Recommendation: The Director of the Office of Management and Budget should (1) require that agencies explicitly document annual data center closure goals in their DCOI strategic plans and (2) track those goals on the IT Dashboard. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should require agencies to report in their quarterly inventory submissions those facilities previously reported as data centers, even if those facilities are not subject to the closure and optimization requirements of DCOI. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should document OMB's decisions on whether to approve individual data centers when designated by agencies as either a mission critical facility or as a facility not subject to DCOI. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should take action to address the key performance measurement characteristics missing from the DCOI optimization metrics, as identified in this report. (Recommendation 4)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Secretary of Agriculture should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 5)

Agency: Department of Agriculture
Status: Open

Comments: In comments on our report, the Department of Agriculture (Agriculture) agreed with our recommendation and stated that it planned to meet the cost savings target in 2020. We will continue to monitor Agriculture's efforts to implement this recommendation.

Recommendation: The Secretary of Commerce should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 6)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: In comments on our report, the Department of Commerce (Commerce) agreed with our recommendation and described actions that they planned to take in order to address the recommendation. We will continue to monitor Commerce's efforts to implement this recommendation.

Recommendation: The Secretary of Commerce should take action to meet its data center optimization metric targets established under DCOI by OMB. (Recommendation 7)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: In comments on our report, the Department of Commerce (Commerce) agreed with our recommendation and described actions that they planned to take in order to address the recommendation. We will continue to monitor Commerce's efforts to implement this recommendation.

Recommendation: The Administrator of the National Aeronautics and Space Administration should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In comments on our report, the National Aeronautics and Space Administration (NASA) agreed with our recommendation and described actions that the agency planned to take to address the recommendation. NASA stated that it expected to complete these actions by March 31, 2020. Once we have obtained and assessed evidence of the agency's actions taken, we will update the status of this recommendation.

Recommendation: The Director of OCC should establish internal written policies to effectively implement and document the State Plan review and approval process for future review and approval periods. (Recommendation 1)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it has been working on establishing written policies (e.g., internal guidance documents and checklists) to implement and document the State Plan review and approval process. OCC expects to complete this work for the FY2022-2024 Plan period. We will continue to monitor OCC's efforts to implement this recommendation.

Recommendation: The Director of OCC should define the informational needs related to the results of program-integrity activities. (Recommendation 2)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to incorporate its information needs regarding the results of program integrity into the Preprint document as it develops the document. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate externally to the states its informational needs related to the results of states' program-integrity activities. (Recommendation 3)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to states and territories as part of the Preprint Training activities - including webinars and peer-to-peer virtual meetings - so Lead Agencies understand what is expected for them to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate internally to staff its informational needs related to the results of states' program-integrity activities. (Recommendation 4)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to staff in both regional and central offices as part of the Preprint Training activities so staff understand what is expected for Lead Agencies to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop documented criteria to guide the review of CAPs submitted by states to ensure that proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. (Recommendation 5)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it revised the CAP Review Tool to in response to our recommendation. OCC also told us that it plans to implement the revised CAP Review Tool beginning September 2020 to document the review of CAPs submitted for the most recent ACF-404 reporting cycle (June 2020). We asked OCC to provide documentation showing the revised CAP Review Tool is responsive to our recommendation. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should timely complete its effort to develop established written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. (Recommendation 6)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it developed draft written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. However, due to the impact of the COVID-19 on staffing capacity, OCC has not presented the draft policies to regional offices for feedback. OCC told us it plans to finalize the written policies for the CAP follow-up process by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop and document criteria to assess the effectiveness of states' program-integrity control activities. (Recommendation 7)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it analyzed information gathered from federal and state resources to develop and document criteria to be used to assess the effectiveness of states' program integrity control activities. We asked OCC to provide us the document showing all criteria to be used to assess the effectiveness of states' program integrity control activities. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should evaluate the feasibility of collecting information from the Grantee Internal Controls Self-Assessment Instrument (Self-Assessment Instrument) and Fraud Toolkit, such as during its Monitoring System process, to monitor the effectiveness of states' program-integrity control activities. (Recommendation 8)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it is working to make the Self-Assessment Instrument and Fraud Toolkit more user-friendly to encourage increased use within the state CCDF program. With increased usage, OCC believes it will be in a better position to assess how the collection of data from these two instruments can be incorporated into the Onsite Monitoring System or other oversight activity. OCC told us it anticipates completing work to implement this recommendation by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Assistant Secretary for ACF should ensure that ACF conducts a fraud risk assessment to provide a basis for the documentation and development of an antifraud strategy that describes the CCDF program's approach to address prioritizing fraud risks identified. (Recommendation 9)

Agency: Department of Health and Human Services: Administration for Children and Families
Status: Open

Comments: In September 2020, HHS told us it anticipates completing the initial fraud risk assessment for the CCDF program by December 2020. We will continue to monitor HHS's efforts to implement this recommendation.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary enhances existing procedures for Treasury management to perform additional reviews for restatements, reclassifications, and adjustments to beginning net position to reasonably assure that they are properly supported and accurately reported. (Recommendation 2)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury enhanced its procedures to include additional management reviews, particularly the Financial Reports and Advisory Division Director, for restatements, reclassifications, and adjustments to beginning net position. Although FRAD took steps to enhance its review procedures, the additional review did not prevent FRAD from including descriptions in the draft CFS that were not supported by entity financial statements or from excluding some information from the CFS notes. Further steps are needed to define procedures to ensure consistent and accurate treatment of restatements, reclassifications, and adjustments to beginning net position in the CFS. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, establishes effective processes and procedures to reasonably assure that appropriate information regarding legal contingency losses is reported in the CFS. (Recommendation 4)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury and OMB (1) increased guidance to federal entities in the Treasury Financial Manual section 2-4700; (2) included an illustrative Contingent Loss Table in OMB Circular No. A-136 for agencies to use as guidance when reporting probable and reasonably possible losses; (3) provided guidance to agencies through monthly Central Reporting Team (CRT) meetings with the agencies' financial reporting staff and at the Government Financial Management Conference; (4) communicated regularly with Department of Justice officials regarding the preparation of the government-wide legal representation letter; and (5) increased the number of Treasury staff performing the legal letter analysis. However, we noted inconsistencies among the significant component entities' financial statement note disclosures, management schedules, and legal representation letters, and the legal contingency loss information reported in the CFS, as well as inconsistencies between entities' year-end management schedules/legal representation letters and the final government-wide legal representation letter. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials implement the necessary actions to effectively address the two primary causes of the significant deficiency in IRS's internal control over unpaid assessments. These actions should (1) resolve the system limitations affecting the recording and maintenance of reliable and appropriately classified unpaid assessments and related taxpayer data to support timely and informed management decisions, and enable appropriate financial reporting of unpaid assessment balances throughout the year, and (2) identify the control deficiencies that result in significant errors in taxpayer accounts and implement control procedures to routinely and effectively prevent, or detect and correct, such errors. (Recommendation 19-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS documented the key management decisions in the design and use of the estimation process. This step should reduce the risk that IRS may perform sampling procedures inconsistent with management intent or plans. Continued management commitment and sustained efforts are necessary to build on the progress made to date and to fully address IRS's remaining unresolved issues concerning the management and reporting of unpaid assessments. We will assess IRS's progress in addressing these issues during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials document and implement a formal comprehensive strategy to provide reasonable assurance concerning its nationwide coordination, consistency, and accountability for internal control over key areas of physical security. This strategy should include nationwide improvements for (1) coordinating among the functional areas involved in physical security; (2) implementing and monitoring the effectiveness of physical security policies, procedures, and internal controls; and (3) ongoing communication in identifying, documenting, and taking corrective action to resolve underlying control issues that affect IRS's facilities. (Recommendation 19-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that Facilities Management and Security Services is in the process of developing and documenting a formal, comprehensive strategy. According to IRS officials, this strategy will include different overarching goals, such as improving workforce effectiveness, ensuring appropriate monitoring functions and employee accountability, and improving coordination and communication of policies and procedures. IRS plans to complete the formal, comprehensive strategy during fiscal year 2020 and finalize the implementation of this strategy by March 2021.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials determine the reasons staff did not consistently comply with IRS's existing requirement for maintaining an emergency contact list at all of its facilities and, based on this determination, establish a process to enforce compliance with the requirement. (Recommendation 19-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS used a questionnaire survey and obtained feedback from security section chiefs and physical security specialists to determine the reasons staff did not consistently comply with IRS's existing requirement to maintain an emergency contact list at all IRS facilities. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will establish a process to better enforce compliance with the requirement based on the results of the feedback obtained.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials establish and implement policies and procedures requiring that corrective actions be documented in the Alarm Maintenance and Testing Certification Report for malfunctioning alarms identified in the annual alarm tests. (Recommendation 19-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will (1) update the Internal Revenue Manual to reflect the requirement to use the Alarm Maintenance and Testing Certification Report to document alarm testing results, including any malfunctioning alarms and related corrective actions taken, as appropriate;, and (2) review the Alarm Maintenance and Testing Certification Report Form and incorporate any additional instructions and fields to document the specific alarms tested, the testing results, and related corrective actions taken, as appropriate.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement policies or procedures, or both, to provide reasonable assurance that the video surveillance systems at all IRS facilities record activity at the correct time and are properly secured. The policies or procedures should include periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment and systems. (Recommendation 19-05)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will develop, document, and implement policies or procedures, or both, to provide reasonable assurance of the accuracy and physical security of the video surveillance systems at all IRS facilities by including periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented. (Recommendation 19-06)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Information Technology and the Criminal Investigation organizations will update and implement their policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials (1) identify the reason IRS's policies and procedures related to the transmittal forms were not always followed and (2) design and implement actions to provide reasonable assurance that SB/SE units comply with these policies and procedures. (Recommendation 19-07)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that the Small Business/Self-Employed (SB/SE) Field Collection organization determined that the reasons the policies and procedures were not always followed were either a lack of understanding of the requirements or a lack of consistency in adhering to them. In order to address this, in October 2019, Field Collection distributed a memorandum to its area directors, territory managers, and group managers, reminding them of the required remittance processing procedures, emphasizing the importance of following the procedures, and requesting that they distribute the information in the memorandum within their organization. IRS officials stated that the memorandum will help assure that SB/SE Field Collection units comply with the applicable policies and procedures. Since this memorandum was issued after the end of our fiscal year 2019 audit, we will review the implementation of this action during our fiscal year 2020 audit. Further, IRS officials stated that during fiscal year 2020, the SB/SE Examination organization will identify the reason that IRS's policies and procedures for transmittal forms were not followed, and based on this, it will add guidance to the applicable Internal Revenue Manual sections to clarify and supplement the service-wide guidance for the appropriate control, monitoring, and review of the forms used to transmit packages containing personally identifiable information.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including specifying how the information should be validated. (Recommendation 19-08)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, the Information Technology (IT) organization updated IRS's Integrated Data Retrieval System (IDRS) security policy contained in the Internal Revenue Manual to ensure that the IDRS account administration process complies with IRS's personnel security policy regarding background investigation completion dates. In addition, IRS officials stated that by November 2020, the IT organization will update the Unit Security Representative (USR) designation form, as well as policies and procedures, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including how the information should be validated.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement procedures to clearly specify the tax refund data elements that PVS COs are required to verify before certifying the tax refunds in SPS. (Recommendation 19-09)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Information Technology organization updated its standard operating procedures to clearly specify the tax refund data elements that the Processing Validation Section Certifying Officers are required to verify before certifying the tax refunds in the Secure Payment System. Since IRS completed this action after we had already performed our fiscal year 2019 testing related to the certification of tax refunds, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement a review process to provide reasonable assurance that the RSNs that Data Conversion key entry operators enter into the ISRP system and post to the master files are correct. (Recommendation 19-10)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Wage & Investment organization will establish and implement a review process to provide reasonable assurance that the Refund Schedule Numbers on manual refund forms are transcribed accurately into the Integrated Submission and Remittance Processing system.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials implement a validity check in the ISRP system to confirm that RSNs that Data Conversion key entry operators enter into the system have the required 14 digits. (Recommendation 19-11)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS officials stated that the Wage and Investment organization agrees that developing and implementing a Unified Work Request for programming changes is needed to systemically validate the refund schedule numbers input into the Integrated Submission and Remittance Processing system; however, IRS officials indicated that the organization is unable to commit to implementing a corrective action because of budgetary constraints. As a result, IRS will place this recommendation on hold until funds are available.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to require that reviewers follow up with tax examiners to verify the errors that tax examiners made in working on cases related to suspicious or questionable tax returns are corrected. (Recommendation 19-12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by April 2020, IRS will update and implement policies or procedures, or both, requiring that reviewers follow up with tax examiners to verify that the errors tax examiners made in working a case related to suspicious or questionable tax returns are corrected.

Recommendation: The Director of OMB should take steps to update OMB guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: The Office of Management and Budget (OMB) neither agreed or disagreed with the recommendation but stated that it had no comments. In January 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: Once VA's new software for managing authorizations has been fully implemented, the Undersecretary for Health should monitor data on secondary authorization requests approval decision time frames to ensure VA medical facilities are in adherence with VA policy, assess the reasons for nonadherence with the policy, and take corrective actions as necessary. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA agreed with our recommendation and stated that it has already taken steps to improve compliance with secondary authorization request approval timeframes.by identifying challenges, agreeing on improvement actions, and providing training. According to VA, its new Health Share Referral Manager system, which VA expects will be fully implemented across all medical facilities by December 2019, will automate secondary authorization request reporting and tracking. According to VA, it will utilize this new system to ensure compliance with secondary authorization request approval time frames.

Recommendation: The Undersecretary for Health should collect data and monitor compliance with the Choice Program contractual requirements pertaining to customer service for community providers, and take corrective actions as necessary. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA agreed with our recommendation and stated that it currently does not have the ability to monitor and assess the performance of customer service operations under the Choice Program contracts. VA has included additional requirements for customer service in the Veterans Community Care Network request for proposals and plans to monitor compliance with these requirements under the Veterans Community Care Program. VA expects to implement this recommendation by December 2019.

Recommendation: The Secretary of Education should enroll loan servicers in FSA's continuous monitoring program and, in the interim, require these entities to report the results of security controls testing at an FSA-defined frequency. (Recommendation 1)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and the agency stated that loan servicers are scheduled to be enrolled in its ongoing security authorization program beginning in fiscal year 2019. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should enroll private collection agencies in FSA's continuous monitoring program, and, in the interim, require these entities to test all controls at an FSA-defined frequency and regularly report the results. (Recommendation 2)

Agency: Department of Education
Status: Open

Comments: FSA stated that it concurred with this recommendation, but the actions it said it planned to take would not fully address it. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should modify FSA's agreements with guaranty agencies to specify a required baseline of security controls based on the impact level of the information shared with these agencies, as determined by FSA. (Recommendation 3)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and described planned actions to address it. In November 2019, FSA officials told us that this recommendation has a pending date of 5/31/2020 for completion When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should establish a process for continuous monitoring of guaranty agencies' implementation of security and privacy requirements between on-site assessments, to include testing all controls at an FSA-defined frequency and regularly reporting results. (Recommendation 4)

Agency: Department of Education
Status: Open

Comments: FSA partially concurred with this recommendation and described actions it planned to take in response. However, we believe the entire recommendation is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should include specific security and privacy requirements in agreements with the Federal Family Education Loan (FFEL) Program lenders based on FSA's categorization of the information shared with the lenders. (Recommendation 5)

Agency: Department of Education
Status: Open

Comments: FSA stated that it partially agreed with this recommendation; however, if effectively implemented, the planned actions it described would address this recommendation. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should develop policies and procedures to gain assurance that FFEL lenders have appropriate security and privacy controls in place and that these controls are being regularly tested and monitored. (Recommendation 6)

Agency: Department of Education
Status: Open

Comments: FSA did not concur with this recommendation. However, we believe it is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: As MHS governing bodies conduct their recurring reviews of quality measures selected for MHS's Core Dashboard and Purchased Care Dashboards, the Assistant Secretary of Defense for Health Affairs should direct those bodies to prioritize, as appropriate, the selection of measures that apply to both direct and purchased care at the provider level and that expand the range of quality measure types and medical conditions that are assessed. (Recommendation 1)

Agency: Department of Defense: Office of the Assistant Secretary of Defense (Health Affairs)
Status: Open

Comments: As of January 2020, DOD officials described proposed actions to address key elements of our recommendation. Specifically, DOD officials described compiling a comprehensive library of existing inpatient and outpatient quality measures for both direct and purchased care; categorizing those measures by type and medical condition; and identifying 8 measures that are common across direct and purchased care. DOD stated it is considering expanding those 8 common measures to 12 measures. The new measures would cover three cancer screening measures and an additional inpatient satisfaction measure. However, DOD officials noted these 12 measures are not reported at the provider level for purchased care given current contract reporting requirements and would require contract modifications. DOD officials also said they are participating in an interagency partnership to use a common set of quality measures across federal programs, including under the Department of Veterans Affairs. Once those quality measures are determined, DOD may expand the range of quality measures common across direct and purchased care to be consistent with other federal programs. We will keep this recommendation open until DOD provides additional information on actions taken to select and expand quality measures across direct and purchased care.

Recommendation: The Assistant Secretary of Defense for Health Affairs should establish, as appropriate, performance standards related to the Purchased Care Dashboard measures that are consistent with the MHS's performance standards for direct care; ensure they are applied to individual purchased care providers; and take steps, such as amending its managed care support contracts, if necessary, to require corrective actions to be taken when providers do not meet those standards. (Recommendation 2)

Agency: Department of Defense: Office of the Assistant Secretary of Defense (Health Affairs)
Status: Open

Comments: As of January 2020, DOD officials said that once a common set of quality measures is adopted to the extent possible across direct and purchased care (as discussed in Recommendation 1), DOD plans to establish consistent performance standards applied to individual providers and plans to develop processes to issue corrective actions for individual direct and purchased care providers who do not consistently meet established standards. We will update this recommendation as DOD provides progress updates on the implementation of these plans.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA takes steps to work with Defense Finance and Accounting Service (DFAS)--DSCA's financial service provider--and other DOD components, as appropriate, to improve the reliability of the data the DSCA obtains on all DOD components' use of FMS administrative funds, including actual execution data, at an appropriate level of detail, such as by object class. (Recommendation 1)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In February and May 2019, DSCA informed us that it had taken some steps to implement this recommendation, including establishing an automatic interface with certain DOD components' accounting systems to provide DSCA with daily information and data on those components' actual spending of FMS administrative funds. DSCA noted that it is working toward establishing automatic interfaces for the other components that receive these funds. In October 2019, DSCA informed us that implementation is ongoing. As of August 2020, we continue to monitor DOD's ongoing actions to implement this recommendation .

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS to conduct regular reconciliations of the data that DSCA collects on DOD components' use of administrative funds, to help ensure that the data are reliable. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: In May 2019, DSCA noted that it is undertaking an initiative to incorporate reconciliation capabilities into its oversight of components' use of FMS administrative funds. In October 2019, DSCA informed us that efforts to implement this recommendation are ongoing. As of August 2020, we continue to monitor DOD's actions to implement this recommendation .

Recommendation: The Director of DSCA should follow its requirement to conduct at least two annual reviews of military department business processes for administrative funds. (Recommendation 3)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In October 2019, DSCA informed us that it had conducted two business process reviews for military departments in 2019. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation.

Recommendation: The Director of DSCA should conduct periodic (e.g., annual or biennial) reviews of other DOD components' (e.g., other than military departments) business processes for administrative funds, based on a risk-based approach. Such an approach could include consideration of whether an entity has received a prior review or representative sampling over time, as well as consideration of factors such as the results of prior audits or other identified risks. (Recommendation 4)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In October 2019, DSCA informed us that it planned to conduct one review for another DOD component (e.g., other than a military department) in fall 2019. In January 2019, it collaborated with other DOD components that receive FMS administrative funds to develop risk-based criteria for selecting components for periodic business process reviews . DSCA also provided updated policies and procedures for these reviews, which state that DSCA will conduct at least one review for another DOD component annually. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation.

Recommendation: The Director of DSCA should create and maintain a complete list of military department organizations or offices that receive administrative funds and are subject to DSCA's business process reviews. (Recommendation 5)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In May 2019, DSCA provided supporting documentation to show that, as part of its annual budget review cycle, it had required DOD components to provide a list of sub-components/organizations that receive FMS administrative funds. In October 2019, DSCA provided a list of sub-components/organizations that DSCA obtained as part of the 2019 annual budget cycle. As of August 2020, we continue to monitor DSCA's actions to implement this recommendation.

Recommendation: The Director of DSCA should update DSCA's policy for selecting military department organizations for reviews of their business processes for administrative funds, to better ensure that it reflects a risk-based approach. (Recommendation 6)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In May 2019, DSCA provided updated standard operating procedures for selecting military department organizations for reviews of their business processes for administrative funds. As of August 2020, we are reviewing the documentation provided and following up with DSCA to determine the extent to which the new procedures reflect a risk-based approach.

Recommendation: The Director of DSCA should clarify guidance to ensure that the DSCA officials conducting reviews of business processes for administrative funds periodically track action items until they are completed. (Recommendation 7)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it had updated its policies and procedures to reflect that it will track action items from business process reviews every 30 days, until the action items area completed. DSCA needs to providing supporting documentation for its efforts to track action items. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation .

Recommendation: The Director of DSCA should develop a process for conducting periodic (e.g., quarterly or annual), targeted reviews of DOD components' use of administrative funds, including transactions testing, to verify that actual costs incurred are allowable and approved. (Recommendation 8)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it was in the process of conducting "mock" audits of DOD components' use of FMS administrative funds, and that it was undergoing efforts to ensure that a process is in place for the financial review of components' actual spending of these funds. DSCA noted that these efforts were ongoing in October 2019. As of August 2020, we continue to monitor DSCA's ongoing efforts to implement this recommendation.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA takes steps to work with DFAS and other DOD components, as appropriate, to improve the reliability of the data that DSCA obtains on all DOD components' use of CAS funds, including actual execution data, at an appropriate level of detail, such as by object class. (Recommendation 9)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In February and May 2019, DSCA informed us that it had taken some steps to implement this recommendation, including establishing an automatic interface with certain DOD components' accounting systems to provide DSCA with daily information and data on those components' actual spending of FMS CAS funds. DSCA noted that it is working toward establishing automatic interfaces for the other components that receive these funds. In October 2019, DSCA informed us that implementation is ongoing. As of August 2020, we continue to monitor DOD's ongoing actions to implement this recommendation.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS to conduct regular reconciliations of the data that DSCA collects on DOD components' use of CAS funds, to help ensure that the data are reliable. (Recommendation 10)

Agency: Department of Defense
Status: Open

Comments: In May 2019, DSCA noted that it is undertaking an initiative to incorporate reconciliation capabilities into its oversight of components' use of FMS CAS funds. In October 2019, DSCA informed us that efforts to implement this recommendation are ongoing. As of August 2020, we continue to monitor DOD's actions to implement this recommendation

Recommendation: The Director of DSCA should develop a process for conducting periodic (e.g., quarterly or annual), targeted reviews of DOD components' use of CAS funds, including transactions testing, to verify that actual costs incurred are allowable and approved. (Recommendation 11)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it was in the process of conducting "mock" audits of DOD components' use of FMS CAS funds, and that it was undergoing efforts to ensure that a process is in place for the financial review of components' actual spending of these funds. As of October 2019, DSCA noted that these efforts were ongoing. As of August 2020, we continue to monitor DSCA's ongoing efforts to implement this recommendation.

Recommendation: The Commissioner of CBP should develop a monitoring system to help ensure that CBP officials comply with license verification policies and procedures. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a monitoring system that observes agency verification of licenses for imported radiological materials to ensure CBP officials are complying with existing policies and procedures.

Recommendation: The Commissioner of CBP should develop a system that better identifies shipments of radiological material that pose the greatest risk and revise CBP's policies and procedures as necessary to verify licenses for these shipments. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a system to better identify which shipments of radiological material pose the greatest risk and revise their policies and procedures for verification of the licenses for these shipments accordingly.

Recommendation: The Commandant of the Coast Guard should either develop new performance goals to address mission activity gaps, or explain in the Coast Guard's Annual Performance Report (APR) why certain aspects of mission performance are measured while others are not. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In October 2017, the Coast Guard concurred with our recommendation and stated that it would add new measures in future Annual Performance Reports (APRs) and explain what is measured and what is not, as appropriate. In May 2020, the Coast Guard provided GAO with its updated fiscal year 2019 APR. After reviewing the fiscal year 2019 APR, we found that the Coast Guard made revisions to the goals for the Ports, Waterways, and Coastal Security (PWCS) and Marine Environmental Protection-prevention activities (MEP) missions and added a goal for the Search and Rescue mission. However, the APR did not include additional goals or an explanation why certain aspects of mission performance are measured while others are not for the other performance goals we previously identified as not fully addressing all related mission activities. In its July 2020 update to this recommendation, the Coast Guard reported that the metrics published in the APR are measures of Coast Guard performance and not performance goals. The Coast Guard also noted that it continually evaluates the utility of its performance measures, and makes changes to individual measures, as well as its suite of measures, when doing so provides meaningful improvement. In its July 2020 update, the Coast Guard added that targets established for performance measures are intended to be realistic expectations of future performance and targets are continually evaluated and changed when current performance modify expectations. However, we continue to believe that in the absence of documentation explaining how existing performance goals address each mission, the extent to which the Coast Guard's performance goals encompass all of its mission activities is unclear. Either developing new goals to address mission activity gaps, or describing in the APR how existing goals sufficiently assess the performance of each mission could provide more meaningful information on progress in achieving Coast Guard's missions to executive branch decision makers, Congress, and the public. In order to fully implement the recommendation as intended, in instances in which performance goals do not fully address all of the respective mission activities, the Coast Guard's APR should include an explanation of the Coast Guard's rationale for why certain aspects of mission performance are measured while others are not. We will continue to follow-up on the Coast Guard's efforts to address this recommendation.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to take steps needed to ensure that system requirements are defined to align with the business needs of CNCS's future risk-based grants monitoring process (Recommendation 1).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the Grants and Member Management (GMM) system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a commercial off-the-shelf (COTS) application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet defined requirements for the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to ensure that the system development project schedule identifies in the baseline both planned and actual dates for completing all project-level activities, and can be used to monitor and measure progress of the grant monitoring system project (Recommendation 2).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the GMM system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a COTS application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet established a project schedule for completing the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to ensure that test plans are defined and implemented to include the second version of the grant monitoring system in all stages of testing during development, and results of initial stages are approved before conducting subsequent test stages (Recommendation 3).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the GMM system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a COTS application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet established a timeframe to define test plans for the selected solution for the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: The Secretary of the Army should direct the Accountability and Audit Readiness Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to enhance the directorate's policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs.

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. The Army stated that the Accountability and Audit Readiness Directorate has completed actions to enhance its current standard operating procedures to include (1) updating its corrective action plan (CAP) database and reporting tool, (2) documenting its reporting procedures, and (3) updating its CAP template to include additional elements recommended by the Implementation Guide for OMB Circular A-123. In addition, the Army stated that its policies and procedures include steps to incorporate external financial management-related audit findings assigned to the Accountability and Audit Readiness Directorate by the Internal Review Directorate and that the existing process the Army uses to prioritize findings and the related CAPs and to monitor the progress and status of CAPs has been documented. We reviewed Army's documentation that was provided in January 2020. Army's documentation did not show that it has a process for ensuring that all financial management related findings and recommendations are identified and tracked. To implement this recommendations Army needs to enhance their policies and procedures related to tracking and monitoring the status of these audit findings.

Recommendation: The Secretary of the Air Force should design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that it continues to develop a process for identifying and tracking financial management-related findings and recommendations from all audit sources by updating its process guidance. In August 2019, we received draft guidance that Air Force is developing as guidance and procedures for a universe of financial management-related findings and recommendations. In January 2020, we also received a list of the Air Force deficiencies being tracked in the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database. After assessing the provided documentation, we found that the draft does not include procedures for identifying GAO, DODOIG, and Air Force Audit Agency (AFAA) findings and the database did not include deficiencies identified by those external auditors. As a result of our review of the documentation provided, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: The Secretary of the Air Force should update the Air Force's written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources and for developing and monitoring CAPs so that they include sufficient details. These procedures should include the following details: (1) The process to be followed for prioritizing the financial management-related findings and recommendations from audit sources. (2) The guidance for developing CAPs for all financial management-related audit findings and recommendations from all audit sources to include complete details, including the elements recommended by the Implementation Guide for OMB Circular A-123. (3) The process for monitoring the status of the CAPs for all financial management-related audit findings and recommendations from all audit sources, including the documentation to support any corrective actions taken, as recommended by the Implementation Guide for OMB Circular A-123.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that its Air Force Deficiency Remediation Tracking processes and guides were being refined. In December 2019, Air Force provided a document titled "NFR Prioritization Process." We found that this document included Air Force's priority categories. However, the document does not include information on determining the priority level or applying the priority levels when addressing the deficiencies. We also received a copy of Air Force's guide for the Corrective Action Plan (CAP) process dated July 2019. We found that this guide does not fully incorporate CAP development for deficiencies from all sources. Additionally, the guide does not provide information on the process for (1) determining resources and other requirements for remediating the deficiency, (2) conducting a cost benefit analysis, and (3) developing criteria for validating that the deficiency has been remediated. The guide also includes a template for conducting a root cause analysis. However, the instructions for conducting a root cause analysis are somewhat limited for determining the initial cause or underlying reason for the deficiency. Per the guide, the Air Force uses the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database to monitor and report on Air Force's deficiencies and remediation CAP status. We obtained a listing of the NFRs and related CAPS in the database as of December 2019. We found that deficiencies from all audit sources were not included in the listing, only the independent public accountant's NFRs. The results of our review of a limited number of CAPs indicate that Air Force staff does not always comply with the Air Force's CAP requirements. As a result of our assessment of the Air Force documentation, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: To improve DOD management's process for monitoring the military services' audit remediation efforts and to provide timely and useful information to stakeholders as needed, the Secretary of Defense should direct the Secretary of the Army, the Secretary of the Navy, and the Secretary of the Air Force to prepare and submit to the Under Secretary of Defense (Comptroller), on at least a bimonthly basis for availability at the FIAR Governance Board meetings, a summary of key information included in the CAPs that at a minimum contains the data elements recommended by the Implementation Guide for OMB Circular A-123 for each CAP related to critical capabilities for achieving audit readiness.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation. DOD stated that it solicits input on a bi-monthly basis, on critical capability corrective action plans (CAPs) at a summary level. This information is provided routinely at regularly scheduled FIAR Governance Board meetings. DOD also stated that an updated notice of finding and recommendation (NFR) form template is being developed and will be provided to the military services to use for reporting this information so that it will include the recommended standard data elements outlined in OMB Circular A-123 to provide greater transparency into the nature of remediation plans. DOD also stated that FIAR Guidance will be updated to explicitly state that military services should include the OMB recommended standard data elements in CAPs. To implement this recommendation, DOD needs to provide documentation that shows that the military services are able to provide a summary of key information in the corrective action plans that at a minimum contains data elements recommended by the Implementation Guide for OMB Circular A-123. .

Recommendation: To reasonably assure that DOD management and external stakeholders have a comprehensive picture of the status of corrective actions needed for audit readiness throughout the department, the Secretary of Defense should direct the Under Secretary of Defense (Comptroller) to prepare a consolidated CAP management summary on a bimonthly basis that includes the data elements referred to above on the status of all CAPs related to critical capabilities for the military services and for the service providers and other defense organizations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD partially concurred with this recommendation. According to DOD, the military services already provide summary-level updates on their critical capability corrective action plans (CAPs) at FIAR Governance Board meetings. It also stated that the template that is used to present CAPs to the FIAR Governance Board meetings at the summary level has been updated to align CAPs to critical capabilities. DOD still needs to address how all of the data elements from the Implementation Guide for OMB Circular A-123 will be summarized or otherwise reported for all CAPs pertaining to critical capabilities across the Department. In addition, DOD stated that because the Under Secretary of Defense (Comptroller) takes responsibility for maintaining, monitoring, and reporting on the status of CAPs for the service providers and other defense organizations and of DOD-wide issues, the Comptroller will also summarize this information. However, DOD has not clarified what information from the military services will be summarized. To implement this recommendation, DOD needs to provide documentation that shows the Comptroller has prepared a consolidated CAP management summary on a bimonthly basis.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to determine the reason(s) why staff did not always comply with IRS's established policies and procedures related to initiating, monitoring, and reviewing the monitoring of manual refunds and, based on this determination, establish a process to better enforce compliance with these requirements.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, we identified instances where staff did not comply with IRS's policies and procedures related to monitoring and reviewing the monitoring of manual refunds. IRS officials stated that the Wage and Investment (W&I) organization determined that a fully automated process to perform monitoring of manual refunds is the optimal solution to address, at an enterprise level, deficiencies associated with reliance on employees to monitor refunds in process and take appropriate action when potential duplicate or erroneous refund conditions are encountered. In addition, IRS officials indicated that the W&I organization will develop business requirements and request programming through the Unified Work Request process; however, limited resources and competing priorities prevent the identification of an implementation date. As a result, IRS will place this recommendation on hold until an implementation date is known.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to identify the cause of and implement a solution for dealing with the periodic backlogs of ICO inventory that is hampering the performance of quality reviews.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Wage and Investment (W&I) organization determined that periodic backlogs of Input Correction Operation (ICO) inventory were caused by a combination of factors, such as systemic issues, fluctuations in projected filings, and hiring challenges. IRS officials stated that the W&I organization has also identified and implemented several strategies to address ICO backlogs and mitigate the impact on the quality review program, including hiring more staff in ICO functions, using seasonal employees, cross-training, overtime, transferring of work, and updating the Internal Revenue Manual. Since IRS provided us with this information near the end of our fiscal year 2019 audit in September 2019, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The IRS Commissioner should direct the appropriate officials to establish and implement monitoring procedures designed to reasonably assure that the key detailed information for tangible capitalized P&E is properly recorded and updated in the KISAM system.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS established the Asset Management Program Monitoring and Review procedure, effective October 1, 2016, for performing quarterly sample reviews of Information Technology (IT) assets in the Knowledge, Incident/Problem, Service Asset Management (KISAM) system. In September 2017, IRS also revised the Internal Revenue Manual to require Facilities Management and Security Services territory managers or section chiefs to review KISAM key data elements for non-IT assets to verify that they are correct and updated. However, during our fiscal year 2018 floor-to-book inventory testing, we identified exceptions where (1) a key detailed information element (e.g., building code) for property and equipment (P&E) assets was not properly recorded in KISAM and (2) P&E assets found on the floor did not have asset records in KISAM. We will conduct inventory testing and follow-up to determine the status of this issue during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: To address the limitations of existing distribution performance metrics, the Secretary of Defense should direct the Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with TRANSCOM, to revise guidance to ensure that a customer wait time standard is established and used for the Marine Corps.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In September 2016, the Marine Corps established a Customer Wait Time (CWT) standard and developed CWT metrics that are in alignment with DOD policy. These changes were to be incorporated into Marine Corps policy through their normal Service procedures. As of August 2020, the Marine Corps has the CWT standard included in its new policy document, but the policy is going through internal coordination and is still in draft at this time. Current timeframe for publication is January 2021. Once we confirm the CWT standard is in the issued policy, we will close the recommendation.

Recommendation: To better ensure that FBI whistleblowers have access to recourse under DOJ's regulations should the individuals experience retaliation, and to minimize the possibility of discouraging future potential whistleblowers, the Attorney General should clarify in all current relevant DOJ guidance and communications, including FBI guidance and communications, to whom FBI employees may make protected disclosures and, further, explicitly state that employees will not have access to recourse if they experience retaliation for reporting alleged wrongdoing to someone not designated in DOJ's regulations.

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: In response to our report, in December 2016, Congress passed and the President signed the FBI Whistleblower Protection Enhancement Act of 2016, Pub. L. No. 114-302, which, among other things, provides a means for FBI employees to obtain corrective action for retaliation for disclosures of wrongdoing made to supervisors and others in the employees' chain of command. Following this, the FBI worked closely with the Department of Justice's Office of Inspector General (DOJ-OIG) to develop a training that clearly identifies to whom FBI employees may make protected disclosures. In addition, the FBI issued an aligned policy directive and two fact sheets detailing whistleblower rights. In October 2018, a DOJ official reported to us that the department was in the process of updating its regulations and, in February 2020, DOJ officials confirmed that the updated regulation was in the departmental clearance process but they could not provide an estimate for when it would be finalized. As a result, as of February 2020, DOJ's regulations have not been updated and are inconsistent with the current statute and FBI's guidance and training; as such, the problem of unclear or conflicting guidance to FBI employees still needs to be addressed. To address this recommendation, DOJ would need to update its regulations and ensure that all relevant guidance is clear and consistent across the department.

Recommendation: To help ensure that HHS is adequately and comprehensively assessing HPP and PHEP awardees' performance and progress in meeting the medical and public health preparedness goals of the cooperative agreements, the Secretary of Health and Human Services should direct ASPR and CDC to develop objective and quantifiable performance targets and incremental milestones that correspond to the new HPP and PHEP performance measures, against which HHS can gauge progress toward the medical and public health preparedness goals of the cooperative agreements and direct technical assistance, as needed.

Agency: Department of Health and Human Services
Status: Open

Comments: Since we examined the HPP and PHEP cooperative agreements in 2012, ASPR had developed few targets for the HPP program measures or their corresponding indicators that were contained in the HPP performance measurement guidance documents issued for Budget Periods (BP) 2-5, ending June 30, 2017. Additionally, the new HPP performance measure implementation guidance for the 5-year project cycle from 2017-2022 introduces 28 performance measures, with few having targets; the guidance notes that corresponding goals or targets may be set at a later date after data from the first budget period of this new project cycle has been reviewed. Regarding PHEP, CDC had developed performance targets for about half of the performance measures as of the PHEP BP5 performance measurement guidance (BP5 ended June 30, 2017). These performance measures generally remain the same, with existing targets, for BP1 (July 1, 2017-June 30, 2018) of the new 5-year budget cycle. GAO recognizes that it may not be appropriate to develop performance targets for every performance measure depending on the desired process or outcome; however, both agencies still have work to do in this area. In November 2017, both ASPR and CDC officials noted that they could not commit to setting consistent targets with incremental milestones over a budget cycle and therefore could not implement the recommendation. As of August 2018, there was no change from the agencies' position that they do not have plans to fully implement the recommendation at this time.

Recommendation: To help ensure that HHS is adequately and comprehensively assessing HPP and PHEP awardees' performance and progress in meeting the medical and public health preparedness goals of the cooperative agreements, the Secretary of Health and Human Services should ensure that performance measures and targets remain consistent across the 5-year project cycle and that any future measures be comparable to determine whether awardees are making progress toward meeting short- and long-term medical and public health preparedness goals of the cooperative agreements.

Agency: Department of Health and Human Services
Status: Open

Comments: Since we first examined the HPP and PHEP cooperative agreements in 2012, ASPR and CDC had made efforts to maintain consistency in their performance measures, particularly in the last 3 years of the prior project cycle which ended June 30, 2017. However, because part of the recommendation includes consistency of performance measures into future project cycles, we also examined whether both cooperative agreements continued to use basically the same performance measures into the current 5-year cycle, which began July 1, 2017. ASPR's HPP has made a significant change in its performance measures, introducing a new set of 28 performance measures for this new 5-year cycle. CDC's PHEP performance measures generally remained consistent in the last two budget periods of the prior 5-year cycle, and remained generally the same for the first year of the new 5-year cycle (some measures were "retired," though key components from a measure may continue to be used by CDC in other types of reviews). Additionally, in November 2017, both CDC and ASPR officials noted that they may need to continue to adjust the performance measures during the new 5-year cycle. As of August 2018, as a result of the change to HPP's measures and the agency statements in November 2017, GAO anticipates keeping this recommendation open at least for the next few budget periods, in order to determine whether the agencies maintain consistency with the performance measures during the new project cycle.

Recommendation: The Commissioner of Internal Revenue should direct the appropriate officials to define and implement a process, including defined criteria, for reselecting ongoing projects.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In March, 2017, IRS issued its Portfolio Investment Plan Process Description Manual for selecting and prioritizing new and ongoing operations support activities. The manual includes criteria for prioritizing selections; and provides for comparing assets against one another to create a prioritized portfolio; and ensuring executives' funding decisions are based upon the process for selecting and prioritizing activities. In March 2018, IRS updated the manual and also issued related detailed procedures. In May 2019, IRS stated that its Information Technology/Strategy and Planning group had developed a prioritization process and associated scoring criteria to help facilitate decision making for business systems modernization programs, projects, and capabilities. The agency noted that improvements were being made to the process and full implementation was anticipated for June 2019.In April 2020, IRS informed us that it had moved its target for fully implementing the recommendation to November 2020. We will continue to monitor IRS's efforts to implement the recommendation.

Recommendation: To ensure sufficient follow-up to DOD's corrosion study, the Secretary of Defense should direct the USD (AT&L) to document program-specific recommendations flowing from the corrosion study with regard to the other weapon systems identified--specifically, the Expeditionary Fighting Vehicle, CH-53K helicopter, Joint High Speed Vessel, Broad Area Maritime Surveillance Unmanned Aircraft System, and the Joint Light Tactical Vehicle--and establish a process for monitoring and assessing the effectiveness of the CPC programs for these systems.

Agency: Department of Defense
Status: Open

Comments: As of September 2015, DOD had not documented program-specific recommendations from the corrosion study for the other weapon systems identified in its report. However, DOD updated its Corrosion Prevention and Control Planning Guidebook in 2014 and, according to officials, is working to update DOD Instruction 5000.67, Prevention and Mitigation of Corrosion on DOD Military Equipment and Infrastructure. These actions may improve the corrosion prevention and control planning for the weapon systems identified in DOD's study. DOD partially concurred with this recommendation at the time of our report but as of March 2019, has since decided to take action to implement it. According to Corrosion Office officials, they interacted with two of five weapon-systems programs on corrosion-related matters. One of these weapon-system programs, per Corrosion Office officials, was eventually canceled. In addition to updating the Corrosion Prevention and Control Planning Guidebook for Military Systems and Equipment in 2014, officials stated that they are planning to further update DOD Instruction 5000.67 (Prevention and Mitigation of Corrosion on DOD Military Equipment and Infrastructure). Also, according to Corrosion Office officials, procedures for evaluating acquisition programs will be included in the new DOD manual on corrosion. The Corrosion Office's goal of completing this instruction update and creating the new manual is by the end of calendar year 2020. We will monitor the extent to which DOD implements this recommendation.

Recommendation: To ensure sufficient follow-up to DOD's corrosion study, the Secretary of Defense should direct the USD (AT&L) to document Air Force-and Navy-specific recommendations flowing from the corrosion study and establish a process for monitoring and assessing the effectiveness of these services' corrective actions.

Agency: Department of Defense
Status: Open

Comments: As of September 2015, DOD had not documented Air Force- and Navy-specific recommendations flowing from the corrosion study. However, DOD updated its Corrosion Prevention and Control Planning Guidebook in 2014 and, according to officials, is working to update DOD Instruction 5000.67, Prevention and Mitigation of Corrosion on DOD Military Equipment and Infrastructure. Further, the Air Force and the Navy have both taken actions to address the DOD-wide recommendations from the corrosion study. These actions may improve corrosion prevention and control planning for Air Force and Navy programs. As of March 2019, Corrosion Office officials stated that they are planning to further update DOD Instruction 5000.67 (Prevention and Mitigation of Corrosion on DOD Military Equipment and Infrastructure) or other appropriate guidance related to the process or procedures for monitoring and assessing the effectiveness of Corrosion Prevention Control planning for weapon systems, particularly related to how the military services will accomplish this within their increased weapon system oversight role. In addition, per Corrosion Office officials, this information will be addressed in the new DOD manual on corrosion. The Corrosion Office's goal to complete this instruction update and create the new manual by the end of calendar year 2020. We will monitor the extent to which DOD implements this recommendation.

Recommendation: The Secretary of the Interior should direct the Deputy Assistant Secretary for Insular Affairs to develop a framework for OIA employees to use in conducting site visits to help ensure objectives are achieved, to assure that relevant information is shared with responsible officials, and to allow more efficient and effective monitoring of issues.

Agency: Department of the Interior
Status: Open

Comments: On May 24, 2017, the Department of Interior (DOI) sent out an email to its staff showing the dissemination of the new format required for completing trip reports by the staff of the Office of Insular Affairs (OIA). The new format requires staff to include travel justification (i.e., purpose/objective, location, and travel period) and trip report (i.e., meetings, site visits, results, and next steps, as applicable.) The intent of the recommendation is for DOI to have a framework that includes (1) status of required single audit reports; (2) the progress of actions to resolve reported internal control weaknesses; and (3) current needs for technical assistance, capacity building, and staff level expertise. Further, the intent of GAO's recommendation is that this information be integrated into a comprehensive monitoring process. We did not see these elements included in DOI's new format. At present, the agency has been unable to provide additional information that supports the development of a framework for conducting sites visits that incorporates procedures about how information will be shared and monitored. In August 2020, the agency informed us that it has taken additional corrective actions some time ago and is in the process of trying to locate the supporting documentation. We will continue to monitor the agency's actions to address this recommendation.