Open Recommendations

Confirm that medical facility directors develop local guidance on using automated dispensing cabinets in accordance with VHA Directive 1108.21 (and any revisions to this directive) and that facilities comply with that local guidance.

Require Pharmacy Benefits Management Services to revise VHA Directive 1108.21 to include routine monitoring for the use of generic information as a requirement in facility-level guidance for automated dispensing cabinets.

Ensure, in coordination with the controlled substance coordinator, or appropriate designee, and Veterans Integrated Service Networks, that reports detailing cabinet transactions for controlled substances removed using generic information are reviewed as part of required controlled substance inspections.

The Overton Brooks VA Medical Center Director conducts a comprehensive review of the patients hospitalization and takes action as indicated, including quality management improvement processes such as a peer review.

The Overton Brooks VA Medical Center Director ensures medical staff recognize the importance of obtaining hospitalized patients non-VA medical records and assesses the current processes for obtaining non-VA medical records, identifies any barriers to completion, and takes action as warranted.

The Overton Brooks VA Medical Center Director assesses the application of the one-to-one observation policy and practices at the facility, and takes action as warranted.

The Overton Brooks VA Medical Center Director reviews interim behavioral patient record flag processes to ensure implementation of safety strategies for staff and patients, and takes action as warranted.

The Overton Brooks VA Medical Center Director evaluates whether documentation of patient and patient-related behavioral events are reflected accurately in the electronic health record to facilitate continuity of care and communication among medical staff and takes action as necessary.

Verify that Ministry of Health in Jordan corrects the instance of material noncompliance detailed on page 7 of the audit report.

We recommend that the PBS Commissioner institute policies and procedures to ensure battery systems are designed, installed, operated, and maintained in accordance with federal regulations, PBS policy, and building code requirements.

We recommend that the PBS Commissioner institute policies and procedures to ensure training requirements are designed and implemented for PBS and PBS contractor personnel working with battery systems and associated technologies.

We recommend that the PBS Commissioner institute policies and procedures to ensure appropriate action is taken to address PBS personnel performance deficiencies identified in this report, including supervisory chains of command and individuals responsible for managing the battery systems.

We recommend that the PBS Regional Commissioner of the Pacific Rim Region take immediate action to safeguard the occupants and assets in the Anderson and Reagan Buildings by: (1)verifying that the ESCO removed the batteries and any other hazards from both the Anderson and Reagan Buildings using only qualified personnel; and, (2) obtaining the complete third-party investigation report into the cause of the battery system fire at the Anderson Building. Upon receipt, ensuring any remaining health and safety hazards listed in the report are addressed or mitigated.

We recommend that the PBS Regional Commissioner of the Pacific Rim Region take immediate action to improve management oversight of the region’s facilities to ensure that: (1) code violations and maintenance deficiencies brought to management’s attention are immediately addressed; (2) local fire department personnel are involved in pre-fire planning activities for future battery system projects; (3) local fire department personnel are involved in post-fire assessments; and (4) final certificates of occupancy are not issued until all outstanding fire and life safety deficiencies are corrected.

Rec. A.1: The DoD OIG recommended that the Under Secretary of Defense for Policy update guidance and identify specific steps to address highly sensitive information requests that require additional coordination and approvals, including the levels of coordination required to efficiently transfer information to facilitate the Government Accountability Office engagement, in accordance with 31 U.S.C. 716, and for a more transparent process for tracking requests.

Rec. A.2.a: The DoD OIG recommended that the DoD Performance Improvement Officer and Director of Administration and Management establish and consistently implement guidance and training for all primary action officers, including their roles and responsibilities, as well as procedures for processing Government Accountability Office information requests, including requests for highly sensitive information, in accordance with 31 U.S.C. 716.

Rec. A.2.b: The DoD OIG recommended that the DoD Performance Improvement Officer and Director of Administration and Management engage with the Government Accountability Office to develop and implement mutually agreed?upon processes and procedures for the DoD Audit Management Division and the Government Accountability Office during engagements that involve highly sensitive information, including the roles of the DoD Audit Management Division liaisons and primary action officers.

Document policies and procedures for developing and maintaining current and target cybersecurity profiles that include, at a minimum, consideration of the NCUA’s mission objectives, threat landscape, and resources (including personnel) and constraints.

Create and maintain current and target cybersecurity profiles—including a gap analysis that identifies differences between the current and target state—that consider anticipated changes in the NCUA’s cybersecurity posture.

Update and maintain the comprehensive inventory of data and the corresponding metadata to meet the requirements of the Open Government Data Act and OMB Memorandum M-25-05 by the established September 2026 deadline.

Implement baseline compliance monitoring for routers, switches, and firewalls on the NCUA network. This includes documenting deviations from the configuration baselines and providing business justifications for these deviations.

Improve processes to ensure that the NCUA remediates workstation vulnerabilities within agency-required timelines, including monitoring for workstations that have been disconnected from the network for an extended period of time.

Develop and implement procedures to remediate vulnerabilities for the (b) (7)(E) within NCUA timeline requirements that fall outside of the (b) (7)(E) monthly patching schedule.

Coordinate with (b) (7)(E) to upgrade the (b) (7)(E) software or document any risk-based decisions, including compensating controls.

Conduct a review of all current (b) (7)(E) privileged user accounts to ensure that the NCUA has documented access requests and approvals for each privileged user account, as required by NCUA policies and procedures.