Open Recommendations

Update relevant policies and procedures for appraiser roster management so that they align with each other and with regulations and reflect HUD practice. At a minimum, the policies and procedures should clearly cover appraiser roster status, license expiration, disciplinary actions, removals, data accuracy, and documentation.

Maintain historical data for each appraiser record, including history on expiration dates, when appraisers are moved on or off the appraiser roster and when they are and are not allowed to be assigned to conduct appraisals.

Improve quality assurance processes by adding steps to verify that the appraiser roster is accurate and reliable over time through testing of its logic-based system controls and data fields.

Evaluate the postmarking policy and adjust as necessary to ensure that all mail-in ballots receive a postmark.

Develop qualitative and quantitative performance measures to evaluate the effectiveness of the following: Configuration Management plan and change control activities.

Perform a cost benefit analysis of introducing automation to support the testing of system contingency plans; and apply the appropriate risk mitigation strategy.

Fully implement its processes for information system back up for General Support System Cloud.

Include controls in future debt management system modernization efforts to address system limitations causing overpayments to not be recovered via Cross-Program Recovery or transferred to another liable individual for recovery.

Pending automation improvements, remind employees of circumstances when a manual action is needed to initiate cross-program recovery or transfer a debt to another liable individual for recovery.

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.

FHFA-OIG's Chief Information Officer should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA-OIG and OPM standards.

FHFA-OIG's Chief Information Officer should establish and implement a process to make suitability adjudicative determinations and take suitability actions for covered positions in accordance with OPM’s regulation under Title 5 CFR, Part 731.103.

FHFA should disable accounts of nonprivileged users who have been inactive for over 365 days, as required by the FHFA customer controls for the cloud system.

FHFA should work with the cloud system’s vendor to implement software updates that automatically disable user accounts after 365 days of inactivity, as required by the FHFA customer controls for the cloud system.

FHFA should update the customer controls for the cloud system to include a procedure for regular reviews of non-privileged users’ access.

FHFA should complete the review and update of overdue SSPPs and Customer Control Plans in accordance with the existing related plans of action and milestones (POA&Ms).

FHFA should complete the review, update, and testing of the Capital Models (PolyPaths) ISCP in accordance with the existing related POA&M

Evaluate and document all accounting policies within the combined financial statements to ensure non-GAAP policies are identified and monitored at least annually for quantitative and qualitative impacts.

Evaluate and document the accounting implications of all unusual arrangements within the Federal Government, including alternative financing arrangements and regulatory assets and liabilities.

Enhance existing Southwestern processes to ensure that all substantially completed projects are transferred from CWIP to PP&E for financial reporting purposes.

Work with the Corps to enhance existing CWIP monitoring processes to ensure the timely transfer of CWIP to PP&E.

3. We recommend that the NOAA Administrator direct the Office of Space Commerce Director to modify the TraCSS staffing plan to include roles, responsibilities, and priority for each position and strategies for attrition management.

4. We recommend that the NOAA Administrator direct the Office of Space Commerce Director to define and document OSC's approach for STM-related responsibilities in the near and long terms to address current and future operational risks and include items such as guidelines, safety standards, behavioral norms, and conjunction prevention protocols.

5. We recommend that the NOAA Administrator direct the Office of Space Commerce Director to develop and regularly update a plan to implement OSC's approach to fulfiling the Department's STM-related responsibilities set in SPD-3.

We recommend the FEMA Administrator, in coordination with DHS and OMB, take action to issue final regulations implementing the State-Administered Direct Housing Grant Program authorized by Section 1211(a) of the Disaster Recovery Reform Act of 2018.

We recommend the FEMA Administrator provide quarterly briefings, consistent with House Report 117-87, to congressional Appropriations Committees on the status of the component’s DRRA implementation efforts, including the State-Administered Direct Housing Grant Program.

We recommend the FEMA Administrator continue to evaluate challenges associated with implementing the State-Administered Direct Housing Grant Program, and then develop and implement new authorities or program changes to address those challenges.

Develop and implement a post-award oversight policy that includes requirements to document site visits and develop a central repository for site visit reports, and controls to ensure these requirements, and existing requirements to update risk registers and assign risk response dates, are met.

The Sheridan VA Medical Center Director ensures that psychiatry or medical officer of the day staff reassess suicidal patients prior to changing a one-to-one observation status order.

As DOJ policy does not address what information Department personnel may include in a statement that is determined to be necessary to reassure the public that the appropriate law enforcement agency is investigating a matter or to protect public safety, we recommend that the Department revise this policy to require that the information contained in a statement released pursuant to JM 1-7.400(C) be reasonably necessary either to reassure the public that the appropriate law enforcement agency is investigating a matter or to protect public safety.

We recommend that the Department make clear whether the Justice Manual's Confidentiality and Media Contacts Policy, Justice Manual 1-7.000, applies to the Attorney General.

We recommend that the Department clarify its policies to address whether any of the provisions of 28 C.F.R. 50.2 remain Department policy in light of the existence of the Confidentiality and Media Contacts Policy contained in the Justice Manual.

If 28 C.F.R. 50.2(b)(9) remains valid Department policy, we recommend that the Department require that requests to the Attorney General or Deputy Attorney General for approval to release information otherwise prohibited from disclosure and any approval to release such information pursuant to 50.2(b)(9) be documented.

We recommend that the Department consider revising its White House communications policy to clarify what information can be disclosed to the White House in situations where the policy permits communication about a contemplated or pending civil or criminal investigation.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend Departmental Administration Information Technology Office management enforce multi-factor authentication, or the equivalent thereof, to the application.

We recommend Departmental Administration Information Technology Office management configure the system to generate user listings with the required data elements (e.g., first name, last name, account creation date, and roles or privileges) to support its system of internal controls and operational needs.

We recommend Cybersecurity and Privacy Operations Center management update existing policies and procedures to include repercussions when an individual does not complete their required role-based security training in the designed 45-day time frame.

We recommend the Chief Information Officer perform a cybersecurity resource assessment to identify any technology, people, or tool gaps.

The Phoenix VA Health Care System Director ensures Phoenix VA Health Care System policy is in alignment with Veterans Health Administration Directive 1101.14, Emergency Medicine.

The Phoenix VA Health Care System Director makes certain that investigation and closure of events placed into the Joint Patient Safety Reporting system are completed per the Veterans Health Administrations established time frame, and monitors compliance.

Conduct in-depth evaluations to monitor the performance of EPA regional offices' oversight of delegated agencies' implementation of the EPA's Clean Air Act Stationary Source Compliance Monitoring Strategy.

Ensure that Region 9 develops a plan to conduct Clean Air Act state reviews of California's largest air quality management districts every five years, in accordance with the State Review Framework Compliance and Enforcement Program Oversight, SRF Reviewer's Guide.

Formalize a state review framework recommendation resolution process to ensure that the EPA's senior managers and delegated agencies are accountable for the resolution of state review framework recommendations.

In collaboration with the Office of General Counsel and the Office of Air and Radiation, determine to what extent the Clean Air Act authorizes the EPA to require periodic identification and inspection of nonmajor stationary sources such as SM-80s by states, local government agencies, federally recognized Indian tribes, and U.S. territories. Document the EPA's determination and exercise such authority, if applicable, as the EPA deems appropriate.

Clarify Agency policies and guidance to: a. Communicate the EPA's expectations for the EPA regions and states, local government agencies, federally recognized Indian tribes, and U.S. territories to identify, inspect, report, and verify data for SM-80 sources. b. Communicate steps the EPA will take, if any, to periodically identify and inspect SM-80s if these entities do not meet such expectations. c. Clearly define SM-80 sources.

Establish routine training to reinforce EPA guidance and policies regarding delegated Agency requirements and responsibilities to identify and inspect SM-80 sources. Training is to include coordination among EPA regional managers, including division directors, deputy directors, branch chiefs, section chiefs, managers, and staff in the Office of Air and Radiation and the Office of Enforcement and Compliance Assurance.