Open Recommendations

The Railroad Retirement Board's Bureau of Fiscal Operations should continue working with the
Department of Treasury to determine the proper accounting treatment for contributions received by
Department of Labor on behalf of the RRB (i.e., contributions receivable) and provide supporting documentation
of the discussions and decisions made with the Department of Treasury for auditor review.

Revise NARA 161, NARA’s Internal Control Program , to establish a process to periodically evaluate whether the prior-year risk assessment remains valid and appropriate to address significant organizational or operational changes.

Document through a written formal memorandum any periodic risk evaluations and the decision whether or not to update the last prior-year assessment to reflect the current risk environment. This memorandum should include a clear justification and documentation of the evaluation performed and be reviewed and approved by the Management Control Oversight Council to ensure appropriate oversight and accountability.

Establish NARA policy for reviewing System and Organization Controls 1 Type 2 reports and evaluating complementary user entity controls. This policy related to control activities should be integrated into the agency’s internal control over financial reporting framework and include: a. Identification and Evaluation of CUECs b. Assignment of Responsibility c. Assessment of Control Effectiveness d. Documentation and Oversight

Establish a written formalized methodology for calculating materiality thresholds in accordance with Office of Management and Budget Circular A-123, Appendix A.

Ensure access request forms are resubmitted for the NARANet accounts noted in the audit finding.

Implement procedures (e.g., patching, configuration weaknesses) to remediate security vulnerabilities identified by vulnerability scans within the defined remediation timeframes in the NARANet General Support System Common Controls System Security Plan and document an acceptance of associated risks as appropriate.

Conduct an assessment to: 1) identify applications running on unsupported platforms and their associated servers; 2) group applications and establish a migration schedule; and 3) migrate applications to vendor-supported platforms. For applications or operating systems that cannot be migrated, document the associated risks and obtain formal acceptance for continued operation.

Disable non-essential certificate service endpoints and web enrollment. Additionally, enable features that enhance the protection and handling of credentials when authenticating network connections.

The CPSC implement and provide routine training regarding an improved Employment of Relatives Directive that requires written determinations on the propriety of the workplace relationships of all related persons, employees and contractors, who work at the CPSC.

Although the marriage of two senior CPSC officials created the perception of impropriety, we found insufficient evidence to substantiate that the subjects misused their positions.

Implement written policies and training to ensure that all employees who work on multiple activities record their time in a way that supports the distribution of the employee’s salary or wages among specific activities or cost objectives.

The Commission should determine the risks associated with non-standard adjustments in its financial reporting process and develop and document appropriate controls to review and validate those non-standard transaction outputs on the aging reports created by their service provider. At a minimum, the Commission should:

• Establish a dollar value threshold to review all balances without identifying contract and vendor fields, recorded on the monthly aging reports provided to the Office of the Chief Financial Officer and the OIG and
• Review and verify all material non-standard adjustment transactions (JVs, SVs, RVs, and BB transactions) recorded without identifying contract and vendor…

To address the issues we identified, we recommend that the Executive Vice President,
Strategy and Planning, take the following action:
1. Continue to develop and implement a joint strategic fleet/facilities plan. The plan
should define company goals, timelines, and next steps to ensure that the
company’s fleet and facilities efforts align. The plan should also include an
inventory of existing facilities and a method to continuously assess which
modifications are critical to support future operations and reprioritize, as
needed.

In addition, we recommend that the Executive Vice President, Capital Delivery, take the
following action:
2. Develop and implement a management framework for its facility upgrades,
including a management plan with the requisite components outlined in
company and industry standards. This should include a risk management
process and tools, such as a risk register.

Develop new or modify existing MOU supplemental schedules to include a framework for multicycle project budgets with specific illustrative criteria describing which projects should be categorized as multicycle, as well as roles and responsibilities for
a. developing and approving the currency budget’s multicycle projects, including which costs may be conditionally approved and how to receive full approval.
b. reviewing to ensure multicycle projects’ quarterly funding requests are justified and subsequently advancing funds.
c. annually reconciling the prior year’s advances to expenses and adjusting future advances as appropriate.

Executive leaders ensure staff store clean and dirty equipment separately, repair torn furnishings, and keep the environment clean.

Executive leaders ensure the facility’s policy for test result communication aligns with the VHA directive.

The Associate Medical Center Director ensures Environmental Management Services and nutrition staff maintain clean patient food storage areas.

The Associate Medical Center Director ensures staff monitor storage areas and remove expired supplies.

The Associate Medical Center Director ensures Environmental Management Services staff make feminine hygiene products available in public womens and unisex restrooms.

The Chief of Staff ensures staff establish written service-level workflows for the communication of test results.

Develop and implement a remediation plan to address incomplete data migration and ensure all IT assets are captured accurately.

Configure the system to generate standardized inventory reports for audit, compliance, and management review.

Establish a process to perform regular reconciliations between procurement records, physical assets, and system data.