Treasury OIG's requests and management's ability to provide sufficient documentation, Castro recommends Treasury OIG determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 and Aggregate Payments to Individuals payment…

Treasury Office of Capital Access follow-up on any CRF specific questioned costs reported in the fiscal year 2020 and 2021 Single Audit Act reports.

Castro also recommends that Treasury's Office of Capital Access to ensure that management decision letters are issued on the CRF specific findings identified by the auditor in the Single Audit Act reports noted in the finding.

Treasury OIG follow-up with Mississippi's management to confirm if the $1,324,066 noted as unsupported expenditures within the Direct Payments greater than or equal to $50,000 and Aggregate Payments to Individuals payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request Mississippi management to provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on Mississippi's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Castro recommends Treasury OIG determine the…

For the Fiscal Year 2021 Single Audit report, Treasury Office of Inspector General should follow-up with Treasury's Office of Capital Access to ensure that management decision letters are issued on the findings identified by the auditor in the Single Audit report and should follow-up on any CRF related questioned costs.

Treasury's Office of Capital Access follow-up on the CRF-specific questioned costs reported in the fiscal year 2021 report.

Treasury OIG follow-up with Mississippi to determine the feasibility of conducting a limited scope review of its unemployment expenditures.

Castro recommends Office of Inspector General (OIG) follow-up with Arizona's management to confirm if the $135,747,413 noted as unsupported expenditures within the Transfers greater than equal to $50,000 and Aggregate Payments to Individuals payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request Arizona's management to provide support for replacement expenses, not previous charges, that were eligible during the CRF period to performance. In addition, Castro recommended that Treasury OIG request the Arizona management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance for…

Treasury's Office of Capital Access ensure that management decision letters are issued on the findings identified by the auditor in the fiscal years 2020 and 2021 Single Audit reports.

Treasury's Office of Capital Access should follow up with Arizona to obtain a copy of its fiscal year 2023 Single Audit Act report.

Treasury OIG request that Arizona's management completes a reconciliation of its Transfers greater than or equal to $50,000. Additionally, Castro recommends Treasury OIG determine the feasibility of performing additional testing over Transfers greater than or equal to $50,000.

Treasury OIG request Arizona's management perform and assessment over whether there were any additional indirect costs, above those identified by Castro, claimed withing its Grants greater than or equal to $50,000 CRF submission, and identify those for removal and repayment to Treasury, as applicable.

Treasury OIG request that Arizona's management performs and assessment of whether it had any additional annual leave payouts that were earned prior to the covered period and claimed as CRF expenses, above those identified by Castro, and identify those for reversal and repayment to Treasury.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommended the CIO: Develop and implement an unambiguous standard operating procedure, utilizing Federal Risk and Authorization Management Program guidance and leading practices, to monitor cloud service providers and escalate non-compliance effectively to the agency Authorizing Official, including defined risk management deficiency triggers.

We recommended the CIO: Complete in progress efforts to modernize impacted systems and subsequently enable multi-factor authentication.

We recommended the CIO: Enhance the validation process for the quarterly Chief Information Officer FISMA Metrics to ensure all metrics are reported accurately and are in accordance with applicable guidance and standards.

We recommended the CIO: Develop, implement, and track privacy-focused, role-based training for employees and contractors with significant privacy responsibilities.

In order for senior leadership to be able to consider and decide matters potentially raising constitutional separation of powers issues, we recommend that the Department evaluate when advance notification to a senior Department official, such as the Deputy Attorney General or Attorney General, should be required before compulsory process is issued, and any corresponding NDOs are sought, for records of a Member of Congress or congressional staffers and establish, as necessary, implementing policies and guidance.

We recommend that the Department consider whether there are circumstances in which an exhaustion requirement should be a prerequisite for issuing compulsory process to obtain records of Members of Congress and congressional staffers.

Establish and implement an agency-wide resource committee to monitor and report on corporate resource needs, including existing recruiting strategies, staffing levels, and information technology resources in order to strengthen resource planning and response capabilities for large regional bank resolutions.

Establish a practice of regular interdivisional participation in the development and review of the Regional Resolution Framework procedural documents, as appropriate.

Develop and implement a resolution readiness training program for key personnel responsible for executing the Regional Resolution Framework and related procedures. The training program should address awareness, plan-specific, role-based, and functional training.

Establish and implement a process of periodic interdivisional exercises of large regional bank resolution activities, to test the ongoing effectiveness of agency-wide response and coordination.

Identify from after action review documents the recommendations that are the most critical for large
regional bank resolutions and prioritize them with formal tracking and monitoring.

Mint management should reinforce and monitor the policy related to access removal tickets for separated Mint employees to effectively remove/disable access within five business days of separation.

Mint management should ensure a thorough review of the obligations classified as "de-obligate" is performed to verify that the obligation is de-obligated timely.

We recommend that BIE develop and implement a plan to monitor identified deficiencies at Tate Topa Tribal School for resolution and correction in accordance with abatement plan timelines.

We recommend that BIE during each health and safety inspection, ensure the inspector verifies that deficiencies identified in the prior year's inspection were corrected or documents them as repeat deficiencies.

We recommend that BIE develop a plan focused on hiring additional maintenance and grounds staff at Tate Topa Tribal School.

We recommend that BIE provide all Tate Topa Tribal School facilities maintenance staff the necessary computer hardware, software, and training to access the facility management system.

We recommend that BIE review and analyze all Tate Topa Tribal School work orders in the Facility Management System and update work order status as needed to ensure accuracy.

We recommend that BIE develop an updated and accurate map of the Tate Topa Tribal School campus.