Open Recommendations

The VA Nebraska"Western Iowa Health Care System Director ensures compliance with Veterans Health Administration staffing requirements for areas identified as high-risk, such as the inpatient mental health unit, and monitors compliance.

The Under Secretary for Health evaluates the Veterans Health Administration written guidance for high-risk workplace staffing and determines if clarification is needed.

The VA Nebraska"Western Iowa Health Care System Director ensures staff that may provide coverage on the inpatient mental health unit receive applicable Prevention and Management of Disruptive Behavior training for high-risk units.

The VA Nebraska"Western Iowa Health Care System Director strengthens processes to ensure that supervisors are made aware of staff members that have not completed the applicable Prevention and Management of Disruptive Behavior training for high-risk units, to include the hands-on component, and monitors compliance.

The Under Secretary for Health considers written guidance regarding risk for violence assessment use in units identified as a high-risk workplace that can be used to temporarily change a units acuity level and staffing needs.

Require the Maryland GOCPP to develop and implement adequate controls to ensure required grant-related records are retained in accordance with DOJ and state guidelines.

Require the Maryland GOCPP to strengthen its annual state certification reporting practices to improve reporting accuracy.

Require the Maryland GOCPP to develop and implement controls to ensure adequate oversight and improve the accuracy of performance reporting.

Work with the Maryland GOCPP to strengthen procedures for its secondary review of payments and implement enhanced accounting controls to help mitigate the risk of duplicate payments.

Remedy $80,550 in duplicate victim compensation payments.

Remedy $66,653 in unallowable questioned costs associated with victim compensation payments.

Remedy the $4,400 in unsupported questioned cost associated with a victim compensation payment.

Ensure the Maryland GOCPP updates its CICB Manual to: (1) require that the supporting files for claims contain written justification for any deviation from the CICB's policy on processing decisions, and (2) reflect the applicable and accurate statutory award limits established by the state of Maryland.

Update policies, and procedures related to monitoring and oversight of internal controls related to journal entries, to ensure internal consistency with, and clear definition of, those journal entries that are processed by the service provider; and to define the required documentation to be maintained to evidence CPSC reviews of journal entries.

ML - 1: Design and implement a control to identify, analyze, and respond to risks related to the validity of open obligations.

ML - 2: Establish procedures and recurring communication with the appropriate stakeholders to assist in the identification and de-obligation of stale undelivered orders.

ML - 3: Design a control to identify, analyze, and respond to risks related to the reporting of leases.

ML - 4: Establish recurring communication with the appropriate stakeholders.

Work with the Illinois Department of Human Services to ensure it accurately charges expenditures related to Social Security Administration programs.

We recommend that management design and implement controls that respond to the risks associated with the reliability of key underlying data and code used in developing the subsidy re-estimates. Such review should be documented and maintained.

We recommend that management: 1. Evaluate, design, and implement security management controls to ensure that corrective actions remediate the risk and address the root cause of findings and quality reviews over the POA&M closure documentation are conducted to confirm that the noted deficiencies are fully addressed to prevent future reoccurrences.

We recommend that management evaluate, design, and implement logical access controls and provide training and oversight over access provisioning, removal and/or deactivation of access, periodic reviews and recertifications of access, and adherence to password and security setting requirements, segregation of duties, and least privileged principles.

We recommend that management evaluate, design, and implement change management controls to ensure the Department’s system change management process identifies and categorizes the types of changes that impact the system, data, and configurations in addition to defining and documenting the change descriptions and requirements for testing, approvals, documentation, audit trails, and retention for each system change.

We recommend that management evaluate, design, and implement computer operations controls to develop and implement formal procedures addressing controls over changes to production jobs and schedules and the monitoring of actions taken by the generic/shared job processing account in the job scheduling tool.

We recommend that management ensure that controls are operating effectively over the complete and timely review of SOC reports to ensure the scope adequately covers the controls in place at the service organization, including the CUECs presented in such reports. Furthermore, management should implement and execute controls designed to address those CUECs in a timely manner.