Open Recommendations

Use the e-invoicing platform to replace manual invoice processing for future Infrastructure Support Services contracts.

Require Contracting Officers, Oversight Managers, and Program Office personnel to document the methodology for service level metrics calculations on all future managed service contracts before contract award or prior to implementing credits on invoices.

Ensure that Oversight Managers upload the supporting data for invoices to the contract electronic file application and determine whether the [redacted] in questioned costs for resource unit charges are supported and allowable.

Ensure that Oversight Managers communicate to Contractor personnel their responsibilities to follow FDIC policies to safeguard data and procedures for self-reporting related incidents.

Ensure Contracting Officers and Oversight Managers have the appropriate access to review and verify that contractors complete the required Privileged User Rules of Behavior training.

Review the installed applications on all issued laptops/desktops/endpoints to ensure no unauthorized software is present and take appropriate action if unauthorized software is present.

Review the Commission’s "user" setting population to ensure each "user" is properly configured in compliance with Commission's approved Group Policy Objectives (GPO). Make the appropriate corrections to user configurations, as appropriate.

Review and update Active Directory settings and Microsoft Defender and Intune policies to ensure unauthorized software cannot be installed.

We recommend that the Grantee reimburse $6,002 to ARC for the unallowable indirect costs charged to the grant.

We recommend that the Grantee implement its procedures for reporting and reviewing expenses, prior to charging them to the grant.

Revise the AmeriCorps Grants Accrual (IBNR & Advance) SOP, dated September 2024, and Grant Accrual Survey and Lookback Analysis Policy, dated August 15, 2024, and Record-to-Report End-to-End Narrative Version 2.0, dated March 7, 2025, to address:
a. Validating and documenting the accuracy of the grantee survey data provided in support of the grant accrual validation.
b. Procedures for identifying and documenting AmeriCorps’ internal control objective in terms of materiality risk.
c. Procedures to confirm the validation process met AmeriCorps’ internal control objective. If it does not meet the internal control objective, then determine the cause and corrective action to address…

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.