Open Recommendations

We recommend that the Election Assistance Commission's Chief Information Officer establish and implement a formal Information Security Continuous Monitoring Strategy and an effective monitoring mechanism to track the progress of ongoing lessons learned.

We recommend that the Election Assistance Commission's Chief Information Officer identify and employ an automated notification mechanism to test its system level contingency plans thoroughly and effectively.

We recommend that the Division of Examinations: (a) Develop Broker-Dealer and Exchange examination program goals and objectives that reflect core mission areas; (b) establish Broker-Dealer and Exchange examination program performance metrics that align with established program goals and objectives and are based on recognized leading practices (that is, are outcome-based, informative, clear, and linked to agency goals and mission); and (c) develop Broker-Dealer and Exchange examination program evaluation and monitoring activities that consider performance metric data and are based on recognized leading practices (that is, activities that help drive potential change by determining whether the program is working and why).

"Conduct a comprehensive review of the following topics as part of ongoing efforts to improve the BrokerDealer and Exchange examination program, and establish appropriate corresponding corrective action(s):
a. Examination scoping practices holistically, to include the use of limited scope examinations (such
as thematic initiatives).
b. Alignment of examinations with annual priorities, industry activities, and risks identified in brokerdealer planning data.
c. Extent of asset verification performed and waivers authorized.
d. Broker-dealer examination coverage of the Financial Industry Regulatory Authority and how it
may be leveraged in program planning. "

Require that exam plans or other planning memoranda contain more detailed information about the process used to select broker-dealer examination candidates and the reason(s) for selection to help support that risk-based strategies were used.

Review and update, as appropriate, procedures and guidance relevant to asset verification and risk ratings to ensure recordkeeping in TRENDS is consistent across broker-dealer examination files, which may include incorporating reviews of this information across broker-dealer examinations.

The Chief Information Officer and the Chief, Direct File, should ensure that Direct File developers document their test plan with traceability to test types, test cases, and test results.

The Chief Human Capital Officer should create and implement a systemic fix to ensure that Section 1204 managers completing their quarterly certifications are automatically routed to the appropriate SharePoint page(s) when their responses necessitate additional information reporting about potential ROTER violations.

The Chief Human Capital Officer should perform an annual reconciliation to ensure that: 1) all Section 1204 employees assigned the yearly Section 1204 mandatory briefing are accounted for in the yearly Section 1204 population and 2) the entire Section 1204 population has been assigned the annual Section 1204 mandatory briefing.

Assess electronic health record major performance incident data needs and contractually commit to real-time data sharing that will provide greater awareness of system operations.

Develop a formal procedure for verifying performance metrics and associated credits to ensure the department receives the remedies it is due under the contract.

Update the process for prioritizing major performance incidents to ensure that notification and resolution occur in a consistent manner.

Develop effective notification and resolution metrics that consistently capture results for all major performance incidents, regardless of the owner, and enforce them.

Identify the information needed in post-resolution reports, such as corrective and preventative actions, and require the contractor to consistently collect, verify, and report that information as a contract deliverable.

Develop a plan to ensure all clinicians are familiar with the national downtime procedures.

Identify the appropriate backup system and develop a training strategy to ensure clinicians can use the system during downtime.

Assess facilities patient safety reports identified during this audit to determine if additional actions need to be taken and, if so, provide an action plan.

Develop a mechanism to better identify major performance incidents and negative patient outcomes and provide a plan to prioritize and address their causes.

Provide guidance to EPA regions and authorized states on methods that they can use to verify land-use control status, such as reporting or onsite assessments.

Define the minimum frequency for region and state verification that landuse controls remain operational-for example, verification every one, three, or five years.

Update RCRAInfo to capture data on the operational status of land-use controls. This could be achieved by establishing national event codes for land-use control activities in RCRAInfo-for example, using Region 3's event codes as nationally defined event codes.

Provide training to help regions and authorized states input and maintain land-use control data in RCRAInfo.

Implement mechanisms to monitor land-use control status at the national level, such as annual reports from RCRAInfo that identify land-use controls that have not been verified at the minimum frequency to ensure they remain operational.

We recommend that Humana Health Plan, Inc. refund to the Federal Government the $6,777,385 of estimated overpayments.

We recommend that Humana Health Plan, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.