Open Recommendations

Consult with VA’s Office of General Counsel to determine whether the modernization plan submitted to Congress—regarding service-connected death benefit grants—complies with section 701(b) of the PACT Act and take appropriate corrective action if needed.

Take corrective action on the remaining three of seven instances that led to about $612,000 in improper payments.

Update the Veterans Benefits Administration’s Adjudication Procedures Manual to clarify and strengthen the actions claims processors should take to verify foreign beneficiaries are alive.

Ensure jurisdiction guidance for routine reviews for residents in the Philippines is clearly communicated to all regional offices.

Provide guidance to assist claims processors in verifying information in the Veterans Benefits Administration’s systems compared to the results from the Social Security Administration inquiry results.

Update the Adjudication Procedures Manual to require claims processors to upload the Social Security Administration inquiry results to beneficiaries’ records.

Take corrective action on the remaining three of seven instances that led to about $612,000 in improper payments.

Update the Veterans Benefits Administrations Adjudication Procedures Manual to clarify and strengthen the actions claims processors should take to verify foreign beneficiaries are alive.

Ensure jurisdiction guidance for routine reviews for residents in the Philippines is clearly communicated to all regional offices.

Provide guidance to assist claims processors in verifying information in the Veterans Benefits Administrations systems compared to the results from the Social Security Administration inquiry results.

Update the Adjudication Procedures Manual to require claims processors to upload the Social Security Administration inquiry results to beneficiaries records.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that the program office conducts reviews to confirm that initial, merit, and programmatic reviews are completed, ensuring applications meet program requirements.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that training is developed and implemented for grant file reviewers that, at a minimum, addresses the responsibility for (1) evaluating applications and (2) maintaining official grant award files that are consistent and complete.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that following the implementation of the training (described in recommendation 3), grant file reviewers complete the training and retain documentation in the grant files that support that the training was completed.

We recommend that the Associate Administrator for NTIA, Office of Internet Connectivity and Growth develop milestones and performance metrics for reviewing future broadband program planning phase deliverables during program planning and design as required by Office of Management and Budget circular A-11. The performance metrics should be specific, measurable, achievable, relevant, and timely for measuring performance against the established review timelines.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that NTIA FPOs confirm that the official award files are complete and accurate before they are submitted to the grants officer.

We recommend the DHS Office of the Chief Information Officer implement all necessary mobile device security countermeasures in accordance with guidance from DHS and the Defense Information System Agency’s Security Technology Implementation Guides.

We recommend I&A’s Directorate of Technology and Data Services implement controls to address identified custom-developed application vulnerabilities and weaknesses.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure component custom-developed applications have been evaluated and do not have unmitigated vulnerabilities.

We recommend the DHS Office of the Chief Information Officer remove applications from component mobile devices that are prohibited by DHS policy, applications with unmitigated security risk, and applications that do not meet business needs.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure: • all user-installed applications are evaluated for security risks to the mobile device or data security and for compliance with Department policy before allowing their use; and • user-installed applications are managed and monitored on a routine basis.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process and to ensure: • tools used for credentialed scans can detect known vulnerabilities; • credentialed scans are completed and assessed in accordance with DHS guidance; • plans to address vulnerabilities are created and implemented promptly in accordance with DHS guidance; and • the risk of noncompliant enterprise-level system settings is formally accepted or mitigated.

We recommend I&A’s Directorate of Technology and Data Services update its policies and procedures for notification of official foreign travel to incorporate DHS Office of the Chief Information Officer guidance and ensure mobile devices receive proper authorization for international travel.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure mobile devices are configured with minimal features and applications based on mission needs.

We recommend I&A’s Directorate of Technology and Data Services coordinate with DHS Office of the Chief Information Officer to develop and implement a memorandum of understanding that clearly defines roles, responsibilities, and accountability for the inventory management of I&A mobile devices.

We recommend the DHS Office of the Chief Information Officer update and implement policies and procedures to improve its mobile device management to ensure: • OCIO-issued mobile devices are enrolled in the mobile device management system; • documentation is required for devices that receive waivers from the policy; • all reported lost, stolen, and disposed-of I&A mobile devices are unenrolled from the mobile device management system; • all lost or stolen mobile devices and those I&A no longer needs are reported to the Office of the Chief Information Officer to be remotely wiped by the mobile device management system; and…

We recommend I&A’s Directorate of Technology and Data Services coordinate with the DHS Office of the Chief Information Officer to develop and implement policies and procedures to improve the management of mobile services and ensure: • all mobile devices without a business need are unenrolled from mobile services; • mobile service overage charges are incurred in support of mission needs; and • mobile device use is routinely monitored and reported to prevent paying for unnecessary devices and services.

The Chief, Criminal Investigation, should either reestablish the CI Training Council or update internal guidelines outlining new processes and procedures that CI Senior Executives will follow to review and approve changes to the SAIT training program.

The Chief, Criminal Investigation, should review SAIT training courses to identify those that involve legal components to determine if CT Counsel attorneys should be instructors.

The Chief, Criminal Investigation, should ensure that representatives from the Office of Chief Counsel are consulted when proposing/making curriculum changes on tax related lessons.

The Chief, Criminal Investigation, should initiate a review of the SAIT Training Program Evaluation Policy to ensure that the policy currently reflects the CI Senior Executive Team’s test grading policies.

The Chief, Criminal Investigation, should establish processes and procedures that regularly review test grading to ensure adherence to and compliance with the SAIT training program evaluation policies.

Take appropriate steps to ensure that BJA staff and grantees receive appropriate guidance and direction related to subrecipient/contractor classifications.

Review the instances of approvals of unallowable costs and take appropriate steps to ensure that BJA personnel are aware of and recipients receive accurate guidance related to unallowable costs.

Require Newburyport to develop and implement written policies and procedures to ensure performance reporting is limited to the work performed under the relevant award, as required.

Ensure Newburyport submits its FY 2023 and FY 2024 single audit reports and require Newburyport to develop and implement policies and procedures to ensure the timely completion and submission of future single audit reports to the Federal Audit Clearinghouse

Require Newburyport to develop and implement policies and procedures related to subrecipient/contractor classifications.

Require Newburyport to develop and implement adequate policies and procedures for subrecipient management, to include assessing subrecipient risk, subrecipient monitoring, relevant special conditions, and reviewing subrecipient expenditures for allowability, appropriateness, and support.

Remedy $388,037 in unallowable costs, which consists of $233,850 in unallowable research partner costs, $139,619 in unallowable subrecipient costs, $5,750 in unallowable other direct costs, and $8,818 in unallowable supply costs

Remedy $51,662 in unsupported costs, which consists of $35,000 in unsupported subrecipient costs and $16,662 in unsupported supply costs.

Require Newburyport to improve its procedures for ensuring costs charged to the grants are allowable and reasonable according to federal regulations.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

Restricted due to sensitive information.

Restricted due to sensitive information.

We recommend the Director of FEMA’s Individual Assistance Division ensure the National Board resolves the $425 million in questioned costs associated with the Emergency Food and Shelter Program-Humanitarian Relief funding during the grant closeout process by collecting supporting documentation, determining whether the costs are allowable, and recouping any costs that are not allowable.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate resolve the $16.5 million in questioned costs associated with the Shelter and Services Program funding identified in our report. FEMA should collect supporting documentation, determine whether the costs are allowable, recoup any costs that are not allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate review payment requests during the grant closeout process for all Shelter and Services Program awards in FY 2023 and FY 2024 to minimize the reimbursement of unsupported costs. FEMA should collect supporting documentation, determine whether the costs are allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.