Open Recommendations

PBGC should implement an enterprise-wide approach to prevent counterfeit components from entering its supply chain and establish performance measures to gauge the effectiveness of its anti-counterfeit policies and procedures. Additionally, PBGC should provide a comprehensive anti-counterfeit training for its personnel.

PBGC should manage Active Directory certificate template settings effectively by hardening and auditing existing templates in the environment. Privileges should also be assessed for all templates to prevent unauthorized changes to the configuration settings.

PBGC should establish robust network segmentation and configure firewalls with default rules to ensure the guest wireless network is effectively isolated from internal resources.

PBGC should establish a comprehensive system for monitoring, analyzing, and reporting on quantitative performance measures to evaluate the effectiveness of its Data Breach Response policies and procedures.

PBGC should implement an effective specialized security training program that includes steps to identify and prevent phone-based social engineering for all employees.

PBGC should strengthen its controls around verifying the identity of PBGC personnel prior to temporarily disabling their requirement for MFA for remote access should a user purportedly have a malfunctioning PIV card or other MFA token.

We recommend that OESPIM develop a SORN for all applicable systems.

We recommend that OPM obtain feedback on its security awareness and training program and use the information to make improvements to the IT security training program.

identify all cameras not functioning and develop a plan to restore them to operational status.

develop and implement a strategic, nationwide plan that includes continuous monitoring of the operational status of cameras and diagnosing and addressing camera failures timely.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to determine whether the $24,386 that Yukon-Koyukuk charged toARP ESSER for the three expenditures made without maintaining proper documentation of the competitive procurementprocess was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate correctiveactions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to ensure that LEA officials responsible for making and documentingpurchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should implement an automated governance, risk, and compliance tool to manage risk from all sources across the three tiers of the organization in a timely manner. This recommendation updates FY 2021 FISMA recommendation number 5 (IG FISMA metrics 5, 9, and 10).

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

Implement additional policies, processes, and/or procedures to ensure that NSF assigns program element, thematic, account, budget object class, and/or other codes consistent with its Guidance for Coding of Mid-scale Research Infrastructure Awards for all awards NSF includes within its Mid-scale Research Infrastructure portfolio.

Update and/or develop external Mid-scale Research Infrastructure guidance for proposing organizations to identify and/or clarify NSF’s expectations for the proposal, award, monitoring, and reporting activities required for different types of Mid-scale Research Infrastructure awards.

Implement a formal process for documenting NSF’s oversight, as well as the performance of the activities funded under Mid-scale Research Infrastructure awards, and for appropriately storing and archiving this documentation within NSF’s eJacket system (or another appropriate system) on a timely basis.

Produce and provide additional training to Integrated Project Teams responsible for overseeing Mid-scale Research Infrastructure awards.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that ICF Macro, Inc., corrects the one material weakness in
internal control detailed on page 8 of the audit report.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management BranchVerify that Chemonics International, Inc. corrects the material
weaknesses in internal control detailed on pages 11 to 12 of the audit report.

We recommend that National Government Services, Inc. develop and deliver additional education to auditors and audit supervisors regarding applicable criteria and review requirements.

We recommend that National Government Services, Inc. develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

We recommend that Novitas develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

Develop and enhance procedures for travel charge card terminations to ensure the timely closure of travel charge card accounts for separated employees.

Review and, as necessary, adjust the individually billed accounts to ensure compliance with the established credit limits in the NRC Plan.

Establish a process for conducting periodic reviews of travel charge card accounts to strengthen oversight and monitoring of individually billed accounts and help ensure adherence to the credit limits defined in the NRC Plan.

Develop and implement procedures for periodic reviews of the credit limits for centrally billed travel accounts and adjust these limits, as necessary, for the anticipated operational need.

(U) Rec. 1.a: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C?17 System Program Manager to develop controls to ensure the accuracy of Chief Financial Officer reports.

(U) Rec. 1.b: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C-17 contracting officer to require Boeing to notify the contracting officer of price increases of 25 percent or higher than the proposed price.

(U) Rec. 1.c: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center require that the C?17 contracting officer reviews spare parts prices throughout the execution of the C?17 performance?based logistics contract, determine whether price increases of 25 percent or above occurred, and obtain justification of the price increase from Boeing.

(U) Rec. 1.d: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C?17 contracting officer to review or delegate the review of invoices to determine whether spare parts prices are allowable and reasonable before payment.

(U) Rec. 1.e: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C-17 contracting officer to assess and determine whether overpayments were made on the 12 spare parts we determined not to have fair and reasonable prices and implement available options to seek recovery, including voluntary refunds of at least $992,856, in accordance with Defense Federal Acquisition Regulation Supplement 242.71.

(U) Rec. 2: The DoD OIG recommended that the Director of the Defense Contract Management Agency review Service Parts Management to validate the accuracy of the forecasting demands for spare parts and if accuracy issues are identified during the review, require that corrective actions are taken.

(U) Rec. 3.a: The DoD OIG recommended that the Principal Director of Defense Pricing, Contracting, and Acquisition Policy instruct the Defense Acquisition Regulations Council to initiate changes to the Federal Acquisition Regulation to clarify requirements for the contracting officer to require a technical analysis on the bill of materials or the forecasting system that generated the types and quantities of materials used for proposals in Federal Acquisition Regulation 15.404 1(e).

(U) Rec. 3.b: The DoD OIG recommended that the Principal Director of Defense Pricing, Contracting, and Acquisition Policy instruct the Defense Acquisition Regulations Council to initiate changes to the Federal Acquisition Regulation to clarify requirements for the contracting officer to review or delegate the review of invoices to ensure that prices are allowable and reasonable before payment in Federal Acquisition Regulation 52.216-7.

The Under Secretary for Health ensures that consideration to reactivate the heart transplant program at the Richmond VA Medical Center includes a comprehensive analysis of transplant referral volume, leadership competency, and transplant team proficiency.

The Under Secretary for Health ensures that VA Mid-Atlantic Health Care Network and Richmond VA Medical Center leaders conduct a rigorous surveillance of quality measures if the heart transplant program is reactivated and emphasize safely meeting program target volumes to maintain clinical experience.

Ensure that JFCS develops and implements written policies and procedures related to grant financial management to comply with the DOJ Grants Financial Guide and federal award requirements.

Ensure that JFCS develops and implements a procedure that consists of a review and reconciliation process of VOCA subaward expenditures prior to posting in its accounting records.

Ensure that JFCS enhances its fiscal policies and procedures to include a process or control (e.g., checklist or reconciliation) that facilitates a more robust review of expenses to ensure allowability with VOCA Guidelines.

Require Arizona DPS to complete its review of documents provided by JFCS that support corrective actions for FY 2022 and 2023 fringe benefit transactions and take remedial action if necessary.

Require that the Arizona DPS executes its single audit monitoring responsibilities to verify that the JFCS FY 2021 and 2022 VOCA-related single audit report findings, including any questioned costs, have been remedied.

3. We recommend the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office direct the Commissioner for Trademarks to set targets for the trademark pendency-related KPIs in the 2022-2026 Strategic Plan.

5. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office direct the Commissioner for Trademarks to formalize a methodology for estimating and validating efficiency gains in the trademark production model.

6. We recommend the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office direct the Commissioner for Trademarks to develop and implement a Trademarks workforce action plan that includes strategies to address challenges in recruitment and retention, milestones, roles of key organization components, measures of success, and a process to continuously assess and revise the plan.

We recommend that the Massachusetts Department of Public Health follow up with the two ICF/IIDs to verify that they have taken corrective actions on the life safety and emergency preparedness deficiencies identified during the audit.

We recommend that the Massachusetts Department of Public Health work with CMS to develop standardized life safety training for ICF/IID staff.

We recommend that the California Department of Aging refund the estimated $1,087,459 of CARES Act funds that were not in compliance with Federal and State requirements.