Open Recommendations

Remedy $196,776 in unallowable questioned costs related to excess drawdowns for the 2018 award.

Require West Virginia JCS to train its financial staff on the DOJ Grants Financial Guide FFR requirements and the instructions within the West Virginia JCS' Accounting Policies and Procedures.

Coordinate with West Virginia JCS to ensure FFRs are accurate and supported by accounting records going forward.

Ensure West Virginia JCS: (1) updates its VOCA Administrative Manual with applicable VOCA Fix and federal award requirements, and (2) periodically reviews and makes necessary updates to the document to ensure compliance with federal statutes, regulations, and the award terms and conditions.

Work with West Virginia JCS to establish a monitoring mechanism that will ensure that it adheres to the frequency of on-site monitoring visits, as required by its policies.

Coordinate with West Virginia JCS to establish procedures, such as staff instructions and control mechanisms, to: (1) maintain a comprehensive schedule of monitoring activities, (2) ensure monitoring actions effectively assess subrecipients' implementation of VOCA-funded programs, (3) develop and provide to subrecipients reports of monitoring activities complete with required signatures in accordance with West Virginia JCS policies, and (4) pursue and close out monitoring report findings and recommendations.

Remedy $198,099 in unsupported subaward expenditures.

Require West Virginia JCS to establish adequate controls to ensure its monitoring staff performs monthly financial reviews in compliance with the West Virginia JCS policies and that it maintains evidence to support all claimed subrecipient expenditures reviewed as part of monitoring activities.

Work with West Virginia JCS to develop and implement written policies and procedures to ensure compliance with the Uniform Guidance requirements for pass-through agency action on subrecipient single audit reports.

Ensure West Virginia JCS updates its policies and procedures to implement a process to collect, verify, and maintain monthly progress reports and their respective support.

Ensure West Virginia JCS updates its policies and procedures to implement a process to collect, verify, maintain, and provide accurate data to the OVC that measures the performance and effectiveness of activities funded by the VOCA awards.

IHS should assess the relative benefits of its current recruitment and retention strategies to guide future staffing plans, as well as exploring new tools to address staffing shortfalls.

IHS should explore options for expanding housing for DSFC staff.

1. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that special hardening measures are implemented for the unique threats faced in the Maui region, as required by the contract.

3. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to reevaluate the RTO metric to ensure that it aligns with the NPSBN’s operational purpose of being available during disasters.

5. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to take the necessary steps to ensure that FirstNet Authority has access to real-time network data and the ability to actively monitor network services and deployed assets.

We recommend that the DOI Secretary or designee establish a risk appetite as required in the Office of Management and Budget Circular No. A-123 and implement a process to ensure Departmentwide awareness of the risk appetite.

We recommend that the DOI Deputy Secretary or designee implement a process to periodically reevaluate and adjust risk appetite and tolerance levels to meet DOI's needs in accordance with the Office of Management and Budget Circular No. A-123.

We recommend that the DOI Deputy Secretary or designee create a comprehensive risk profile as required by the Office of Management and Budget Circular No. A-123 and ensure it is properly approved and incorporated into discussions for decision making.

We recommend that the DOI Deputy Secretary or designee establish a risk management council or an equivalent governance system to direct and oversee the establishment of DOI's risk profiles, regularly assess risk, develop appropriate risk responses, and approve the updated risk profile annually.

We recommend that the DOI Deputy Secretary or designee define the enterprise risk management roles and responsibilities for DOI's leadership at the executive, bureau, and office level and ensure those roles and responsibilities are clearly communicated.

Develop and implement guidance for Clean School Bus Program personnel on reviewing Clean School Bus rebate recipients' use and management of rebate funds.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with appropriate USMMA IT officials to ensure that data collected and used for tracking claims and incidents of sexual assault and sexual harassment is secure in accordance with NDAA requirements.

Direct the Maritime Administration's Privacy Officer to complete a privacy impact analysis to ensure personally identifiable information used by the U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR)'s Program is secure based on Federal requirements and verify completion.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with the USMMA's IT officials to implement the necessary security controls in the following areas: access control, encryption, audit logging, data exfiltration, data integrity, and backup, to mitigate possible cybersecurity risks to the SAPR Program's sensitive information in the interim to the extent possible until a new system is implemented and verify completion.

Treasury OIG should follow-up with Pennsylvania management if the transactions noted as unsupported or ineligible expenditures within the Grants greater than or equal to $50,000, Transfers greater than or equal to $50,000, Direct Payments greater than or equal to $50,000, and Aggregate Reporting less than $50,000 payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Pennsylvania management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on Pennsylvania's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation…

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should update internal guidance and develop more robust training to ensure that employees perform adequate research of tax accounts to identify outstanding tax debt prior to initiating manual refunds or credit elects.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should request the necessary programming changes to ensure that the duplicate return freeze and the telephone excise tax freeze code function appropriately. In addition, request programming changes to ensure that overpayments from undelivered refunds and interest offset appropriately.

The Chief Information Officer should ensure that the requested programming changes are implemented by January 2026.

We recommend that the Centers for Medicare & Medicaid Services instruct the SSAs to follow up with the five nursing homes (three nonprofit and two Government-owned) that may not have complied with Federal requirements to verify that they have taken corrective actions.

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to remediate the 22 vulnerabilities identified and verify that the 22 vulnerabilities identified were remediated.

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to improve network monitoring by implementing NIST SP 800-53, Revision 5, for the OPTN IT system, to include data loss prevention technology to prevent unauthorized exfiltration of information (Control SC-7(10)) and red-team exercises to simulate attempts by adversaries to compromise organizational systems (Control CA-8(2)).

We recommend that the Health Resources and Services Administration implement procedures to help ensure that the OPTN IT system contractor maintains compliance with federally required cybersecurity controls policies and standards on a continuing basis.

Castro recommends Treasury OIG follow-up with Guam's management to confirm the transactions noted as unsupported expenditures within the Direct Payments greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to Individuals can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Guam management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on the Government of Guam's responsiveness to Treasury OIG's requests and its ability to provide to provide sufficient documentation and/or replace unsupported and ineligible transactions charged…

Treasury OIG follow-up with Guam's management to 1) determine the feasibility of performing additional testing to verify if unsupported disaster relief payment errors identified were isolated errors or if it represents a systemic issue across other disaster relief payments claimed by Guam; and 2) determine the feasibility of performing additional testing on unsupported expenditures paid to hotels for quarantining to determine eligibility and reasonableness.

We recommend Treasury's Office of Capital Access should follow-up with Guam to obtain a copy of its fiscal year 2022 Single Audit report.

Treasury's Office of Capital Access to ensure that management decision letters are issued on the findings identified in the Single Audit Reports

We recommend that CGS Administrators, LLC discontinue its practices that limit the reopening of prior years' cap calculations and start reopening all prior years' cap calculations.

We recommend that CGS Administrators, LLC revise its policies and procedures so that it meets the reopening deadlines established in Federal requirements.

We recommend that CGS Administrators, LLC conduct the prior years' hospice cap calculations for the five hospices with UPIC recoupments and collect any additional overpayments.

We recommend that OPM centralize its audit resolution process into one program structure, instead of the current audit resolution structure that delegates responsibilities to multiple programs within OPM.

We recommend that OPM implement a plan to develop an agency-wide audit tracking system with all of the functionality needed to facilitate resolution workflows and which acts as a repository for all resolution and closure documentation.

We recommend that Federal Employee Insurance Operations work with all appropriate stakeholders to update the MOUs to reflect the Federal Employee Insurance Operations' current resolution process and implement a plan to regularly review and update the MOUs.

We recommend that Internal Oversight Compliance design a system of controls to track recommendations requiring monetary recoveries, including the five recommendations identified in this finding, to ensure that OPM has recovered all monies.

We recommend that Internal Oversight and Compliance immediately track the three recommendations described in our finding and begin the resolution process to resolve and close the recommendations.

We recommend that the audit follow-up official provide the OIG with corrective actions for the 10 open recommendations identified in this finding.

We recommend that Federal Employee Insurance Operations communicate any new or updated MOUs to the appropriate stakeholders.

We recommend that IOC and ARC develop and implement the necessary internal controls to ensure that all recommendations are resolved within a maximum of 6 months after issuance of a final report and that completed final action on each management decision occurs within 12 months after the date of the Inspector General's report.

We recommend that ARC work with the Office of the Chief Financial Officer to develop a process to verify that questioned funds identified in final reports and agreed to be returned to the FEHBP are fully returned to the FEHBP.

The Chief, FMSS, should ***************************************************************************************************************************************************************************.