Open Recommendations

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommended the CIO: Develop and implement an unambiguous standard operating procedure, utilizing Federal Risk and Authorization Management Program guidance and leading practices, to monitor cloud service providers and escalate non-compliance effectively to the agency Authorizing Official, including defined risk management deficiency triggers.

We recommended the CIO: Complete in progress efforts to modernize impacted systems and subsequently enable multi-factor authentication.

We recommended the CIO: Enhance the validation process for the quarterly Chief Information Officer FISMA Metrics to ensure all metrics are reported accurately and are in accordance with applicable guidance and standards.

We recommended the CIO: Develop, implement, and track privacy-focused, role-based training for employees and contractors with significant privacy responsibilities.

In order for senior leadership to be able to consider and decide matters potentially raising constitutional separation of powers issues, we recommend that the Department evaluate when advance notification to a senior Department official, such as the Deputy Attorney General or Attorney General, should be required before compulsory process is issued, and any corresponding NDOs are sought, for records of a Member of Congress or congressional staffers and establish, as necessary, implementing policies and guidance.

We recommend that the Department consider whether there are circumstances in which an exhaustion requirement should be a prerequisite for issuing compulsory process to obtain records of Members of Congress and congressional staffers.

Establish and implement an agency-wide resource committee to monitor and report on corporate resource needs, including existing recruiting strategies, staffing levels, and information technology resources in order to strengthen resource planning and response capabilities for large regional bank resolutions.

Develop and implement a resolution readiness training program for key personnel responsible for executing the Regional Resolution Framework and related procedures. The training program should address awareness, plan-specific, role-based, and functional training.

Establish and implement a process of periodic interdivisional exercises of large regional bank resolution activities, to test the ongoing effectiveness of agency-wide response and coordination.

We recommend that BIE develop and implement a plan to monitor identified deficiencies at Tate Topa Tribal School for resolution and correction in accordance with abatement plan timelines.

We recommend that BIE during each health and safety inspection, ensure the inspector verifies that deficiencies identified in the prior year's inspection were corrected or documents them as repeat deficiencies.

We recommend that BIE develop a plan focused on hiring additional maintenance and grounds staff at Tate Topa Tribal School.

We recommend that BIE provide all Tate Topa Tribal School facilities maintenance staff the necessary computer hardware, software, and training to access the facility management system.

We recommend that BIE review and analyze all Tate Topa Tribal School work orders in the Facility Management System and update work order status as needed to ensure accuracy.

We recommend that BIE develop an updated and accurate map of the Tate Topa Tribal School campus.

We recommend that BIE develop and deliver training to emphasize the importance of accurate and complete recordkeeping in the facility management system.

FHFA should ensure proper staffing and train staff on existing consumer communications requirements as to: (a) timeliness of responses to consumers; and (b) completeness, accuracy, and timeliness in processing documentation.

FHFA should update existing consumer communications procedures as needed to include new controls, or improve existing controls, to ensure: (a) the timeliness of FHFA’s responses to consumers; and (b) the completeness, accuracy, and timeliness of the Agency’s processing of documentation.

FHFA should train staff on the updated consumer communications procedures as needed.

Fiscal Service perform a review of the current system environment against the CMDB.

Fiscal Service perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the CMDB.

Fiscal Service update policy and procedures related to the above recommendations and disseminate the documentation to enforce such policy and procedures.

We recommend the Assistant Secretary for Employment and Training to evaluate its authority to share data and develop fraud prevention resources and controls with other federal entities, including SBA, that include data sharing mechanisms to detect and mitigate fraud.

Ensure West Virginia JCS develops policies and procedures to ensure compliance with victim assistance priority areas funding requirements.

Require West Virginia JCS to: (1) reconcile and correct its SARs and its subaward list for the audited grants to ensure OVC has accurate information for those previously awarded VOCA subawards, and (2) implement procedures to ensure that West Virginia JCS' subaward list and SARs are accurate and submitted timely as well as periodically reviewed to make necessary updates.

Remedy $24,464 in unallowable questioned costs related to excess administrative expenditures beyond the 5-percent allowance charged to the 2018 award.

Require West Virginia JCS to develop and implement written policies and procedures to ensure compliance with the 5-percent administrative expenditure limit.

Remedy $16,168 in unsupported questioned costs related to non-personnel administrative costs.

Require West Virginia JCS to enhance its written drawdown policies and procedures to include: (1) an adequate system of internal controls over the disbursement of VOCA funds to ensure funds are only provided to subrecipients for allowable costs that were incurred, and (2) supervisory review (or another control) of the reconciliation process used to calculate drawdown amounts to ensure West Virginia JCS does not request funds in excess of its needs.

Remedy $196,776 in unallowable questioned costs related to excess drawdowns for the 2018 award.

Require West Virginia JCS to train its financial staff on the DOJ Grants Financial Guide FFR requirements and the instructions within the West Virginia JCS' Accounting Policies and Procedures.

Coordinate with West Virginia JCS to ensure FFRs are accurate and supported by accounting records going forward.

Ensure West Virginia JCS: (1) updates its VOCA Administrative Manual with applicable VOCA Fix and federal award requirements, and (2) periodically reviews and makes necessary updates to the document to ensure compliance with federal statutes, regulations, and the award terms and conditions.

Work with West Virginia JCS to establish a monitoring mechanism that will ensure that it adheres to the frequency of on-site monitoring visits, as required by its policies.

Coordinate with West Virginia JCS to establish procedures, such as staff instructions and control mechanisms, to: (1) maintain a comprehensive schedule of monitoring activities, (2) ensure monitoring actions effectively assess subrecipients' implementation of VOCA-funded programs, (3) develop and provide to subrecipients reports of monitoring activities complete with required signatures in accordance with West Virginia JCS policies, and (4) pursue and close out monitoring report findings and recommendations.

Remedy $198,099 in unsupported subaward expenditures.

Require West Virginia JCS to establish adequate controls to ensure its monitoring staff performs monthly financial reviews in compliance with the West Virginia JCS policies and that it maintains evidence to support all claimed subrecipient expenditures reviewed as part of monitoring activities.

Work with West Virginia JCS to develop and implement written policies and procedures to ensure compliance with the Uniform Guidance requirements for pass-through agency action on subrecipient single audit reports.