Recommendation: The Inspector General of the IC should establish specific timeliness objectives for completing investigations conducted by the OIG of the IC. (Recommendation 1)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of the IC should establish a time frame to finalize revisions to the OIG's investigations manual. (Recommendation 2)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of the IC should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 3)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of the IC should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 4)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of the IC should develop a process to facilitate external quality assurance reviews of other IC-element OIGs' investigations divisions. (Recommendation 5)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of the IC should ensure that as the ICIG finalizes its draft investigations procedures and investigator training plan, these documents provide an approach that systematically links the requisite knowledge, skills, and abilities and training requirements throughout an investigator's career progression. (Recommendation 6)

Agency: Office of the Director of National Intelligence: Office of the Inspector General of the Intelligence Community
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of CIA should establish a time frame to finalize revisions to the OIG's investigations manual. (Recommendation 7)

Agency: Central Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of CIA should establish a process to regularly review and update the OIG's investigative manual and policies. (Recommendation 8)

Agency: Central Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of CIA should implement routine internal quality assurance reviews as part of the quality assurance program for the OIG's investigations divisions consistent with CIGIE standards and guidance. (Recommendation 9)

Agency: Central Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of DIA should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 10)

Agency: Department of Defense: Defense Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of DIA should implement routine external quality assurance reviews in the quality assurance program for the OIG's investigations division consistent with CIGIE standards. (Recommendation 11)

Agency: Department of Defense: Defense Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of DIA should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case file, as required by OIG policy. (Recommendation 12)

Agency: Department of Defense: Defense Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NGA should establish specific timeliness objectives for completing investigations conducted by the OIG of NGA. (Recommendation 13)

Agency: Department of Defense: National Geospatial-Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NGA should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 14)

Agency: Department of Defense: National Geospatial-Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NGA should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case file, as required by OIG policy. (Recommendation 15)

Agency: Department of Defense: National Geospatial-Intelligence Agency: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should establish a time frame to finalize the OIG's draft investigations manual. (Recommendation 16)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 17)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should continue to develop and implement a quality assurance program for the OIG's investigations division, which should incorporate routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 18)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should consider making the use of documented investigative plans a requirement for all investigations. (Recommendation 19)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should revise its training plan to provide an approach that systematically links the requisite knowledge, skills, and abilities to training requirements throughout an investigator's career progression. (Recommendation 20)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NRO should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case files, as required by OIG policy. (Recommendation 21)

Agency: Department of Defense: National Reconnaissance Office: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NSA should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 22)

Agency: Department of Defense: National Security Agency/Central Security Service: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Inspector General of NSA should develop an investigator training plan that provides an approach that systematically links the requisite knowledge, skills, and abilities to training requirements to an investigator's career progression. (Recommendation 23)

Agency: Department of Defense: National Security Agency/Central Security Service: Office of the Inspector General
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of FinCEN should develop and implement written policies and procedures to help promote the greater use of BSA reports by law enforcement agencies that do not have direct access to the BSA database. Such policies and procedures could include outreach strategies and educational or training materials. (Recommendation 1)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. (Recommendation 1)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. (Recommendation 4)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to develop and maintain a comprehensive systems inventory that incorporates sufficient, reliable information about the external entities with which HUD program information is shared and the extent to which each external entity has access to PII and other sensitive information. (Recommendation 5)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of VA should improve the completeness and accuracy of use of force data in Report Executive by addressing (1) incomplete categorization of the type of force used, (2) inaccurate data on the highest level of force used, and (3) the potential for duplicate data entries. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of VA should implement plans to include analytical features in Report Executive that will position the agency to analyze use of force data at VA medical centers nationwide, including by officer; type of force used; and facility, among other variables. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of VA should ensure that medical centers submit records of all locally initiated use of force investigations and any resulting disciplinary action to VA headquarters office(s) with responsibility for police oversight. (Recommendation 3)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of VA should implement plans for obtaining a quality database to collect all locally initiated use of force investigations at medical centers. (Recommendation 4)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Once positioned to do so, the Secretary of VA should analyze all use of force investigations and any resulting disciplinary action by facility; officer; and outcome, among other variables. (Recommendation 5)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Division Director for Risk Management Supervision (RMS) should require case managers to document how high-risk areas in the scoping plan were considered by the examination team if they were not addressed in the examination report. (Recommendation 1)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Division Director for RMS should implement policies to require that higher-level managers review case managers' documentation that describes whether banks have fully addressed MRBAs. (Recommendation 2)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Division Director for RMS should revise examination documentation retention policies to increase the retention period beyond one examination cycle for banks with satisfactory or better composite ratings. (Recommendation 3)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FDIC Chairman should direct RMS and the Legal Division Ethics Unit to develop a process for systematically requesting and collecting information on where departing examiners, including examiners-in-charge, enter into employment after leaving FDIC. (Recommendation 4)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances Treasury's procedures for the aggregate analysis to consider the impact of all amounts not obtained from significant entity audited financial statements on the reliability of the CFS and use the results to determine if audit coverage is needed for any information. (Recommendation 1)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it has already taken steps to address this recommendation by updating guidance to federal entities for the preparation of the fiscal year 2020 Agency Financial Reports or Performance and Accountability Reports. In addition, Treasury stated that it has drafted a memo to the Federal Accounting Standards Advisory Board to seek clarification of existing guidance related to reporting differences for federal entities that prepare financial reports according to FASB standards.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances Treasury's process for revising accounting and reporting policies to reasonably assure that financial information—including the SOCNP, Funds from Dedicated Collections note, and Other Liabilities note—is prepared in accordance with U.S. GAAP and sufficiently documented to allow effective management review. (Recommendation 2)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it has already taken steps to address this recommendation by updating guidance to federal entities for the preparation of the fiscal year 2020 Agency Financial Reports or Performance and Accountability Reports.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances existing procedures to reasonably assure that disclosures for financial information incorporated using accounting standards issued by FASB are prepared in accordance with U.S. GAAP, such as improving (1) the quantitative analysis to consider all FASB information included in the CFS, (2) the FASB questionnaire to consider all relevant disclosures and obtain responses from all significant component entities, and (3) procedures for sufficiently documenting analyses and conclusions related to FASB information in the CFS. (Recommendation 3)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it drafted a memo to the Federal Accounting Standards Advisory Board to seek clarification of existing guidance related to reporting differences for federal entities that prepare financial reports according to FASB standards.

Recommendation: The Director of OMB should take steps to ensure that federal agencies implement its guidance on agency adherence to E.O. 13132 requirements, particularly related to designating a federalism official. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should fully define in VHA policy the oversight roles and responsibilities related to ensuring facilities' adherence to disbursement agreement policies, including roles related to ReDPro and the role of VISNs. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should more clearly define in VHA policy the purposes of the periodic independent audits and the ReDPro checklist reviews—including differentiating their purposes from one another and ensuring that they do not unnecessarily overlap. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure that OAA and CBI modify the ReDPro checklist and associated guidance, to include ensuring that checklist items are clearly stated, relevant to the updated purpose of the ReDPro checklist, and not unnecessarily duplicative of items to be addressed by the periodic independent audits. The guidance should also include detailed instruction on what the compliance officers should review, and how they should determine the appropriate response for each checklist item. (Recommendation 3)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure that OAA and CBI develop and provide additional ReDPro training for compliance officers, consistent with the updated checklist and guidance. This training should include general information on GME programs and disbursement agreement oversight, as well as detailed information about how ReDPro reviews should be conducted. (Recommendation 4)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure that OAA implements a standardized independent audit tool that is consistent with the updated purpose of the periodic independent audits, and does not unnecessarily overlap with the ReDPro checklist. This could include modifying its existing recommended checklist, or developing a new tool. (Recommendation 5)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure that OAA develops guidance for periodic independent audits to assist the audit teams and facility management in understanding how audits are to be conducted. (Recommendation 6)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure that OAA develops substantive training for independent audit team members, consistent with the updated audit purpose, guidance, and tools. This training should include general information on GME programs and disbursement agreement oversight, as well as detailed information about how the independent audits should be conducted. (Recommendation 7)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Air Force should develop and implement procedures for an ERM governance structure that includes oversight responsibilities for identifying, assessing, responding to, and reporting on the risks associated with agency material weaknesses from all relevant sources. These procedures should clearly demonstrate that risks associated with material weaknesses are considered by Air Force governance, as a whole, and are mitigated appropriately to achieve goals and objectives. (Recommendation 1)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and highlighted steps taken or planned to address this recommendation. Specifically, in FY19, the Air Force assessed the current-state of the risk management programs throughout the Air Force and developed a maturity model, implementation plan, and a governance structure to comply with OMB A-123 requirements. These enhancements will be implemented and formalized in policy in FY20. Further, beginning in FY19, the Air Force Senior Assessment Team (SAT) and the Senior Management Council (SMC) monitored corrective action plans for material weaknesses identified internally and by independent public accountants, including their impact on the Air Force's ability to achieve its enterprise objectives. In addition, the Air Force developed a process for the SAT and the SMC to discuss corrective action plans for material weaknesses on a quarterly basis as opposed to an annual basis, which will be evidenced in the form of board briefings and meeting minutes. Additionally, in FY19 the Air Force engaged the Enterprise Productivity Improvement Council to serve as the Air Force Risk Management Council (RMC) to oversee enterprise risk management as defined by their Charter, which was signed in February 2020. The Air Force will refine its policies and procedures to clearly specify the risks associated with the material weaknesses being addressed by the Air Force governance boards. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require (1) clearly delineating who within the Air Force is responsible for evaluating the internal control components and principles, how often they are to perform the evaluation, the level (e.g., entity or transactional) of the evaluation, what objectives are covered in the assessment, to whom to communicate the results if they are relevant to others performing assessments of internal control, and what guidance to follow; (2) documenting management's determination of whether each component and principle is designed, implemented, and operating effectively; and (3) documenting management's determination of whether components are operating together in an integrated manner. (Recommendation 2)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address the recommendation. The Air Force SAF/FM performs both entity-level control assessments against all internal control components and principles and performs process level control assessments for internal controls over financial reporting and financial systems. The Air Force Audit Agency and the Air Force Inspector General have performed assessments related to operations and compliance. The Air Force will document those roles and responsibilities in formal policies. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require the use of test plans that (1) tie back to specific objectives to be achieved as included in the Business Operations Plan; (2) specify the nature, scope, and timing of procedures to conduct under the OMB Circular No. A-123 assessment process; and (3) reflect a consideration of prior year self-identified control deficiencies and results of internal and external audits. (Recommendation 3)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address this recommendation. The Air Force test plans for internal controls over financial reporting and financial systems tie back to their relevant risk frameworks embedded in authoritative audit guidance. The framework used for financial reporting is the Financial Audit Manual, and the framework used for financial systems is the Federal Information Systems Controls Audit Manual, and include the nature, scope and timing of procedures performed. The Air Force's process-level internal control test plans are aligned with business process-level risks and objectives and are not directly associated with the Air Force's strategic objectives. The Air Force Business Operations Plan identifies strategic objectives, not business process-level objectives. Additionally, the Air Force considers previously identified internal control deficiencies in its annual documented internal control assessment scoping process. The Air Force will refine its policies and procedures regarding the use of test plans including operational and compliance controls. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to validate (1) the number of organizational units reporting for its overall internal control assessment; (2) how control procedures were tested, what results were achieved, and how conclusions were derived from those results; and (3) whether the results used to compile the current year report are based on current fiscal year's assessments. (Recommendation 4)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will design policies and procedures to determine assessable units and verify that results are current on an annual basis. Due to the need to reevaluate the Air Force's assessable unit structure and the associated change management that will be necessary to implement the changes to sustain an effective program, the Air Force plans to refine the policies by September 2021 and publish the policies by September 2022.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to assess how waivers affect the current year assessment of internal control, the determination of systemic weaknesses, and the compilation of the Air Force's overall Statement of Assurance. (Recommendation 5)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will design policies and procedures to consider the impact of waivers to the overall assessment of the system of internal control. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should require that developers of the policy and related guidance associated with designing the procedures for conducting OMB Circular No. A-123 assessments receive recurring training and are appropriately skilled in conducting internal control assessments and are familiar with Standards for Internal Control in the Federal Government. (Recommendation 6)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address the recommendation. Specifically, the Air Force is implementing multiple changes to the Air Force's ERM and internal control program, including improved governance, standardized processes and documentation for enterprise risk management, entity-level and process-level controls, training, fraud risk management, and data quality management. Training content in FY20 was updated to reflect additional information, including definitions for internal controls and considerations for determining material weaknesses for operations. The Air Force will continue to update its the policies, guidance, and training to coincide with the current progress of the program. The Air Force will continue to refine the audience of its training to verify that those responsible for implementing and assessing ERM and internal controls are trained sufficiently. Due to the need for policy, procedure, documentation, and training updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, documentation, and training by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should analyze all definitions included in Air Force ERM and internal control assessment policy and related guidance to ensure that all definitions and concepts are defined correctly. (Recommendation 7)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will verify that all definitions and concepts in its policies are current and consistent with other authoritative guidance. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should require SAF/FM to design recurring training for those who will assess internal control that (1) includes enhancing their skills in evaluating the internal control system and documenting results; (2) reflects all OMB Circular No. A-123 requirements, such as those related to identifying objectives, evaluating deficiencies, and determining material weaknesses; and (3) is provided to all who are responsible for performing internal control assessments. (Recommendation 8)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. Specifically, the Air Force performs annual training to Major Commands, Direct Reporting Units, and Functional Executives. In FY20, the Air Force included business process assessable leads in this training. The Air Force plans to continue to refine the audience of its training to verify that those responsible for implementing and assessing ERM and internal controls are trained sufficiently by September 2021.

Recommendation: The Secretary of the Air Force should develop policy or procedures consistent with OMB Circular No. A-123 to assess the system of internal control using a risk-based approach. (Recommendation 9)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. Specifically, the Air Force's scoping procedures, beginning in FY19, consider materiality, both quantitative and qualitative risk, as well as risks identified in the enterprise risk management process. The Air Force assesses internal controls over financial reporting and financial systems using a risk-based approach as evidenced currently in documented procedures and testing templates. The Air Force will refine its procedure documentation to include the assessment of internal controls over operations and compliance using a risk-based approach. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop procedures to assess internal control over processes related to mission-critical assets, including (1) tests of design that evaluate whether controls are capable of achieving objectives, (2) tests of effectiveness only after a favorable assessment of the design of the control, and (3) a baseline that has accurate descriptions of business processes and identifies key internal controls as designed by management to respond to risks. (Recommendation 10)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. The Air Force documents processes and assesses internal controls over financial reporting and financial systems related to mission critical assets that includes determinations as to internal control design, implementation, operating effectiveness and risks. The Air Force will enhance its approach for documenting processes and assessing internal controls over operations and compliance not related to financial reporting and financial systems through policy. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls related to mission-critical assets, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should establish a process and reporting lines of all the sources of information, including reviews performed of internal control processes related to mission-critical assets, that will be considered in the Secretary's Statement of Assurance. (Recommendation 11)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force reports material weaknesses in internal controls over financial reporting and financial systems related to mission critical assets through SAF/FM, but it will solidify its reporting channels for material weaknesses in internal controls over operations and compliance through policy. Due to the need for policy, procedure, documentation, and training updates required to appropriately report deficiencies in internal control over operations and compliance, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, documentation, and training by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop procedures to require coordination between business process leads and the Air Force's unit managers to ensure that mission-critical asset–related internal control deficiencies are considered in the unit managers' assessments of internal control and related supporting statements of assurance. These procedures should include how, when, and with what frequency the results from the business process internal control reviews should be provided to relevant organizational units for consideration in their respective assurance statements. (Recommendation 12)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will develop procedures to enhance communication between business process leads and Air Force unit managers to verify that deficiencies are reported appropriately in supporting statements of assurance. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, as well as the change management needed to implement additional communications and protocol processes, the Air Force plans to refine the policies by September 2021 and publish the policies by September 2022.

Recommendation: The Secretary of Commerce should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 1)

Agency: Department of Commerce
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that it will develop an action plan to address the recommendation to better align its contingency plan with OMB guidance. When we confirm what actions Commerce has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and and stated that it has begun to take steps to better address OMB guidance on contingency plans. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) partially agreed with the recommendation. IRS agreed with one element of our recommendation to include additional detail in its agency contingency plan and stated that it is in the process of adding procedures for resuming program activities following a government shutdown into its contingency plan. IRS did not agree with the other elements of the recommendation because it believes it has already addressed plans for a potential prolonged shutdown and flexibilities for supervisors if employees are unable to return to work at the end of a shutdown in its contingency plans. We agree that while IRS has included some details on these elements in its plans, we continue to believe that it should provide more detail, such as points in time when the furlough status of an employee may change, how many employees would be affected, and the legal basis for the changes, within its publically available contingency plan to fully address these elements. We will continue to monitor IRS's efforts in this area.

Recommendation: The U.S. Trade Representative, in consultation with EOP as appropriate, should align the component's contingency plan with OMB guidance. This could be accomplished through (1) revisions to the EOP contingency plan; or (2) by creating a separate USTR plan. (Recommendation 4)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has already begun addressing our recommendations on aligning its contingency plan with OMB guidance. When we confirm what actions USTR has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for International Trade should document the component's shutdown processes, including roles and responsibilities, planning processes for potential shutdowns, and recall processes for furloughed employees during a shutdown. (Recommendation 5)

Agency: Department of Commerce: International Trade Administration
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that the International Trade Administration (ITA) has documented its shutdown planning processes and recall processes for furloughed employees during a shutdown. When we confirm what actions ITA has taken in response to this recommendation, we will provide updated information.

Recommendation: The U.S. Trade Representative should document the component's shutdown processes, including roles and responsibilities, planning processes for potential shutdowns, and recall processes for furloughed employees during a shutdown. (Recommendation 6)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has already begun addressing our recommendations on documenting its shutdown processes. When we confirm what actions USTR has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to track and document which employees worked and what work was performed daily during a government shutdown. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and stated that Customs and Border Protection plans to analyze existing systems to determine which is best suited to track and document employee work during a government shutdown and will ensure that the chosen system is available should a future shutdown occur. When we confirm what actions CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 8)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation but stated that because Customs and Border Protection (CBP) does not have systems capable of efficiently restoring physical access for furloughed employees, it would have to reinstate employee access individually and the cost would be substantial. DHS stated that CBP plans to update procedures to ensure more comprehensive workspace access guidance for furloughed employees. We continue to believe that physical access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's efforts going forward.

Recommendation: The Commissioner of Internal Revenue should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 9)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service disagreed with this recommendation. IRS stated that it believes that it has effective controls in place to manage physical workspace access during a shutdown. In addition, IRS said that it believes that implementing additional access controls do not justify the corresponding resource investments. We continue to believe that IRS should improve its access controls, which currently rely on managers and furlough letters to communicate limits on workspace access. While we recognize the costs of increased access controls, government shutdowns are unique events that require additional access controls in order to prevent potential misuse of government resources and will monitor IRS's efforts to address it.

Recommendation: The U.S. Trade Representative should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 10)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has made the Executive Office of the President (EOP) aware of the recommendations on developing controls for physical workspace access during a shutdown. We will continue to monitor USTR's efforts to address this recommendation.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 11)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation. DHS stated that Customs and Border Protection (CBP) believes that furloughed employees must be able to passively monitor the status of the government shutdown and access important agency communications using DHS-issued electronic devices. Additionally, disabling and reactivating thousands of employee user accounts during a shutdown posed a significant burden. DHS said that CBP plans to update shutdown procedures to clarify allowed use of DHS-issued electronic devices by furloughed employees. We agree that CBP should update procedures on workspace access as suggested, and continue to believe that virtual access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's progress going forward.

Recommendation: The Commissioner of Internal Revenue should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service disagreed with this recommendation. IRS stated that it believes that it has effective controls in place to manage virtual workspace access during a shutdown. In addition, IRS said that it believes that implementing additional access controls do not justify the corresponding resource investments. We continue to believe that IRS should improve its access controls, which currently rely on managers and furlough letters to communicate limits on workspace access. While we recognize the costs of increased access controls, government shutdowns are unique events that require additional access controls in order to prevent potential misuse of government resources and will monitor IRS's efforts to address it.

Recommendation: The Under Secretary for International Trade should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 13)

Agency: Department of Commerce: International Trade Administration
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that the International Trade Administration (ITA) has established and documented internal controls to limit virtual workspace access to excepted or exempt employees during a government shutdown. When we confirm what actions ITA has taken in response to this recommendation, we will provide updated information.

Recommendation: The U.S. Trade Representative should, in consultation with EOP, develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 14)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has made the Executive Office of the President (EOP) aware of the recommendations on developing controls for virtual workspace access during a shutdown. We will continue to monitor USTR's efforts to address this recommendation.

Recommendation: We recommend that the Commissioner of Internal Revenue update and implement policies and procedures for developing a courier contingency plan to prohibit managers responsible for overseeing the preparation of taxpayer receipts for deposits from also transporting them to financial institutions. (Recommendation 20-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization will update the Courier Contingency Plan polices and procedures to provide for appropriate segregation of duties or other curative measures.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement manual refund procedures to direct (1) initiators to document (e.g., record on the taxpayers' accounts or annotate on the related manual refund forms) the justification for bypassing the IAT tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to monitor whether such warnings were bypassed and review the justifications for reasonableness prior to approving manual refund forms. (Recommendation 20-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization agrees that actions need to occur to address duplicate tax refund conditions through improved manual refund procedures to require (1) initiator to document the justification for bypassing the Integrated Automated Technologies (IAT) tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to review the justification documented for bypassing the IAT tool warning for reasonableness prior to approving manual refund forms. However, IRS also stated that it was unable to commit to implementing a corrective action plan at this time due to budgetary constraints on system enhancements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that business units record the acceptance of goods and services in a timely manner in accordance with IRS policies and procedures. (Recommendation 20-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will determine the reasons for business unit(s) non-compliance with established policies and procedures related to timely recording of receipts and acceptance of goods and services and, based on this evaluation, develop an action plan that once completed will provide additional tools to aid the business units in reasonably ensuring compliance with established requirements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that the future lease payment amounts for non-cancellable operating leases are calculated correctly. (Recommendation 20-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will update policies and procedures to include additional instructions needed to calculate the future lease payments due on the non-cancelable leases with terms greater than one year and will also create an automated calculation to determine the number of remaining months of lease payments.

Recommendation: The Secretary of the Army should ensure that the Assistant Chief of Staff for Installation Management, in conjunction with the Centers of Standardization and the U.S. Army Corps of Engineers, establish and implement performance measures to assess the progress the Centers are making in ensuring that standard designs are used consistently. (Recommendation 1)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: DOD concurred with this April 2020 recommendation. In June 2020, DOD provided information that it had developed a corrective action plan and identified an action officer to lead implementation of this recommendation. DOD stated that it is developing a sampling plan with criteria to consider for assessing the consistent use of standard designs. DOD stated that it would identify projects that were completed during the year that used standard designs and that it would then assess the progress that the Centers are making in ensuring that standard designs are used consistently by sampling from the completed projects. DOD stated that, based on the results of this analysis, it would adjust the metrics and frequency of future analyses, as appropriate. DOD stated that it expects this effort to be completed in Spring 2021.

Recommendation: The Secretary of the Army should ensure that the Assistant Chief of Staff for Installation Management, in conjunction with the Centers of Standardization and the U.S. Army Corps of Engineers, establish and implement performance measures to assess the effects of the use of standard designs, specifically the progress the Centers are making in reducing design costs and time, construction costs and time, and change orders. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: DOD concurred with this April 2020 recommendation. In June 2020, DOD provided information that it had developed a corrective action plan and stated that it planned to establish relevant performance measures to analyze efforts to reduce design costs and time, construction costs and time, and the number of change orders. DOD stated that it expects to develop standards containing the metrics, frequency of analysis, and means of reporting. DOD stated that it expects to present the results of its analysis at the FY2020 Military Programs After Action Review in January 2021.

Recommendation: The Director of the Bureau of Indian Education should develop a systematic process for identifying JOM contractors and maintaining an accurate and complete list of contractors and other relevant information about contractors, such as the amount of JOM funds they receive and their current points of contact. (Recommendation 1)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: Interior concurred with this recommendation. They expect their newly expanded JOM program workforce to develop, publish and implement a comprehensive JOM policy and procedure that includes a systemic process for identifying JOM contractors and maintaining a complete and accurate list of contractors. We will monitor the progress of these efforts.

Recommendation: The Director of the Bureau of Indian Education, in coordination with the Bureau of Indian Affairs as needed, should establish a process to track and monitor the timeliness of JOM disbursements to non-tribal contractors, including identifying a target date for disbursing funds to these contractors. (Recommendation 2)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: Interior concurred with this recommendation. The BIE, BIA and other partners will work collaboratively to publish and implement a policy and procedure that accurately tracks and monitors timely disbursement of JOM funds to these contractors. We will monitor the progress of these efforts.

Recommendation: The Director of the Bureau of Indian Education should develop a timeline to assess the usefulness of the information they are collecting from JOM contractors and update JOM information collection forms, including converting them to an electronic format to reduce the burden on contractors to complete them. (Recommendation 3)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: Interior concurred with this recommendation. They expect that their newly expanded JOM program workforce will expedite the BIE's review and information collection efforts. We will monitor the progress of these efforts.

Recommendation: The Director of the Bureau of Indian Education should develop and provide training to contractors on administering the JOM program. (Recommendation 4)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: Interior concurred with this recommendation. SIE and JOM staff will be tasked with developing a technical assistance framework for contractors and a training plan as part of the wider JOM program policy and task procedures. We will monitor the progress of these efforts.

Recommendation: The Director of the Bureau of Indian Education should clearly define the roles and responsibilities and identify the staff necessary for conducting critical JOM functions, including administering contracts, reviewing the appropriateness of contract types, and overseeing those contractors that are subject to BIE oversight. (Recommendation 5)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: Interior concurred with this recommendation. The BIE, BIA and other partners plan to work collaboratively to develop an inter-bureau policy that clearly identifies each agency's roles and responsibilities. They are also developing a data-informed workforce analysis for the JOM program. They will continue to develop and implement a data-informed workforce strategy to identify human capital needs and clearly identifies and assigns critical JOM-related functions among BIE divisions, offices and staff. We will monitor the progress of these efforts.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment, in collaboration with the military departments, provide updated guidance for the oversight of privatized military housing, to include oversight objectives for each service to monitor the physical condition of privatized homes over the remaining duration of the ground leases. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Assistant Secretary of Defense for Sustainment (ASD (S)), as the Chief Housing Officer, issued guidance requiring the military departments to monitor work order completion for housing privatized under the Military Housing Privatization Initiative based on a combination of resident input, timeliness of work order completion, and number of repeat work orders for the same repair. The guidance also required increased tracking of MHPI project work orders by installation staff. Moving forward, the ASD(S) plans to issue quarterly program review guidance that establishes oversight objectives for the military departments to monitor the physical condition of MHPI housing over the duration of their project ground leases, formalizing the requirement that the data be monitored by the Chief Housing Officer. DOD expects this to be completed by December 2020. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Army should take steps, in collaboration with the Army's private housing partners, to review the indicators underlying the privatized housing project performance metrics to ensure they provide an accurate reflection of the condition and quality of the homes. (Recommendation 2

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Secretary of the Army has taken several steps toward addressing this recommendation. For example, the Army published the Portfolio and Asset Management Handbook creating a multi-tiered assessment approach of performance metrics to measure the health of each privatized home through inspection, assessment, satisfaction, and feedback. The Army and the private housing partners revised the Incentive Fee Performance Management Plan, placing increased emphasis on resident satisfaction and work order/maintenance management. The Army also put Commanders in charge, ensuring Army leadership at every Army installation is tracking housing quality and safety. In late 2020, the Army plans to review and evaluate these actions and make a determination by 31 Jan 2021 if any changes or revisions are needed to best implement the recommendation. As such, we will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Air Force should take steps, in collaboration with the Air Force's private housing partners, to review the indicators underlying the privatized housing project performance metrics to ensure they provide an accurate reflection of the condition and quality of the homes. (Recommendation 3)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Air Force is engaging in several steps to address this recommendation. Specifically, in March 2020, the Air Force tasked each of the Military Housing Offices to inspect all move-in, move-out, and change of occupancy maintenance events and all emergency, urgent, and life, health, and safety work orders, which is outlined in Air Force guidance. The Air Force is also engaging in several ongoing actions. In response to a memo to the military departments to provide consistency of performance incentive fees, the Air Force was negotiating with the privatized housing project owners to update performance incentive fee metrics in accordance with ASD directed categories and weightings. As of August 2020, agreements had been finalized with 2 partners and work was ongoing with the remaining partners. In addition, the Air Force was working with the project owners to deploy Satisfacts, a survey tool to independently measure resident satisfaction with projects' work order performance, across all Air Force projects with an expected completion by December 2020. We will continue to monitor the status of these recommendations.

Recommendation: The Secretary of the Navy should take steps, in collaboration with the Navy and Marine Corps' private housing partners, to review the indicators underlying the privatized housing project performance metrics to ensure they provide an accurate reflection of the condition and quality of the homes. (Recommendation 4)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Navy and Marine Corps are engaging in several steps to address this recommendation. Specifically, the Navy and Marine Corps have developed a centralized electronic data warehouse, which receives data from privatized housing partner maintenance systems to display work order and survey performance dashboards. By February 2021, the Navy expects to complete the development of metrics displayed by the data warehouse to include key service call performance metrics and resident feedback data. The Navy and Marine Corps are also developing a web-based monitoring matrix tool housing officials can use to evaluate the performance of privatized housing partners. The tool is intended to provide improved tracking capabilities and improved accessibility to information, thus providing more consistent oversight and improved advocacy service members and their families. The Navy is also working to hire 247 additional Navy and Marine Corps housing staff to review and analyze private partner provided recurring maintenance and customer satisfaction reports in an effort to strengthen oversight and monitoring, with an estimated completion of September 2020. Moving forward, we will continue to monitor the status of these and other efforts.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment, in collaboration with the military departments and private housing partners, establish minimum data requirements and consistent terminology and practices for work order data collection for comparability across installations and projects and to track trends over time. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: e Department of Defense (DOD) partially concurred with this recommendation. In its August 2020 response, DOD stated that the Assistant Secretary of Defense for Sustainment (ASD(S)), as the Chief Housing Officer, plans to issue a policy directing the military departments to establish, to the maximum extent practical, minimum data requirements and consistent terminology and practices for MHPI housing unit work order collection to aid in comparability across installations and projects, and for tracking trends over time. However, DOD noted that the department cannot mandate changes to existing MHPI project legal documents. DOD estimates that this effort will be completed by December 2021. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment require the military departments to establish a process to validate data collected by the private housing partners to better ensure the reliability and validity of work order data and to allow for more effective use of these data for monitoring and tracking purposes. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Assistant Secretary of Defense for Sustainment (ASD(S)), as the Chief Housing Officer, issued guidance directing the military departments to exercise proper oversight to ensure Military Housing Privatization Initiative (MHPI) projects perform in accordance with legal agreements, to include due diligence in monitoring and auditing project maintenance records and other project performance data. The guidance also required military departments to review their entire portfolios of MHPI projects to ensure accurate and appropriate work order management processes. In response to the new guidance, DOD noted that the military departments put in place appropriate oversight measures and undertook the required reviews, though the investigations of project business practices were ongoing in some cases. As another step, the ASD(S) plans to issue guidance directing the military departments to establish a process to validate data collected by their respective MHPI Project Owners to better ensure the reliability and validity of work order data and to allow for more effective use of these data for monitoring and tracking purposes. DOD expects this to be completed by the end of September 2020. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Defense should ensure the Assistant Secretary of Defense for Sustainment, in collaboration with the military departments, develop a process for collecting and calculating resident satisfaction data from the military departments to ensure that the data are compiled and calculated in a standardized and accurate way. (Recommendation 7)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense (DOD) partially concurred with this recommendation based on the fact that the draft report listed the incorrect office as the source for addressing the deficiency, but subsequently changed its response to concur after the recommendation was directed to the appropriate office in the final report. In its August 2020 response, DOD noted that the Assistant Secretary of Defense for Sustainment (ASD(S)) plans to issue guidance establishing a department-wide process for collecting and calculating resident satisfaction data to ensure that the data are compiled and calculated in a standardized and accurate way effective with the survey collection effort in Fiscal Year 2021. The department expects this effort to be completed by October 2020. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Defense should ensure the Assistant Secretary of Defense for Sustainment provides additional explanation of the data collected and reported in future reports to Congress, such as explaining the limitations of available survey data, how resident satisfaction was calculated, and reasons for any missing data, among other things. (Recommendation 8)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense (DOD) partially concurred with this recommendation. In its August 2020 response, DOD noted that the Assistant Secretary of Defense for Sustainment (ASD(S)) would provide additional explanation of the MHPI resident satisfaction data collected and reported in future annual Military Housing Privatization Initiative (MHPI) reports to Congress, effective with the annual report covering fiscal year 2019. DOD noted that the additional information will include, among other things, an explanation of the limitations of available survey data, how resident satisfaction was calculated, and reasons for any missing data. As of August 2020, the annual MHPI report covering fiscal year 2018 was in final coordination and the department noted that the report would addresses a vast majority, but not all, of the requirements identified in our recommendation. DOD noted that the additional information would be provided in the next annual MHPI report. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Army should develop and implement a plan to clearly and systematically communicate to residents the difference between the military housing office and the private partner. At a minimum, these plans should include the Army housing office's roles, responsibilities, locations, and contact information and should ensure that all residents are aware that they can directly contact Army housing office officials. (Recommendation 9)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its response, DOD noted that the Army developed a "Plain Language" briefing as required by the 2020 National Defense Authorization Act that included the Army Housing Office's roles, responsibilities, location, and contact information at each privatized housing project site. DOD noted that the intent of the briefing was to ensure that all residents were aware of their ability to directly contact Army Housing Office and/or the Garrison Commanders. DOD stated that the briefing was disseminated to all of the Military Housing Offices, who are using it in newcomer briefings, and stated that the briefing would be provided to all current residents of privatized military housing, but that measure would not be tracked due to attrition. In addition, DOD noted that Headquarters, Department of the Army was tasking Army Materiel Command to develop a more detailed plan to communicate to residents the difference between the Army Housing Office and the private housing partner. The Army's intent is to not only capture residents upon their arrival at an installation, but making the services of the MHO known over the duration of a resident's time on at installation. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Navy should develop and implement a plan to clearly and systematically communicate to residents the difference between the military housing office and the private partner. At a minimum, these plans should include the Navy housing office's roles, responsibilities, locations, and contact information and should ensure that all residents are aware that they can directly contact Navy housing office officials. (Recommendation 11)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Navy has taken various steps to address this recommendation, with additional steps planned. For example, the Navy has ensured that each installation has a specific issue resolution process description marketing flyer available, both in hard copy and on the public housing websites, with a reminder that residents can contact both the privatized housing property manager and the Navy housing office with any issues. Moreover, every housing unit has been provided with a refrigerator magnet reminding residents that they can and should contact the Navy housing office if they have any issues with their home. In addition, the Navy and Marine Corps have established a requirement to contact each privatized housing resident not later than 15 days after move-in and again 60 days after move-in to provide an opportunity to request assistance and remind them of available support. Moving forward, the Navy has an ongoing effort to require private housing companies to market the same messaging as the service issue resolution processes for the MHOs that they support, for consistent advocacy messaging to the tenants. The information will be added to PPV partner websites, printed material and resident handbooks. The Navy also plans to use its annual survey to tracks resident satisfaction and awareness of the Navy's issue resolution process, with expected completion by October 2020. In addition, the Marine Corps has identified a near-term initiative to procure name tags for all MHO employees to wear, identifying themselves as distinct and separate from privatized housing property management company, which will be standardized across all USMC installations. The Marine Corps also plans to develop a standard welcome aboard package to include magnets and other items with key point of contact information. The Marine Corps expects these efforts to be completed by the end of September 2020.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment, in collaboration with the military departments, assess the risks of proposed initiatives aimed at improving the privatized military housing program on the financial viability of the projects. (Recommendation 12)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. In its August 2020 response, DOD noted that the Assistant Secretary of Defense for Sustainment, as the Chief Housing Officer, planned to issue a policy establishing the assessment of Military Housing Privatization Initiative (MHPI) project financial viability as part of quarterly program reviews as a long-term requirement. The department noted that the program review data would be augmented by input from the MHPI companies, who are assessing the likely impact of proposed initiatives in conjunction with their third party lenders. The department expected this effort to be completed by December 2020. We will continue to monitor the status of this recommendation.

Recommendation: The Archivist of the United States should require small and micro agencies that were determined to be at high risk of not complying with statutory and regulatory records management requirements to develop plans and timelines to address their records management weaknesses (Recommendation 1)

Agency: National Archives and Records Administration: Office of the Archivist
Status: Open

Comments: The National Archives and Records Administration concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Archivist of the United States should monitor the agencies' progress towards these efforts on a regular basis. (Recommendation 2)

Agency: National Archives and Records Administration: Office of the Archivist
Status: Open

Comments: The National Archives and Records Administration concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 3)

Agency: Armed Forces Retirement Home
Status: Open

Comments: The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Armed Forces Retirement Home establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 4)

Agency: Armed Forces Retirement Home
Status: Open

Comments: The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: usability, content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 5)

Agency: Armed Forces Retirement Home
Status: Open

Comments: The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Armed Forces Retirement Home should ensure existing policies and procedures describe the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 6)

Agency: Armed Forces Retirement Home
Status: Open

Comments: The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 7)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: The Department of Commerce concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should ensure the electronic system that manages email provides the capabilities to manage permanent and temporary email records and to identify, retrieve, and retain records. (Recommendation 8)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: The Department of Commerce concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Consumer Financial Protection Bureau should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 9)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: The Consumer Financial Protection Bureau concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the bureau states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of the Election Assistance Commission should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 10)

Agency: Election Assistance Commission
Status: Open

Comments: The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of the Election Assistance Commission should establish a time frame to develop a plan on how the agency intends to manage permanent electronic records. (Recommendation 11)

Agency: Election Assistance Commission
Status: Open

Comments: The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 12)

Agency: Election Assistance Commission
Status: Open

Comments: The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include the (1) following records management controls required for electronic information systems: content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 13)

Agency: Election Assistance Commission
Status: Open

Comments: The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of the Election Assistance Commission should develop a written policy that describes the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 14)

Agency: Election Assistance Commission
Status: Open

Comments: The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of the Federal Trade Commission should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates. (Recommendation 15)

Agency: Federal Trade Commission
Status: Open

Comments: The Federal Trade Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of the Marine Mammal Commission should use recently developed policies and procedures to implement and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 16)

Agency: Marine Mammal Commission
Status: Open

Comments: The Marine Mammal Commission did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the National Aeronautics and Space Administration should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 17)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the National Science Foundation should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 18)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the National Science Foundation should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: technical characteristics of the systems, identify inputs and outputs, and describe update cycles. (Recommendation 19)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the National Science Foundation should establish a time frame to update the agency's policies and procedures to include all of the records management controls required for electronic information systems and the required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 20)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the National Science Foundation should develop policies and procedures for the required retention and management requirements for email, including instructions to staff to ensure that the names and addresses of the sender, date of message, attachments, calendars, and draft documents will be retained. (Recommendation 21)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Management and Budget should ensure, in conjunction with the Executive Office of the President's Office of Administration, that existing policies and procedures incorporate the management of electronic records into its overall records management program. (Recommendation 22)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Management and Budget should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 23)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Management and Budget should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 24)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Management and Budget should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 25)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Management and Budget should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 26)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of National Drug Control Policy should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 27)

Agency: Executive Office of the President: Office of National Drug Control Policy
Status: Open

Comments: The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of National Drug Control Policy should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 28)

Agency: Executive Office of the President: Office of National Drug Control Policy
Status: Open

Comments: The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of National Drug Control Policy should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 29)

Agency: Executive Office of the President: Office of National Drug Control Policy
Status: Open

Comments: The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management should establish a time frame to ensure that all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 30)

Agency: Office of Personnel Management: Office of the Director
Status: Open

Comments: The Office of Personnel Management concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 31)

Agency: Office of Personnel Management: Office of the Director
Status: Open

Comments: The Office of Personnel Management concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management should establish a time frame to develop a plan to manage permanent electronic records. (Recommendation 32)

Agency: Office of Personnel Management: Office of the Director
Status: Open

Comments: The Office of Personnel Management concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 33)

Agency: Office of Personnel Management: Office of the Director
Status: Open

Comments: The Office of Personnel Management concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management should establish a time frame to update the agency's policies and procedures on retention and management for email to include retaining electronic calendars and draft documents. (Recommendation 34)

Agency: Office of Personnel Management: Office of the Director
Status: Open

Comments: The Office of Personnel Management concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 35)

Agency: Overseas Private Investment Corporation (OPIC)
Status: Open

Comments: The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop policies and procedures that define required electronic information system functionalities for recordkeeping systems including declaring records and assigning unique identifiers, capturing records, maintaining security, and preserving records. (Recommendation 36)

Agency: Overseas Private Investment Corporation (OPIC)
Status: Open

Comments: The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: reliability, content, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 37)

Agency: Overseas Private Investment Corporation (OPIC)
Status: Open

Comments: The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures on retention and management for email to include policies for retaining electronic calendars. (Recommendation 38)

Agency: Overseas Private Investment Corporation (OPIC)
Status: Open

Comments: The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Peace Corps should establish a time frame to update the agency's electronic information systems inventory to (1) specify technical characteristics necessary for reading and processing the records contained in the system, (2) identify system inputs and outputs, (3) define the contents of the files and records, (4) determine restrictions on access and use, and (5) specify how the agency ensures the timely disposition of records. (Recommendation 39)

Agency: Peace Corps
Status: Open

Comments: The Peace Corps did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Peace Corps should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 40)

Agency: Peace Corps
Status: Open

Comments: The Peace Corps did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Peace Corps should establish a time frame to update the agency's policies and procedures to include (1) following records management controls required for electronic information systems: usability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 41)

Agency: Peace Corps
Status: Open

Comments: The Peace Corps did not state whether or not it concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Executive Director of Udall Foundation should establish a time frame to develop and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 42)

Agency: Morris K. Udall and Stewart L. Udall Foundation
Status: Open

Comments: The Udall Foundation concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should identify the information about family members apprehended together that its components collectively need to process those family members and communicate that information to its components. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: According to DHS, in June 2020, DHS's Office of Immigration Statistics launched a Family Status Data Standards Community of Interest (COI) under the purview of the DHS Immigration Data Integration Initiative. In August 2020, DHS reported that the Family Status COI includes subject matter experts and data system managers from DHS components, the Department of Health and Human Services, and the Executive Office for Immigration Review. The COI's mandate includes drafting common DHS-wide and interagency data standards (common codes, common definitions, common formats) for all topics related to family status, including codes to identify the reasons for family separation, members apprehended together, and unaccompanied children. DHS expects to complete these actions by September 30, 2020. Identifying and communicating department-wide information needs with respect to family members who have been apprehended together should help provide DHS with greater assurance that its components are identifying all individuals who may be eligible for relief from removal from the United States based on their family relationships.

Recommendation: The Secretary of Homeland Security should ensure that, at the time of apprehension, CBP collects the information that DHS components collectively need to process family members apprehended together. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) will work with relevant components and offices to ensure all required information is collected at the time of apprehension on the Form I-213 when processing family members apprehended together. As of August 2020, DHS reported that DHS OIS continues to work with relevant components and offices to ensure all required information is collected at the time of apprehension on Form I-213 when processing family members apprehended together. DHS expects to complete these actions by September 30, 2020. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.

Recommendation: The Secretary of Homeland Security should ensure that CBP documents the information that DHS components collectively need to process family members apprehended together on the Form I-213. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that, upon implementation of the steps the department plans to take in response to our second recommendation, CBP will issue guidance to the field to ensure that CBP agents and officers document the information that DHS components collectively need to process family members. In August 2020, DHS reported that component agencies continue to collaborate to define the process of family members apprehended together, as will be reflected on CBP Form I-213. DHS estimates issuing this guidance by March 31, 2021. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.immigration or other proceedings.

Recommendation: The Secretary of Homeland Security should evaluate options for developing a unique identifier shared across DHS components' data systems to link family members apprehended together. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) plans to work with relevant components to develop a unique shared identifier linking family members apprehended together. According to DHS, DHS OIS launched the Family Status Community of Interest (COI) in June 2020, and the COI has since established a bi-weekly meeting schedule. The COI's initial focus is on standard codes describing the reasons for family separations. Upon completing the family separation reason standard, DHS reported that the COI will prioritize developing common codes to identify family members apprehended together. DHS estimates completing these actions by March 31, 2021. Evaluating options for developing a shared unique family member identifier across components that would allow each component access to certain information about family members apprehended together would help bridge the information gaps about family relationships between components caused by DHS's fragmented data systems.

Recommendation: The Director of USCIS should ensure that, in addition to USCIS's basic asylum officer training, all asylum offices provide pre-departure training on the credible and reasonable fear processes before their officers begin screening cases at the family residential centers. (Recommendation 1)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS plans to develop a standardized pre-departure training and provide this training to all detailees prior to deployment to the family residential centers. DHS estimated that these actions would be completed by September 2020. As of August 2020, USCIS told GAO that the number of noncitizens processed under expedited removal has decreased dramatically as a result of Coronavirus Disease 2019. Therefore, details to the Family Residential Centers have largely been paused. USCIS noted that the Asylum Division is reviewing the credible fear and reasonable fear training requirements; working on an enhanced training module; and, developing a standardized pre-departure training by December 31, 2020. USCIS plans to provide the training to all detailees prior to deployment to the Family Residential Centers during calendar year 2021, should the details resume. Providing pre-departure training, in addition to USCIS's basic training for new asylum officers, would help USCIS ensure that officers from all asylum offices are conducting efficient and effective fear screenings of families.

Recommendation: The Director of USCIS should ensure asylum officers systematically record in USCIS's automated case management system if individuals receive credible fear determinations as principal applicants, dependents, or in the interest of family unity, pursuant to regulation or USCIS policy. (Recommendation 3)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS planned to explore ways to modify its case management system so that asylum officers can record whether an individual received a positive credible fear determination as a principal applicant, dependent, or in the interest of family unity. USCIS plans to make any appropriate changes to its case management system and train asylum officers on these changes by December 2020. As of August 2020, USCIS reported that the agency remains on track to complete this work as planned, provided staffing is not affected by USCIS budget issues. Having complete data in its case management system on all outcomes of credible fear screenings at family residential centers would better position USCIS to report on the scope of either the agency's policy for family members who are treated as dependents, pursuant to regulation, or USCIS's use of discretion in the interest of family unity.

Recommendation: The Director of USCIS should collect and analyze additional information on case delays, including specific reasons for delays and how long they last, that asylum officers may face when screening credible and reasonable fear cases. (Recommendation 4)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS will explore ways to collect additional information on credible and reasonable fear case delays in its case management system. USCIS plans to modify the system, as appropriate, to instruct users on the changes, and begin collecting and analyzing the information by December 31, 2020. As of August 2020, USCIS reported that the agency remains on track to accomplish this work by the end of calendar year 2020, provided staffing is not adversely affected by the on-going COVID-19 pandemic and USCIS budget issues. Collecting additional information in its automated case management system on case delays would provide USCIS with more readily available information and analyzing such data could help USCIS identify case delay reasons relevant in the current environment for officers conducting fear screenings and better position USCIS to mitigate the reasons for the delays and improve efficiency in case processing.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should expand the scope of the department's centralized database on problematic sexual behavior in children and youth, which is under development, to also track information on all incidents involving the abuse of a child (physical, sexual, emotional, and neglect) reported to the Family Advocacy Program or investigated by a military law enforcement organization, regardless of whether the offender was another child, an adult, or someone in a noncaregiving role at the time of the incident. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD did not concur with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should, as part of the ongoing development of the centralized database, identify and define the elements to be tracked by each responsible organization, such as the Family Advocacy Program and military law enforcement. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should develop a plan for how it will use the data it will collect in the centralized database to help ensure data-driven decision-making is used to inform program efforts. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should establish a reliable schedule for the development and implementation of the centralized database on problematic sexual behavior in children and youth that includes key activities, the timeframes and resources needed to execute them, and GAO-identified practices for developing and maintaining a reliable schedule. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should direct the service Family Advocacy Programs and military law enforcement organizations to document in their respective databases the date that they notified the other entity of a reported incident of child abuse. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should issue guidance that describes the process through which the service Family Advocacy Programs are to receive and incorporate information into their central registries regarding child abuse allegations and determinations involving their servicemembers and dependents that were recorded by another service's installation Family Advocacy Program. Such guidance should include a mechanism to monitor that the process is occurring consistently. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 7)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 8)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps develops a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 9)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 10)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Director of the Department of Defense Education Activity, clarifies Department of Defense Education Activity guidance to define what types of incidents must be reported as "serious incidents" to help ensure that all serious incidents of which Department of Defense Education Activity leadership needs to be informed are accurately and consistently reported by school administrators. (Recommendation 11)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should expand the voting membership of the Incident Determination Committee to include medical personnel with the requisite knowledge and experience. (Recommendation 12)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 13)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 14)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps establishes efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 15)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 16)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should clarify, in guidance, the circumstances under which commanders may exercise their authority to remove a child from a potentially unsafe home on an overseas installation. (Recommendation 17)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Director of the Defense Health Agency, establishes processes that help ensure children who are sexually abused overseas have timely access to a certified pediatric sexual assault forensic examiner to conduct the examination. Initiatives could include certifying pediatricians or adult sexual assault forensic examiners as pediatric examiners during mandatory training or establishing shared regional assets. (Recommendation 18)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Deputy Attorney General, should seek avenues to improve communication between the military criminal investigative organizations and United States Attorneys for relevant cases involving child victims to help ensure that investigators are notified when prosecution is declined, including the reasons for the declination when appropriate, such as details about any investigative deficiencies. (Recommendation 19)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should seek to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Army installations and thereby increase awareness of those services across the department. (Recommendation 20)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should continue to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Navy installations and thereby increase awareness of those services across the department. (Recommendation 21)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps continues to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Marine Corps installations and thereby increase awareness of those services across the service. (Recommendation 22)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should seek to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Air Force installations and thereby increase awareness of those services across the department. (Recommendation 23)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Executive Director should ensure the development and implementation of policies and procedures for incorporating key cybersecurity activities into IT project planning, including scheduling, requirements management, and risk management. (Recommendation 1)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was in the process of revising its IT systems project planning to ensure the development and implementation of policies and procedure incorporating key cybersecurity activities. The agency also stated that it plans to hire an IT Security Project Manager in order to acquire the necessary cybersecurity expertise needed to implement this recommendation and to ensure that sufficient time and resources can be dedicated to the development and implementation of these policies and procedures. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the development and implementation of oversight procedures for each externally-operated system that include (1) establishing security and privacy requirements, (2) planning the assessment of security controls, (3) conducting the assessment, and, (4) reviewing the assessment. (Recommendation 2)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was beginning to plan for developing and implementing oversight procedures for each externally-operated system. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the establishment of roles and responsibilities for a risk executive function. (Recommendation 3)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it had expanded the office's IT Director's role to formally include the functions of an IT Risk Executive and was in the process of establishing the roles and responsibilities. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the development and implementation of a cybersecurity risk management strategy. (Recommendation 4)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was beginning to plan for developing and implementing a cybersecurity risk management strategy. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure commitment to a time frame for developing and implementing policies and procedures for managing cybersecurity risk. (Recommendation 5)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that, once the position of IT Security Project Manager is filled and the IT Risk Executive functions are formalized, the agency is planning to commit to a time frame for developing and implementing policies and procedures for managing cybersecurity risk. We will continue to monitor OCWR's progress in addressing this recommendation

Recommendation: The DEA Administrator should develop and implement additional ways to use algorithms in analyzing ARCOS and other data to more proactively identify problematic drug transaction patterns. (Recommendation 1)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation and DEA stated it will continue to examine a variety of technologies to analyze ARCOS and other data and implement additional ways to use algorithms to more proactively identify problematic drug transaction patterns.

Recommendation: The DEA Administrator, in coordination with the department-wide efforts on data strategy, should establish and document a data governance structure to ensure DEA is maximizing its management of industry-reported drug transaction data. (Recommendation 2)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation. As of September 2019, DEA officials stated that its Office of Information Systems' Chief Data Officer just recently started to work with DOJ and other components to develop a data strategy in response to the recently released department wide strategy, and has begun efforts to develop a governance structure. In November, 2019 DEA indicated it will continue to mature its data governance structure. The intent of this recommendation is for DEA to establish a formalized data governance structure to manage its collection and use of data used to support the Diversion Control Division's mission.

Recommendation: The DEA Administrator should establish outcome-oriented goals and associated measurable performance targets related to opioid diversion activities, using data it collects, to assess how the data it obtains and uses supports its diversion control activities. (Recommendation 3)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ neither agreed nor disagreed with this recommendation but DEA stated in November 2019, that it recognizes that measurable performance targets related to opioid diversion activities can serve as leading practices at different organizational levels including the program, project, or activity level. Our recommendation is intended to ensure that DEA can demonstrate the usefulness of the data it collects and uses to support its opioid diversion control activities.

Recommendation: The DEA Administrator, in consultation with industry stakeholders, should identify solutions to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the most useful information possible to assist them in identifying and reporting suspicious orders to DEA. (Recommendation 4)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation and in November 2019, stated it has consulted with industry stakeholders and identified solutions to address the limitations of the tool.

Recommendation: The Commissioner of Internal Revenue should assess options for updating Publications 590-A and 590-B to either include more information or direct taxpayers to other resources for IRA owners with investments in unconventional assets. Such information could include: storage requirements for IRA investments in certain precious metals; valuation methods for hard-to-value IRA assets; the Department of Labor's process for granting exemptions to IRA prohibited transactions rules; and IRA investments with the potential to create unrelated business income tax liabilities. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue, building on forthcoming compliance research using new IRA asset data, should evaluate the feasibility of requiring disclosure for high-risk IRA asset types associated with abusive schemes as transactions of interest. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should develop resources (such as training materials or job aids) for Small Business/Self-Employed examiners conducting IRA owner audits that explain how IRAs with unconventional assets can generate unrelated business income tax liability, and how examiners can refer cases to unrelated business income experts in IRS for assistance. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should ensure that state Medicaid programs have written policies and procedures that specify the extent to which covered entities can use 340B drugs for Medicaid beneficiaries, are designed to effectively identify if 340B drugs were used, and if so, how they should be excluded from Medicaid rebate requests. The policies and procedures should be made publically available and cover FFS, managed care, and all of the dispensing methods for outpatient drugs. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS concurred with this recommendation and in August 2020 stated that it is developing guidance to state Medicaid programs directing them to strengthen policies and procedures related to 340B drugs for Medicaid beneficiaries.

Recommendation: The Administrator of HRSA should incorporate assessments of covered entities' compliance with state Medicaid programs' policies and procedures regarding the use and identification of 340B drugs into its audit process, working with CMS as needed to obtain states' policies and procedures. (Recommendation 2)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS did not concur with this recommendation and, as of August 2020, did not plan to take any actions to implement the recommendation. As noted in our report, covered entities' compliance with state Medicaid programs' policies and procedures is fundamental to preventing duplicate discounts. Thus, we continue to believe that HRSA's audit process should include an assessment of covered entities' compliance with state Medicaid programs' policies and procedures related to 340B drugs as it is necessary to identify potential duplicate discounts and to ensure covered entities' compliance with 340B Program requirements.

Recommendation: The Administrator of HRSA should require covered entities to work with affected drug manufacturers regarding repayment of identified duplicate discounts in Medicaid managed care. (Recommendation 3)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS did not concur with this recommendation and, as of August 2020, did not plan to take any actions to implement the recommendation. As noted in our report, HRSA officials told us that covered entities' obligations for preventing duplicate discounts are the same for Medicaid fee-for-service and managed care. Thus, we continue to believe that when duplicate discounts related to Medicaid managed care have been identified, the agency should require covered entities to work with manufacturers to remedy them as they do for duplicate discounts related to Medicaid fee-for-service to help ensure compliance with 340B Program requirements.

Recommendation: The Director of DFAS should, in accordance with the FMR, implement procedures to help ensure that FBWT reconciliations are consistently performed and that all DFAS sites review and document research conducted on the causes of any differences arising from these reconciliations. (Recommendation 1)

Agency: Department of Defense: Defense Finance and Accounting Service
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. They stated that the Defense Finance and Accounting Service (DFAS) will update the Financial Management Regulation (FMR) and implement procedures to help ensure Fund Balance with Treasury (FBWT) reconciliations are performed consistently and appropriate research on the causes of any difference arising from these reconciliations is reviewed and documented by all DFAS sites. Further, DFAS will update internal documentation/policy to outline DFAS roles and processes for FBWT reconciliations as well as include guidance on the execution of DOD's FMR FBWT reconciliation requirements. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should update the FMR to clearly define the required supporting documentation for system-generated accounting adjustments, including the required documentation of business rules driving the recording of these adjustments, such as documentation of the programming logic. (Recommendation 2)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. They stated that the Department is developing a checklist of required supporting documents for incorporation into the DOD Financial Management Regulations (FMR). They will update the DOD FMR Volume, 6A, Chapter 2 to define the required supporting documentation for system generated accounting adjustments. Additionally, the Defense Finance and Accounting Service (DFAS) will update internal documentation to include narratives outlining the business rules for system generated accounting adjustments with the required supporting documentation. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should perform and document a comprehensive review of the FMR accounting adjustment category codes to determine their ongoing applicability or the need for additional codes to reflect the current financial reporting environment. (Recommendation 3)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department intends to collaborate with the financial community to update the category codes within the DOD Financial Management Regulations (FMR). Specifically, the Office of the Under Secretary of Defense will perform a comprehensive review of Journal Voucher Category Codes listed in DOD FMR, Volume 6A, Chapter 2 and update regulations based on feedback. The Defense Finance and Accounting Service will update internal documentation and procedures to reflect any code changes identified in the revised DOD FMR. The estimated completion date for this recommendation is July 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should establish procedures to help ensure the consistent implementation of the requirements of DFAS Form 9339. (Recommendation 4)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department plans to update the Defense Finance and Accounting Service (DFAS) Form 9339 and develop and conduct refresher training to all users of the Form 9339. The estimated completion date for this recommendation is September 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should update policies and procedures to identify the causes of out-of-balance accounting adjustments and resolve the causes in a timely manner. (Recommendation 5)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department is collaborating on utilizing existing data to identify and resolve out-of-balances and update DOD Financial Management Regulation, Volume 6A, Chapter 2 to include a section conveying out-of-balance accounting adjustments are not authorized. Root cause analysis efforts will be performed in conjunction with corrective action plans (CAPs) for recommendations 6--8. The estimated completion date for this recommendation is December 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement policies and procedures to help ensure that root cause analyses for accounting adjustments are consistently performed and documented across DOD. (Recommendation 6)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department, in conjunction with the Director of Defense Finance and Accounting Service (DFAS), intends to utilize existing advanced analytics tools to research and document root cause analyses. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow-up on this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement policies and procedures to help ensure consistent development, implementation, monitoring, and documentation of action plans across DOD that address accounting adjustment causes that staff identified internally. (Recommendation 7)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department intends to collaborate with the financial community, including the Director of the Defense Financial and Accounting Service (DFAS), and utilize existing tools for documenting and implementing consistent procedures for action plans of accounting adjustments. The analytical tool, Advana will be used to analyze the action plan code for consistent analysis to be performed across the DOD. The estimated completion date for the implementation of this recommendation is February 2021. We will continue to follow-up on this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement procedures across DOD that include clearly defined outcomes focused on reducing accounting adjustments (supported and unsupported) with specific actionable steps and procedures for achieving stated goals. (Recommendation 8)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department, in conjunction with the Director of the Defense Finance and Accounting Service, plans to utilize existing tools to define and measure the outcomes of accounting adjustments. The estimated completion date for the implementation of this recommendation is April 2021. We will continue to follow-up on this recommendation.

Recommendation: The Commissioner of the Social Security Administration should clarify policies and procedures to remind staff that a diagnosis of a substance use disorder is not necessary to conduct a Drug Addiction and Alcoholism evaluation. (Recommendation 1)

Agency: Social Security Administration
Status: Open

Comments: SSA agreed with this recommendation. The agency stated that it had revised related policies in February 2020, and had planned to issue guidance and video-on-demand training to further clarify policies and procedures in this area. However, SSA said its efforts to maintain mission critical activities amid the COVID-19 pandemic have delayed further implementation of this recommendation and a specific implementation date could not be provided at this time.

Recommendation: The Commissioner of the Social Security Administration should ensure that staff document their rationale for decisions involving the Drug Addiction and Alcoholism evaluation process. (Recommendation 2)

Agency: Social Security Administration
Status: Open

Comments: SSA agreed with this recommendation. The agency said it had planned to issue guidance reinforcing its policy on properly documenting decisions involving the Drug Addiction and Alcoholism evaluation process. However, SSA said its efforts to maintain mission critical activities amid the COVID-19 pandemic have delayed implementation of this recommendation and a specific implementation date could not be provided at this time.

Recommendation: The Securities and Exchange Commission's Co-Directors of Enforcement should develop written procedures for generating Enforcement's public reports, including procedures for compiling and verifying statistics used in the reports and documenting their implementation. (Recommendation 1)

Agency: United States Securities and Exchange Commission: Division of Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should develop and provide clear written information in the form of policy, guidance, or regulations, as appropriate, to COR3 and PREPA that clarifies how FEMA will implement new authorities for the electricity grid recovery in Puerto Rico, including guidance on industry standards and defining resilience. (Recommendation 1)

Agency: Federal Emergency Management Agency
Status: Open

Comments: Since GAO's October 2019 report, FEMA updated its guidance and has provided information to local entities on project eligibility and the industry standards it would accept for restoring the grid. In addition, in January 2020, FEMA provided training to FEMA regional officials and local entities on how to implement this guidance. Despite these efforts, uncertainty remains regarding the extent to which local entities in Puerto Rico have sufficient information to implement projects to promote grid resilience. This is in part due to challenges such as the need for written guidance on how project development will proceed after the fixed-cost estimate is finalized. GAO will continue to monitor FEMA progress towards implementation of this recommendation.

Recommendation: The Secretary of HUD should establish time frames and a plan for publication of the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: As of August 2020, HUD had not published a federal notice outlining the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid, nor has it established time frames and a plan for issuing this notice. We continue to believe that the action we recommended is needed and will monitor HUD's efforts as part of our regular recommendation follow-up and additional work examining federal support to improve grid resilience in Puerto Rico. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA, in coordination with DOE, HUD, and other federal and local entities, should establish a mechanism, or take steps to improve existing mechanisms, for coordination among the multiple local and federal entities involved in grid recovery that facilitates decision-making and information sharing among local and federal agencies. (Recommendation 3)

Agency: Federal Emergency Management Agency
Status: Open

Comments: FEMA and DOE have enhanced coordination efforts between their respective agencies and with local entities involved in long-term grid recovery in Puerto Rico via the Technical Coordination Team but until the team's fiscal working group demonstrates how it will help coordinate different potential funding sources, the extent to which these efforts will enhance progress toward grid recovery is uncertain. FEMA can demonstrate this, in part, by providing documentation of efforts to coordinate funding for long-term recovery projects. GAO will continue to monitor agency efforts to support grid recovery in Puerto Rico.

Recommendation: The Secretary of the Army should update Army manpower guidance, or other guidance as appropriate, to ensure that all missions conducted by EOD forces, including DSCA missions, are considered in determining the required number of EOD forces. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: As of July 15, 2020, the Department of the Army has neither concurred nor non-concurred with this recommendation.

Recommendation: The Secretary of the Air Force should update Air Force manpower guidance, or other guidance as appropriate, to ensure that all missions conducted by EOD forces, including DSCA missions, are considered in determining the required number of EOD forces. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: As of July 15, 2020, the Department of the Air Force has neither concurred nor non-concurred with this recommendation.

Recommendation: The Secretary of the Navy should update Navy and Marine Corps manpower guidance, or other guidance as appropriate, to ensure that all missions conducted by EOD forces, including DSCA missions, are considered in determining the required number of EOD forces. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: As of July 15, 2020, the Department of the Navy has neither concurred nor non-concurred with this recommendation.

Recommendation: The Secretary of Defense should ensure that the Chairman of the Joint Chiefs of Staff, in collaboration with the combatant commands, incorporate into the appropriate guidance a requirement that the military services notify the Joint Staff and the affected combatant commands when the execution of VIP support missions negatively affects the preparedness of EOD units for combat-related missions. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: As of July 15, 2020, the Department of Defense has neither concurred nor non-concurred with this recommendation.

Recommendation: The Secretary of Energy should direct DOE's Office of Environmental Management to revise EM's 2017 cleanup policy to establish how the EM program and DOE sites should apply the essential elements of a risk-informed decision-making framework into their current decision-making requirements and guidance. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: In April 2020, DOE officials told us that its Office of Environmental Management (EM) had recently reinvigorated efforts to develop a comprehensive program-wide strategy to address risks in a consistent manner to align cleanup plans and activities with programmatic priorities and available budgets. According to DOE officials, EM plans to revise and replace its 2017 Cleanup Policy with a Cleanup Project Management Protocol and and EM Cleanup Program Management Policy. Officials stated that the Cleanup Program Management Policy will establish an approach for the EM program and DOE sites to apply the essential elements of risk-informed decision-making framework. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Secretary of Energy should direct DOE's Office of Environmental Management, in the development of a program management plan, to incorporate essential elements of risk-informed decision-making. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: In April 2020, DOE officials told us that DOE's Office of Environmental Management (EM) is developing a new Cleanup Program Management Policy that will incorporate the essential elements of risk-informed decision-making, as appropriate, into EM program management policy. DOE officials estimated that this effort will be completed by December 31, 2020.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary enhances existing procedures for Treasury management to perform additional reviews for restatements, reclassifications, and adjustments to beginning net position to reasonably assure that they are properly supported and accurately reported. (Recommendation 2)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury enhanced its procedures to include additional management reviews, particularly the Financial Reports and Advisory Division Director, for restatements, reclassifications, and adjustments to beginning net position. Although FRAD took steps to enhance its review procedures, the additional review did not prevent FRAD from including descriptions in the draft CFS that were not supported by entity financial statements or from excluding some information from the CFS notes. Further steps are needed to define procedures to ensure consistent and accurate treatment of restatements, reclassifications, and adjustments to beginning net position in the CFS. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, establishes effective processes and procedures to reasonably assure that appropriate information regarding legal contingency losses is reported in the CFS. (Recommendation 4)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury and OMB (1) increased guidance to federal entities in the Treasury Financial Manual section 2-4700; (2) included an illustrative Contingent Loss Table in OMB Circular No. A-136 for agencies to use as guidance when reporting probable and reasonably possible losses; (3) provided guidance to agencies through monthly Central Reporting Team (CRT) meetings with the agencies' financial reporting staff and at the Government Financial Management Conference; (4) communicated regularly with Department of Justice officials regarding the preparation of the government-wide legal representation letter; and (5) increased the number of Treasury staff performing the legal letter analysis. However, we noted inconsistencies among the significant component entities' financial statement note disclosures, management schedules, and legal representation letters, and the legal contingency loss information reported in the CFS, as well as inconsistencies between entities' year-end management schedules/legal representation letters and the final government-wide legal representation letter. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: The Commissioner of CBP should review and update policies related to land port of entry inspections in accordance with Office of Field Operations guidance. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by January 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should analyze the results of the Self-Inspection Program over time and at a level necessary to identify and address potentially reoccurring inspection deficiencies at individual ports of entry. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by November 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should implement a policy to conduct periodic comprehensive analyses of covert test findings. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in March 2020, it provided information on its plans to conduct a comprehensive analysis after completing several covert tests. To fully address this recommendation, CBP should implement a policy to conduct periodic comprehensive analyses of covert test findings. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should develop a new target for the land border interception rate for passengers in privately-owned vehicles with major violations that sets an ambitious and realistic goal based on past performance. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by January 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Director of OMB should expand its coordination of CyberStat review meetings for those agencies with a demonstrated need for assistance in implementing information security. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: In January 2020, OMB officials stated that they have incorporated agency feedback for enhancing the CyberStat program into an updated concept of operations document that is currently in draft. To consider this recommendation fully implemented, OMB needs to provide us with an updated concept of operations document for the CyberStat program, and demonstrate the expansion of CyberStat review meetings to agencies that require additional assistance due to persistent information security deficiencies. As of September 2020, OMB has not provided sufficient evidence to close this recommendation.

Recommendation: The Director of OMB should collaborate with CIGIE to ensure that the inspector general reporting metrics include the FISMA-required information security program element for system security plans. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As of September 2020, we were still waiting to receive OMB's 180-day letter detailing the actions it plans to take to address the recommendation.

Recommendation: The Director of OMB should, in coordination with the Secretary of Homeland Security, establish guidance or other means to facilitate the sharing of successful approaches for agencies to address challenges in the areas of (1) managing competing priorities between cybersecurity and operations, such as when operational needs appear to conflict with cybersecurity requirements; (2) implementing consistent cybersecurity risk management policies and procedures across an agency; (3) incorporating cyber risks into enterprise risk management, and (4) establishing agencies' cybersecurity risk management strategies. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget did not say whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once OMB has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 2)

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it is developing a Risk Management Framework implementation plan, which is to include a comprehensive Cybersecurity Strategy. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should update the department's policies to require (1) the use of risk assessments to inform security control tailoring and (2) the use of risk assessments to inform plan of actions and milestones (POA&M) prioritization. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it is developing a Risk Management Framework implementation plan which will include updates to USDA's process guide to ensure informed security control tailoring and updates to USDA's Plan of Actions and Milestones (POA&M) Standard Operation Procedure to inform prioritized POA&M mitigation strategies, through a consistent and repeatable security risk assessment process. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 4)

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it plans to establish a governance framework for USDA Enterprise Risk Management (ERM), which will provide a platform to increase coordination between stakeholders within the cybersecurity and enterprise risk management functions. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should update the department's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 5)

Agency: Department of Commerce
Status: Open

Comments: The Department of Commerce did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to planned actions for this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 6)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: The Department of Commerce did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that its intends to evaluate whether there are any gaps in its cybersecurity policy pertaining to the establishment of an organization-wide cybersecurity risk assessment and will establish a plan to fill in gaps as necessary. The department added that it is making strides in the implementation of a tool that can aggregate data into a dashboard for a unified visibility across the department. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Energy should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 8)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: The Department of Energy concurred with this recommendation. As of January 2020, the department stated that it was developing a department-wide risk management plan, to include a risk management strategy, and this would be completed by May 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 10)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. As of January 2020, HHS stated that it is drafting a cybersecurity risk management memo that will detail its risk management strategy, including how the department will assess, respond to, and monitor risk. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should update the department's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform security control tailoring. (Recommendation 11)

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services partially concurred with this recommendation. As of January 2020, HHS stated that it is in the process of updating its policies to address the missing elements and plans to finalize the revisions by March 2021. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 12)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. As of January 2020, HHS stated that it is drafting a cybersecurity risk management memo and capability model that will include a process for an organization-wide assessment of cybersecurity risk. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that it was in the process of developing an enterprise-wide Cybersecurity Risk Management Strategy that will define cybersecurity risk tolerance thresholds and promote inclusion of cybersecurity risk management into the Department's overall risk management capabilities. The estimated completion date for this effort is July 31, 2020. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 15)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that, once developed, its Cybersecurity Risk Management Strategy will incorporate clarifications of the cybersecurity risk executive's role and will be coordinated with the DHS Office of the Chief Financial Officer, other offices within the DHS Management Directorate, and Department Components, as appropriate. The department estimated completing this effort by July 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Housing and Urban Developing should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 16)

Agency: Department of Housing and Urban Development
Status: Open
Priority recommendation

Comments: The Department of Housing and Urban Development concurred with this recommendation. As of January 2020, the department said it planned to develop a cybersecurity risk management strategy that will determine how cybersecurity risks will be identified, framed, assessed, respond to, and monitored. The Department estimated completing this effort by August 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Interior should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 20)

Agency: Department of the Interior
Status: Open
Priority recommendation

Comments: The Department of the Interior concurred with this recommendation. As of January 2020, the department stated that it cybersecurity and enterprise risk management teams would establish a process for bi-directional communication and status reporting. The Department estimated completing this effort by July 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Attorney General should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 21)

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: In its comments on our draft report, the Department of Justice did not state whether it concurred with this recommendation. As of January 2020, . the department reported that it had an integrated strategy for identifying, prioritizing, assessing, responding to, monitoring, and reporting on cybersecurity risks. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Attorney General should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 22)

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: In its comments on our draft report, the Department of Justice did not state whether or not it concurred with this recommendation. As of January 2020, the department stated that it is developing an ongoing mechanism to institutionalize coordination between its cybersecurity and ERM functions in fiscal year 2020. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Labor should update the department's policies to require (1) the use of risk assessments to inform control tailoring and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 23)

Agency: Department of Labor
Status: Open

Comments: The Department of Labor concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of State should update the department's policies to require (1) an organization-wide risk assessment, (2) an organization-wide strategy for monitoring control effectiveness, (3) system-level risk assessments, (4) the use of risk assessments to inform security control tailoring, and (5) the use of risk assessments to inform POA&M prioritization. (Recommendation 24)

Agency: Department of State
Status: Open

Comments: The Department of State concurred with this recommendation. As of January 2020, the department stated that it is actively working to update the applicable policies and procedures. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of State should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 25)

Agency: Department of State
Status: Open
Priority recommendation

Comments: The Department of State concurred with this recommendation. As of January 2020, the department stated that it is actively working to update the applicable policies and procedures. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Transportation should fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 26)

Agency: Department of Transportation
Status: Open
Priority recommendation

Comments: The Department of Transportation concurred with this recommendation. As of January 2020, the department stated that it would update its cybersecurity risk management strategy to include the identified missing elements. The Department estimated completing this effort by October 1, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Transportation should update the department's policies to require an organization-wide risk assessment. (Recommendation 27)

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation concurred with this recommendation. As of January 2020, the department stated that it would update it policies and procedures to require an organization-wide cybersecurity risk assessment. The Department estimated completing this effort by July 1, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 29)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 30)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 31)

Agency: Department of the Treasury
Status: Open

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 32)

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, the department stated that it plans to develop a comprehensive risk management strategy in accordance with its updated cybersecurity program directive and plans to finalize the strategy by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should update the department's policies to require an organization-wide cybersecurity risk assessment. (Recommendation 33)

Agency: Department of Veterans Affairs
Status: Open

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA stated that it plans to incorporate this requirement into its updated policies by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 34)

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA stated that it plans to fully document its process for an organization-wide cybersecurity risk assessment by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 35)

Agency: Department of Veterans Affairs
Status: Open

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA described efforts under way to institutionalize coordination between cybersecurity and enterprise risk management functions and stated that this coordination will be documented in detail by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 38)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that its strategic plans are under review beginning in the fourth quarter of fiscal year 2020. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should update the agency's policies to require an organization-wide cybersecurity risk assessment. (Recommendation 39)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that it is establishing a process to review, update, and reissue its policies. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 40)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 41)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of General Services should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 44)

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: The General Services Administration concurred with this recommendation. As of January 2020, the agency stated that it would establish a process for conducting an organization-wide cybersecurity risk assessment. The administration estimated completing this effort by June 30, 2020. Once the administration has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the National Aeronautics and Space Administration (NASA) should update the agency's policies to require (1) an organization-wide risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 46)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. As of January 2020, the agency stated that it is working to address gaps in its cybersecurity policy. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of NASA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 47)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA concurred with this recommendation. As of January 2020, NASA stated that the agency is in the process of documenting its process for conducting an organization-wide cybersecurity risk assessment. NASA's planned completion date for this effort is September 30, 2020. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of NRC should update the agency's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 50)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of NRC should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 52)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management (OPM) should update the agency's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform control tailoring. (Recommendation 53)

Agency: Office of Personnel Management
Status: Open

Comments: OPM concurred with this recommendation. As of January 2020, OPM stated that it planned to update its policies to address the missing elements. Once OPM has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Director of OPM should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 54)

Agency: Office of Personnel Management
Status: Open
Priority recommendation

Comments: OPM concurred with this recommendation. As of January 2020, the office stated that it planned to formalize its process for an organization-wide cybersecurity assessment. Once OPM has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of SBA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 57)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA concurred with this recommendation. As of January 2020, SBA stated that it intends to finalize its process for an agency-wide cybersecurity risk assessment by March 31, 2020. Once SBA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Commissioner of the Social Security Administration should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 58)

Agency: Social Security Administration
Status: Open
Priority recommendation

Comments: SSA concurred with this recommendation. As of January 2020, SSA stated that it has initiated a formal process for coordination between its cybersecurity risk management and enterprise risk management teams and that this process should be fully established by the third quarter of FY 2020. Once SSA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should develop performance metrics for the department's EEO program including a mechanism for tracking progress towards eliminating barriers. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: DHS component EEO Directors, in consultation with the Deputy Officer for EEO and Diversity, should develop policies and procedures to help ensure that their component EEO programs have action plans for addressing deficiencies in their Management Directive 715 (MD-715) reports. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: On May 11, 2020, DHS provided GAO with copies of standard operating procedures for addressing EEO program deficiencies for seven out of eight operational components as well as DHS headquarters. Each of the components' standard operating procedures require that action plans are in place to address any outstanding EEO program deficiencies.

Recommendation: The Deputy Officer for EEO and Diversity should develop a formal staffing model for its EEO program. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: DHS component EEO Directors, in collaboration with the Deputy Officer for EEO and Diversity, should develop component formal staffing models. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: The Secretary of Homeland Security—in consultation with the Office for Civil Rights and Civil Liberties (CRCL) and EEOC, and other agencies and components, as relevant—should analyze options for granting additional authorities to the Deputy Officer for EEO and Diversity to ensure DHS components comply with MD-715 guidance, including the authority of the Deputy Officer for EEO and Diversity to certify components' MD-715 reports. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: The Assistant Secretary of State for Consular Affairs should provide additional training or related resources to consular officers and locally employed staff on adjudicating E-2 visas, to cover topics that include the E-2 eligibility requirements and understanding business- and tax-related documents. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to address this recommendation by increasing the frequency and specificity of E-2 content through webinars, workshops, and cables. The Department of State also plans to develop subject matter experts on business and tax related documents that can provide consultative services on an as-needed basis. As of July 2020, Department of State officials said that they had not yet implemented these actions. We will continue to monitor the status of this recommendation.

Recommendation: The Assistant Secretary of State for Consular Affairs should develop minimum standards for E-2 company registration programs, such as standards for how often companies are to be re-vetted. (Recommendation 2)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to address this recommendation by incorporating into policy a 5-year mandatory review of companies registered at any post using a company registration program. As of July 2020, Department of State officials said that they had not yet implemented these actions. We will continue to monitor the status of this recommendation.

Recommendation: The Assistant Secretary of State for Consular Affairs should develop and implement a process to ensure that posts maintain required E-2 visa application documentation. (Recommendation 3)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to communicate a reminder to posts abroad that there is a requirement to scan required E-2 documentation into each visa applicant's record. Department of State also plans to provide regular policy guidance to consular managers at posts that adjudicate E-2 visa applications. Further, Department of State officials stated in July 2020 that the department plans to incorporate the supplemental E-2 visa application (DS-156E) into the standard online application for all nonimmigrant visa applicants (DS-160). However, the officials stated that they experienced technical challenges in doing so, and was still working to resolve the challenges as of July 2020. We will continue to monitor the status of this recommendation as the Department of State works to address the technical challenges.

Recommendation: The CBP Commissioner, in conjunction with the DHS Office of the Chief Readiness Support Officer, should develop and implement a plan to ensure that CBP executes its Facility Condition Assessments (FCA) program by conducting FCAs at each CBP-owned land border crossing consistent with DHS Directive 119-02-004. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in March 2020, provided a plan for conducting FCAs at some, but not all, CBP-owned land border crossings. According to officials, CBP will update this plan to include all CBP-owned land border crossings and may coordinate with the DHS Office of the Chief Readiness Support Officer to ensure the plan is consistent with DHS Directive 119-02-004. To fully address this recommendation, CBP should complete the FCA plan to include all CBP-owned land border crossings.

Recommendation: The CBP Commissioner should share FCA reports with GSA and use facility condition information in GSA's Building Assessment Tool to inform FCAs. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in February 2020, GSA confirmed that it received FCA reports from CBP for GSA-owned land border crossings. GSA also confirmed that it provided CBP with a spreadsheet containing data from GSA Building Assessment Tools. To fully address this recommendation, CBP should demonstrate that it is using GSA Building Assessment Tool information to inform its FCAs at GSA-owned land border crossings.

Recommendation: The GSA Administrator should share Building Assessment Tool reports with CBP and use facility condition information in CBP's FCAs to inform its assessments through the Building Assessment Tool. (Recommendation 3)

Agency: General Services Administration
Status: Open

Comments: GSA concurred with the recommendation and, in April 2020, provided documentation that it received CBP FCAs and provided Building Assessment Tool information to CBP. GSA further provided updated guidance describing how it will share this information with CBP going forward. To fully address this recommendation, GSA should demonstrate that it using CBP FCA reports to inform its Building Assessment Tool assessments.

Recommendation: The GSA Administrator, in conjunction with CBP, should share with CBP information on GSA maintenance and repair work at GSA-owned land border crossings at the level of detail necessary to inform CBP's data in TRIRIGA. (Recommendation 4)

Agency: General Services Administration
Status: Open

Comments: GSA concurred with the recommendation and, in December 2019, stated that it would share this information with CBP on a monthly basis until it is available to CBP for self-service on a shared data system. To fully address this recommendation, GSA should provide documentation that CBP has access to the shared data system.

Recommendation: The CBP Commissioner should use information on maintenance and repair work conducted by GSA at GSA-owned land border crossings to update facility condition information in TRIRIGA on an ongoing basis. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in December 2019, reported that it began documenting processes for validating and correcting existing records in TRIRIGA using information on maintenance and repair work conducted by GSA. In addition, CBP reported that it is developing a standard operating procedure for TRIRIGA data entry. To fully address this recommendation, CBP should demonstrate that it is regularly receiving information on maintenance and repair work performed by GSA and that it is using this information to update data in TRIRIGA.

Recommendation: The CBP Commissioner should establish review time frames for stakeholders involved in its Five-year Capital Investment Plan review and approval process. (Recommendation 6)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in April 2020, provided a document establishing time frames for stakeholders involved in the five-year plan review and approval process. To fully address this recommendation, CBP should demonstrate that it has communicated these time frame expectations to stakeholders.

Recommendation: The CBP Commissioner should establish and document a methodology for its annual land border crossing capital prioritization process that includes procedures and time frames for each step. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in April 2020, provided a document that formally establishes and documents a methodology for its land border crossing prioritization process, including procedures and time frames for each step. To fully address this recommendation, CBP should demonstrate that it is implementing this methodology during its annual five-year capital investment planning process.

Recommendation: The EPA Administrator should direct EPA officials responsible for appointing advisory committee members to follow a key step in its appointment process—developing and including draft membership grids in appointment packets with staff rationales for proposed membership—for all committees. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In September 2019, EPA restated its reasons for disagreeing with this recommendation. (EPA's rationale for disagreeing was originally stated in a June 2019 letter included in an appendix in our report.) We will provide updated information regarding this recommendation when it becomes available.

Recommendation: EPA's Designated Agency Ethics Official should direct EPA's Ethics Office, as part of its periodic review of EPA's ethics program, to evaluate—for example, through audits or spot-checks—the quality of financial disclosure reviews for special government employees appointed to EPA advisory committees. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In August 2019, EPA notified GAO that it expects to launch an electronic financial disclosure reporting system for special government employees in January 2021. Once financial disclosure forms for these individuals are available electronically, EPA's Ethics Office will be better positioned to audit or review the forms, according to EPA officials. In addition, the electronic filing system should minimize errors (e.g. failing to record the date that the form was received) made by filers and reviewers, according to EPA officials.

Recommendation: The Chief Operating Officer of Federal Student Aid should obtain data in order to verify income information for borrowers reporting zero income on IDR applications. For example, Education could pursue access to federal data sources or obtain access to an appropriate private data source. (Recommendation 1)

Agency: Department of Education: Office of Federal Student Aid
Status: Open

Comments: Education generally agreed with this recommendation. Education stated that the President's fiscal year 2020 budget request includes a proposal that Congress pass legislation allowing the IRS to disclose tax return information directly to the department for the purpose of administering certain federal student financial aid programs. According to the agency, such legislation, if enacted, would allow borrowers to more easily certify their income on an annual basis to maintain enrollment in IDR plans, and allow the department to use the information to mitigate improper payments to borrowers as a result of misreported income data. Section 3 of the Fostering Undergraduate Talent by Unlocking Resources for Education Act (FUTURE Act), enacted in December 2019, provided Education with statutory authority to access certain Internal Revenue Service data for the purpose of determining eligibility for IDR plans, among other things (Public Law 116-91). As of August 2020, Education had begun planning for the implementation of the legislation. The Congressional Budget Office estimated that use of this authority to verify eligibility for IDR plans could result in over $2 billion in savings for 2020-2029.

Recommendation: The Chief Operating Officer of Federal Student Aid should implement data analytic practices, such as data matching, and follow-up procedures to review and verify that borrowers reporting zero income on IDR applications do not have sources of taxable income at the time of their application. (Recommendation 2)

Agency: Department of Education: Office of Federal Student Aid
Status: Open

Comments: Education agreed with this recommendation, and from January to March 2020 initiated a pilot program with three of its loan servicers to conduct additional verification of income or family size information on IDR plan applications for a random sample of borrowers each month. When initiated, the pilot focused on IDR borrowers who self-certified that they had no income or who reported certain family sizes. According to Education, selected borrowers would be asked to provide documentation to their servicers to support the income or family size reported on their IDR application. In the event errors were identified, servicers would work with the borrowers to update their applications. If these reviews resulted in changes to a borrower's monthly payment amount, the borrower would be expected to begin paying the new amount within the next 60 days. According to Education, as of the end of March 2020 when the pilot was put on hold, participating servicers selected 48,855 borrowers for verification. The verification pilot was put on hold as it implemented student loan relief for borrowers under the CARES Act in response to the COVID-19 global pandemic (Public Law 116-136). Specifically, on March 27, 2020, the CARES Act was enacted, which suspended student loan payments due, interest accrual, and involuntary collections for Direct and Federal Family Education Loans held by Education through September 30, 2020. According to Education, the Department suspended all IDR recertifications during this period. On August 8, 2020, the President issued a presidential memorandum directing the Secretary of Education to extend this relief to borrowers through December 31, 2020. Education reported that it will weigh options for resuming the pilot against other critical priorities and available resources, noting that its long-term strategy is to fully implement the authorities granted under the FUTURE Act, which provides Education with statutory authority to access certain Internal Revenue Service data for the purpose of determining eligibility for IDR plans, among other things (Public Law 116-91). GAO will continue to monitor Education's actions in this area, and will close the recommendation when Education provides documentation that it has implemented data analytic practices and follow-up procedures to review and verify that borrowers reporting zero income on IDR applications do not have sources of taxable income at the time of their application.

Recommendation: The Chief Operating Officer of Federal Student Aid should implement data analytic practices, such as data mining, and follow-up procedures to review and verify family size entries in IDR borrower applications. For example, Education could review and verify all borrower reports of family size or a subset identified as being most susceptible to fraud or error. (Recommendation 3)

Agency: Department of Education: Office of Federal Student Aid
Status: Open

Comments: Education agreed with this recommendation, and from January to March 2020 established a pilot program with three of its loan servicers to conduct additional verification of income or family size information on IDR plan applications for a random sample of borrowers each month. When initiated, the pilot focused on IDR borrowers who self-certified that they had no income or who reported certain family sizes. According to Education, selected borrowers would be asked to provide documentation to their servicers to support the income or family size reported on their IDR application. Education noted that under the pilot, loan servicers were required to request additional information from borrowers to verify family sizes greater than five; specifically, a statement listing each family member residing with the borrower and for whom the borrower pays at least 51 percent of the support. In the event errors were identified, servicers would work with the borrowers to update their applications. If these reviews resulted in changes to a borrower's monthly payment amount, the borrower would be expected to begin paying the new amount within the next 60 days. According to Education, as of the end of March 2020 when the pilot was put on hold, participating servicers selected 48,855 borrowers for verification. The verification pilot was put on hold as Education implemented student loan relief for borrowers under the CARES Act in response to the COVID-19 global pandemic (Public Law 116-136). Specifically, on March 27, 2020, the CARES Act was enacted, which suspended student loan payments due, interest accrual, and involuntary collections for Direct and Federal Family Education Loans held by Education through September 30, 2020. According to Education, the Department suspended all IDR recertifications during this period. On August 8, 2020, the President issued a presidential memorandum directing the Secretary of Education to extend this relief to borrowers through December 31, 2020. Education reported that it will weigh options for resuming the pilot against other critical priorities and available resources, noting that its long-term strategy is to fully implement the authorities granted under the FUTURE Act, which provides Education with statutory authority to access certain Internal Revenue Service data for the purpose of determining eligibility for IDR plans, among other things (Public Law 116-91). GAO will continue to monitor Education's actions in this area, and will close the recommendation when Education provides documentation that it has implemented data analytic practices and follow-up procedures to review and verify family size entries in IDR borrower applications.

Recommendation: The Commissioner of FHA should enhance the content and communication of FHA's policies and procedures on conveyance condition, including by considering the program stakeholder views discussed in this report and other stakeholder input. (Recommendation 1)

Agency: Department of Housing and Urban Development: Federal Housing Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of FHA should develop a formal plan for evaluating the outcomes of the preconveyance inspection pilot that includes key elements of evaluation design—such as evaluation objectives and measures—and utilizes participant feedback and control groups, as appropriate. (Recommendation 3)

Agency: Department of Housing and Urban Development: Federal Housing Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Labor should document internal policies and procedures for managing the IRA prohibited transaction exemption process. (Recommendation 1)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and plans to create an internal procedure manual which will document the Office of Exemption Determinations' process for managing IRA prohibited transaction exemption applications. When we confirm what actions DOL has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Labor, in consultation with the Commissioner of Internal Revenue, should establish a formal means, such as a memorandum of understanding or other mechanism, to support and guide DOL's and IRS's collaborative efforts to oversee IRA prohibited transaction exemptions. (Recommendation 2)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and plans to periodically discuss all IRA exemption cases with IRS and did not elaborate on the formal means for this information sharing. IRS said that it has met with DOL to formalize collaboration on exemptions from prohibited transaction treatment in IRAs. DOL agreed to contact IRS within 25 days of DOL receiving an IRA prohibited transaction exemption application to determine if there are any Internal Revenue Code issues. To avoid any disclosure concerns, DOL will not identify the applicant at that time. This new process will be reflected in DOL's forthcoming internal procedure manual for the prohibited transaction exemption process.

Recommendation: The Commissioner of Internal Revenue, in consultation with the Secretary of Labor, should establish a formal means, such as a memorandum of understanding or other mechanism, to support and guide DOL's and IRS's collaborative efforts to oversee IRA prohibited transaction exemptions. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation and said it has met with DOL to formalize collaboration on exemptions from prohibited transaction treatment in IRAs. DOL agreed to contact IRS within 25 days of DOL receiving an IRA prohibited transaction exemption application to determine if there are any Internal Revenue Code issues. To avoid any disclosure concerns, DOL will not identify the applicant at that time. This new process will be reflected in DOL's forthcoming internal procedure manual for the prohibited transaction exemption process.

Recommendation: The Director of ICE should take action to ensure consistent implementation of ICE's policies for handling cases of potentially removable veterans. (Recommendation 1)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE has developed policies for handling cases of potentially removable Veterans, but does not consistently adhere to those policies. Therefore, some veterans who were removed may not have received the level of review and approval that ICE has determined is appropriate for cases involving veterans. We recommended that ICE take action to ensure consistent implementation of its policies for handling cases of potentially removable veterans. ICE agreed with this recommendation. In November 2019, ICE reported that it had established a working group to gather requirements for ERO officer and HSI agent training and will identify all of the lesson plans, practice exercises, and checklists to ensure veteran status information is collected during the booking process. In July 2020, ICE reported that the efforts of the working group were ongoing. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The Director of ICE should develop and implement a policy or revise its current polices to ensure that ICE agents and officers identify and document veteran status when interviewing potentially removable individuals. (Recommendation 2)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE has not developed a policy to identify and document all military veterans it encounters. Without such a policy, ICE has no way of knowing whether it has identified all of the veterans it has encountered and, therefore, does not have reasonable assurance that it is consistently implementing its policies and procedures for handling veterans' cases. We recommended that ICE develop and implement a policy or revise its current policies to ensure that ICE offices and agents identify and document veteran status when interviewing potentially removable individuals. ICE agreed with this recommendation. In November 2019, ICE reported that its internal working group is gathering requirements to systematically collect and maintain veteran status information. ICE noted that once the requirement gathering is complete it will revise existing ICE guidance on the issuance of issuing Notices to Appear for individuals with U.S. military service. In July 2020, ICE reported that the working group reviewed and updated its current policy and the Office of Policy and Planning is in the process of reviewing the updates. However, ICE was unable to provide an estimated completion date for finalizing the policy. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The Director of ICE should collect and maintain complete and electronic data on veterans in removal proceedings or who have been removed. (Recommendation 3)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE does not maintain complete electronic data on veterans who have been placed in removal proceedings or removed. As a result, ICE does not know exactly how many veterans have been placed in removal proceedings or removed, or if their cases have been handled according to ICE's policies. We recommended that ICE collect and maintain electronic data on veterans in removal proceedings or who have been removed. ICE agreed with this recommendation. In November 2019, ICE reported that its internal working group is analyzing systems and processes used by ICE officers and agents to identify the components in need of updating to properly capture veteran status. As of July 2020, the working group has identified fields that will be added to its integrated database to capture and maintain veterans' status information. Once the working group is done gathering systems, procedural, and training requirements, this work will also identify updates needed for ICE policies for handling cases of potentially removable veterans. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The Administrator of GSA should take steps to reconcile G-REX and the Federal Real Property Profile to the extent practical. (Recommendation 1)

Agency: General Services Administration
Status: Open

Comments: GSA is taking steps to implement this recommendation. GSA staff summarized the agency's approach to addressing the recommendation in a January 2020 meeting. GAO agreed to check progress with GSA in the summer of 2020.

Recommendation: The Administrator of GSA should develop a process for assessing at regular intervals, such as annually, agencies' policies and procedures for managing their delegated leasing activities. (Recommendation 2)

Agency: General Services Administration
Status: Open

Comments: GSA is taking steps to implement this recommendation. GSA staff summarized the agency's approach to addressing the recommendation in a January 2020 meeting. GAO agreed to check progress with GSA in the summer of 2020.

Recommendation: The Administrator of GSA should develop a process that would allow GSA to track agencies' progress in meeting GSA management goals, such as cost effective lease rates, and avoiding holdovers. (Recommendation 3)

Agency: General Services Administration
Status: Open

Comments: GSA is taking steps to implement this recommendation. GSA staff summarized the agency's approach to addressing the recommendation in a January 2020 meeting. GAO agreed to check progress with GSA in the summer of 2020.

Recommendation: The Administrator of GSA should develop a systematic, risk-based process for monitoring a selection of submitted post award documents. (Recommendation 4)

Agency: General Services Administration
Status: Open

Comments: GSA is taking steps to implement this recommendation. GSA staff summarized the agency's approach to addressing the recommendation in a January 2020 meeting. GAO agreed to check progress with GSA in the summer of 2020.

Recommendation: The Director of the Division of Risk Management Supervision of FDIC should take steps to improve the completeness of matters requiring board attention (MRBA) data in its tracking system, in particular, by developing a structure that allows examiners to record MRBAs at progressively more granular levels (from a broad level such as examination area to more specific levels, including risk or concern type). (Recommendation 3)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: FDIC agreed that a structure should be enhanced to allow staff to further categories MRBAs at the point of entry into the system. As of March 2020, no action has been taken on this recommendation. GAO will continue to monitor for any updates to FDIC procedures.

Recommendation: The Chief Operating Officer of EXIM should consider establishing documented policies and procedures for (1) determining medium-term delegated authority lenders' eligibility for continued participation in EXIM's programs and (2) decertifying or taking other appropriate actions for such lenders that do not meet compliance or eligibility standards. (Recommendation 1)

Agency: Export-Import Bank of the United States
Status: Open

Comments: EXIM concurred with our recommendation and stated that it will consider establishing documented policies and procedures for determining medium-term delegated authority lenders' eligibility for continued participation in EXIM's programs and decertifying or taking other appropriate actions for such lenders that do not meet compliance or eligibility standards. If implemented effectively, EXIM's planned actions should address the intent of our recommendation. An EXIM official indicated that actions to address this recommendation would be completed during 2020.

Recommendation: The Chief Operating Officer of EXIM should establish documented policies and procedures for periodically reviewing credit programs in which the government bears more than 80 percent of any loss to determine whether private sector lenders should bear a greater share of the risk. (Recommendation 2)

Agency: Export-Import Bank of the United States
Status: Open

Comments: EXIM concurred with this recommendation and stated that it will establish documented policies and procedures for periodically reviewing credit programs in which the government bears more than 80 percent of any loss to determine whether private sector lenders should bear a greater share of the risk. If implemented effectively, EXIM's planned actions should address the intent of our recommendation. An EXIM official indicated that actions to address this recommendation would be completed during 2020.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials implement the necessary actions to effectively address the two primary causes of the significant deficiency in IRS's internal control over unpaid assessments. These actions should (1) resolve the system limitations affecting the recording and maintenance of reliable and appropriately classified unpaid assessments and related taxpayer data to support timely and informed management decisions, and enable appropriate financial reporting of unpaid assessment balances throughout the year, and (2) identify the control deficiencies that result in significant errors in taxpayer accounts and implement control procedures to routinely and effectively prevent, or detect and correct, such errors. (Recommendation 19-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS documented the key management decisions in the design and use of the estimation process. This step should reduce the risk that IRS may perform sampling procedures inconsistent with management intent or plans. Continued management commitment and sustained efforts are necessary to build on the progress made to date and to fully address IRS's remaining unresolved issues concerning the management and reporting of unpaid assessments. We will assess IRS's progress in addressing these issues during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials document and implement a formal comprehensive strategy to provide reasonable assurance concerning its nationwide coordination, consistency, and accountability for internal control over key areas of physical security. This strategy should include nationwide improvements for (1) coordinating among the functional areas involved in physical security; (2) implementing and monitoring the effectiveness of physical security policies, procedures, and internal controls; and (3) ongoing communication in identifying, documenting, and taking corrective action to resolve underlying control issues that affect IRS's facilities. (Recommendation 19-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that Facilities Management and Security Services is in the process of developing and documenting a formal, comprehensive strategy. According to IRS officials, this strategy will include different overarching goals, such as improving workforce effectiveness, ensuring appropriate monitoring functions and employee accountability, and improving coordination and communication of policies and procedures. IRS plans to complete the formal, comprehensive strategy during fiscal year 2020 and finalize the implementation of this strategy by March 2021.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials determine the reasons staff did not consistently comply with IRS's existing requirement for maintaining an emergency contact list at all of its facilities and, based on this determination, establish a process to enforce compliance with the requirement. (Recommendation 19-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS used a questionnaire survey and obtained feedback from security section chiefs and physical security specialists to determine the reasons staff did not consistently comply with IRS's existing requirement to maintain an emergency contact list at all IRS facilities. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will establish a process to better enforce compliance with the requirement based on the results of the feedback obtained.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials establish and implement policies and procedures requiring that corrective actions be documented in the Alarm Maintenance and Testing Certification Report for malfunctioning alarms identified in the annual alarm tests. (Recommendation 19-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will (1) update the Internal Revenue Manual to reflect the requirement to use the Alarm Maintenance and Testing Certification Report to document alarm testing results, including any malfunctioning alarms and related corrective actions taken, as appropriate;, and (2) review the Alarm Maintenance and Testing Certification Report Form and incorporate any additional instructions and fields to document the specific alarms tested, the testing results, and related corrective actions taken, as appropriate.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement policies or procedures, or both, to provide reasonable assurance that the video surveillance systems at all IRS facilities record activity at the correct time and are properly secured. The policies or procedures should include periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment and systems. (Recommendation 19-05)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will develop, document, and implement policies or procedures, or both, to provide reasonable assurance of the accuracy and physical security of the video surveillance systems at all IRS facilities by including periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented. (Recommendation 19-06)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Information Technology and the Criminal Investigation organizations will update and implement their policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials (1) identify the reason IRS's policies and procedures related to the transmittal forms were not always followed and (2) design and implement actions to provide reasonable assurance that SB/SE units comply with these policies and procedures. (Recommendation 19-07)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that the Small Business/Self-Employed (SB/SE) Field Collection organization determined that the reasons the policies and procedures were not always followed were either a lack of understanding of the requirements or a lack of consistency in adhering to them. In order to address this, in October 2019, Field Collection distributed a memorandum to its area directors, territory managers, and group managers, reminding them of the required remittance processing procedures, emphasizing the importance of following the procedures, and requesting that they distribute the information in the memorandum within their organization. IRS officials stated that the memorandum will help assure that SB/SE Field Collection units comply with the applicable policies and procedures. Since this memorandum was issued after the end of our fiscal year 2019 audit, we will review the implementation of this action during our fiscal year 2020 audit. Further, IRS officials stated that during fiscal year 2020, the SB/SE Examination organization will identify the reason that IRS's policies and procedures for transmittal forms were not followed, and based on this, it will add guidance to the applicable Internal Revenue Manual sections to clarify and supplement the service-wide guidance for the appropriate control, monitoring, and review of the forms used to transmit packages containing personally identifiable information.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including specifying how the information should be validated. (Recommendation 19-08)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, the Information Technology (IT) organization updated IRS's Integrated Data Retrieval System (IDRS) security policy contained in the Internal Revenue Manual to ensure that the IDRS account administration process complies with IRS's personnel security policy regarding background investigation completion dates. In addition, IRS officials stated that by November 2020, the IT organization will update the Unit Security Representative (USR) designation form, as well as policies and procedures, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including how the information should be validated.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement procedures to clearly specify the tax refund data elements that PVS COs are required to verify before certifying the tax refunds in SPS. (Recommendation 19-09)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Information Technology organization updated its standard operating procedures to clearly specify the tax refund data elements that the Processing Validation Section Certifying Officers are required to verify before certifying the tax refunds in the Secure Payment System. Since IRS completed this action after we had already performed our fiscal year 2019 testing related to the certification of tax refunds, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement a review process to provide reasonable assurance that the RSNs that Data Conversion key entry operators enter into the ISRP system and post to the master files are correct. (Recommendation 19-10)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Wage & Investment organization will establish and implement a review process to provide reasonable assurance that the Refund Schedule Numbers on manual refund forms are transcribed accurately into the Integrated Submission and Remittance Processing system.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials implement a validity check in the ISRP system to confirm that RSNs that Data Conversion key entry operators enter into the system have the required 14 digits. (Recommendation 19-11)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS officials stated that the Wage and Investment organization agrees that developing and implementing a Unified Work Request for programming changes is needed to systemically validate the refund schedule numbers input into the Integrated Submission and Remittance Processing system; however, IRS officials indicated that the organization is unable to commit to implementing a corrective action because of budgetary constraints. As a result, IRS will place this recommendation on hold until funds are available.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to require that reviewers follow up with tax examiners to verify the errors that tax examiners made in working on cases related to suspicious or questionable tax returns are corrected. (Recommendation 19-12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by April 2020, IRS will update and implement policies or procedures, or both, requiring that reviewers follow up with tax examiners to verify that the errors tax examiners made in working a case related to suspicious or questionable tax returns are corrected.

Recommendation: The Administrator of CMS should develop and communicate a policy that defines when changes to a pending section 1115 demonstration application are considered major and should prompt a new review of the application against the transparency requirements applicable to the pending application. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In response to this recommendation, HHS stated that existing regulations permit CMS at its discretion to direct an additional public comment period when states make a modification to an application that substantially changes the design. In July 2020, CMS officials said the agency would continue to exercise its regulatory discretion as needed and planned no further action in response to this recommendation. In light of past CMS decisions to not require states to first seek public comment before submitting major changes to their demonstration applications, we maintain that a policy is needed defining when changes are considered major and should prompt a new review of the application against transparency requirements. We will continue to monitor CMS's actions in this area.

Recommendation: The Administrator of CMS should develop and communicate a policy whereby applications for section 1115 demonstration amendments that may have significant impact are subject to transparency requirements comparable to those for new demonstrations and extensions. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS stated that it plans to implement a policy applying state public input processes and application criteria to amendments proposing significant or substantial changes in the same manner as for new demonstrations. In July 2020, CMS stated the agency plans to develop criteria for determining whether an amendment application proposes a substantial change to an existing demonstration and to include this in guidance by early 2021. We will continue to monitor CMS's actions in this area and will close this recommendation once this policy guidance is issued.

Recommendation: The Director of OMB should clarify and document OMB's procedure for changing official data definition standards for DATA Act reporting, for example, by explicitly describing how change procedures developed for other government-wide initiatives apply to DATA Act definition standards in a public source of guidance or information. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB has taken steps to restructure the federal data ecosystem, including issuing government-wide guidance covering all federal data and creating a Business Standards Council. However, given the complexity of recent changes, OMB needs to explicitly and publicly describe how those changes-developed in the context of other government-wide initiatives-apply to DATA Act data element definitions.

Recommendation: The Director of OMB should ensure that the June 2018 policy changes regarding DATA Act data definition standards are clearly identified and explained in the official repository or another authoritative public source of DATA Act standards and guidance, such as by including a revision history along with the current version of the definitions. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In January 2020, OMB staff cited its Federal Spending Transparency Data Standards website and specifically notations on that site regarding the dates of revisions made to those standards as being responsive to this recommendation. However, the specific notations cited by OMB only show changes made back in 2015 and do not reflect nor explain some of the more recent revisions that led to GAO making this recommendation.

Recommendation: Congress should consider taking legislative action to resolve the long-standing issues between the Corps and the Advisory Council on Historic Preservation over the Corps Regulatory Program's procedures for implementing section 106 of the National Historic Preservation Act. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: When we determine what steps the Congress has taken, we will provide updated information

Recommendation: The Secretary of Energy should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with Alaska Native Corporations (ANC) on the same basis as Indian tribes under Executive Order 13175. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy plans to clarify and consolidate its consultation policies and practices for consultation with Alaska Native Corporations by June 2021.

Recommendation: The Administrator of the Environmental Protection Agency should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In December 2019, EPA created a draft document, Guiding Principles for Consulting with Alaska Native Claims Settlement Act Corporations, and issued it for consultation with Alaska Native Corporations (ANCs). The draft guiding principles seek to clarify EPA's consultation and coordination practices with ANCs. Additionally, according to agency officials, an EPA working group is in the process of developing an internal, best practices implementation guide. As of April 2020, EPA expects to finalize these guidance documents in 2020

Recommendation: The Secretary of Housing and Urban Development should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should establish a time frame for developing or updating policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In February 2019, the Department of Homeland Security provided GAO documentation supporting a planned time frame of March 2020 for developing and updating its consultation policy to implement the statutory requirement to consult with ANCs in response to this recommendation. We plan to close the recommendation after reviewing documentation that the policy has been updated.

Recommendation: The Assistant to the Secretary of Agriculture for Rural Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on proposed infrastructure projects. (Recommendation 6)

Agency: Department of Agriculture: Rural Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of Civil Works of the Corps should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 7)

Agency: Department of Defense: Department of the Army: Corps of Engineers: Civil Works
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director for the Bureau of Ocean Energy Management should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 8)

Agency: Department of the Interior: Bureau of Ocean Energy Management
Status: Open

Comments: As of September 2019, Bureau of Ocean Energy Management (BOEM) plans to amend its tribal consultation policy with policies and procedures for communicating with tribes after consultation by December 2020.

Recommendation: The Secretary of Energy should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 10)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy indicated that it plans to document policies for communicating about how input from tribal consultation was considered in agency decisions on infrastructure projects by June 2021.

Recommendation: The Administrator of the Federal Highway Administration should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 14)

Agency: Department of Transportation: Federal Highway Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 16)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 17)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Nuclear Regulatory Commission should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 19)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Transportation should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 20)

Agency: Department of Transportation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Energy should direct the Director of the Office of Project Management and the Assistant Secretary of the Office of Environmental Management to work together to establish requirements for classifying cleanup work as capital asset projects or operations activities. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE developed a draft Cleanup Project Management Policy to clarify the expectations for EM's management of discrete work, such as operations activities that could be considered projects. In February 2020, EM officials stated that they are addressing this recommendation in two steps. First, EM is working with DOE's Office of Project Management to draft a Cleanup Project Management Policy (expected to be completed in spring 2020) to address the Decommissioning and Deactivation (D&D) phase of cleanup. This policy will become an appendix in DOE's Order 413.3B. EM officials further stated that EM plans to develop an additional Cleanup Program Management Policy that would classify the remaining types of activities not covered by the Cleanup Project Management Policy, including what EM currently classifies as operations activities. EM plans to implement this policy by the end of fiscal year 2020.

Recommendation: The Secretary of Energy should direct the Director of the Office of Project Management and the Assistant Secretary of the Office of Environmental Management to work together to asses EM's ongoing operations activities to determine if they should be reclassified as capital asset projects based on the newly established requirements. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE developed a draft Cleanup Project Management Policy to clarify the expectations for EM's management of discrete work, such as operations activities that could be considered projects. In February 2020, EM officials stated that they are addressing this recommendation in two steps. First, EM is working with DOE's Office of Project Management to draft a Cleanup Project Management Policy (expected to be completed in spring 2020) to address the Decommissioning and Deactivation (D&D) phase of cleanup. This policy will become an appendix in DOE's Order 413.3B. EM officials further stated that EM plans to develop an additional Cleanup Program Management Policy that would classify the remaining types of activities not covered by the Cleanup Project Management Policy, including what EM currently classifies as operations activities. EM plans to implement this policy by the end of fiscal year 2020.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to review and revise EM's 2017 cleanup policy to include program management leading practices related to scope, cost, schedule performance, and independent reviews. (Recommendation 3)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate leading practices related to scope, cost, and schedule, and independent reviews, as appropriate. In February 2020, EM officials stated that EM is working on a Cleanup Project Management Policy (expected to be completed in spring 2020) that will cover the Decommissioning and Deactivation (D&D) phase of cleanup. EM plans to develop an additional Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020), which will supersede EM's current cleanup policy and include leading program management practices-and possibly also project management practices-related to scope, cost, schedule performance, and independent reviews.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to review and revise EM's 2017 cleanup policy to include project management leading practices related to scope, cost, schedule performance, and independent reviews. (Recommendation 4)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate leading practices related to scope, cost, and schedule, and independent reviews, as appropriate. In February 2020, EM officials stated that EM is working on a Cleanup Project Management Policy (expected to be completed in spring 2020) that will cover the Decommissioning and Deactivation (D&D) phase of cleanup. EM plans to develop an additional Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020), which will supersede EM's current cleanup policy and include leading program management practices-and possibly also project management practices-related to scope, cost, schedule performance, and independent reviews.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to update its cleanup policy to require that earned value management (EVM) systems be maintained and used in a way that follows EVM best practices. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate earned value management best practices, as appropriate. In February 2020, EM officials stated that EM's forthcoming Cleanup Project Management Policy (expected to be completed in spring 2020) will require capital asset projects covered under the policy to use earned value management (EVM) systems that have been independently certified, which is an EVM best practice. However, EM officials told us that this policy will not require operations activities to follow EVM best practices. EM officials stated that EM is also considering including this requirement in its forthcoming Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020). In addition, EM officials told is that EM plans to require future end-state contracts to use EVM systems that have either been certified by the DOE Office of Project Management or been subject to a "compliance review" conducted by EM itself, depending on the dollar value of the contract.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to develop a policy to ensure that work is categorized as level of effort only in appropriate, specified circumstances, such as when work is not measurable or when measurement is impractical. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to include requirements related to the categorization of level of effort work in the project and program management policies EM is developing.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to integrate EVM data into EM's performance metrics for operations activities. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE is in the process of developing a Cleanup Program Management Policy that will, among other things, incorporate changes relative to the integration of EVM data into performance metrics as appropriate. As of February 2020, EM officials told us that the new policy is expected to be completed by the end of fiscal year 2020. In February 2020, EM officials stated that EM plans to begin a new performance review process for operations activities that will include EVM-based performance metrics as part of annual reporting to the Assistant Secretary. The new process is expected to begin in October 2020, but EM officials have not determined whether this will be a requirement included in EM's forthcoming Cleanup Program Management Policy.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require documentation of examination teams internal deliberations that lead to consequential decisions for the bank, such as the decision whether to issue a Matter Requiring Attention, among others. (Recommendation 1)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that consistently documenting internal deliberations that lead to consequential decisions for the bank could increase the transparency and accountability of examination teams' findings and decisions.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require that bank examination teams retain drafts of key documents, including the conclusion memorandum and supervisory letter, that record the supervisory review process. (Recommendation 2)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that revising the policy to ensure that drafts of key documents are not deleted will help OCC increase the transparency and accountability of the supervisory review process.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require documentation of communications with banks, including those between executive and senior management and banks, that inform supervisory decisions. (Recommendation 3)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that having meeting minutes and other documentation of key communications would provide OCC with a more complete and transparent record of the information banks provide to examiners and how that information impacts supervisory decisions.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should systematically track and monitor Large Bank Supervisions use of informal recommendations. (Recommendation 4)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that tracking and monitoring the use of informal recommendations could increase transparency of the supervisory process, which could help Large Bank Supervision mitigate the risk of regulatory capture.

Recommendation: The Chief Counsel should develop a policy for Large Bank Supervision (1) to check employees active conflicts of interests during the staffing process for examinations and other supervisory activities and (2) to document the results of this check. (Recommendation 6)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020,, OCC continued to disagree with GAO's recommendation and does not plan to develop a policy to check if employees have active conflicts of interest during the staffing process for examinations and other supervisory activities. OCC noted in its December 2018 response letter to the report that they believed such a policy would shift the responsibility for ensuring compliance with recusal requirements from employees to those responsible for staffing. We maintain that this recommendation does not aim to alleviate the personal responsibility all employees have to comply with recusal requirements. Rather, our recommendation aims to strengthen the due diligence of those responsible for staffing by requiring an independent, preliminary check of active conflicts of interest.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command applies leading practices as they relate to technology development, particularly that of demonstrating technology in an operational environment prior to starting system development. (Recommendation 1)

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. Army officials acknowledged the importance of demonstrating technology in an operation environment prior to starting system development and stated that they have taken steps to assist in the identification and removal of infeasible or immature technologies. For example, development of the Integrated Visual Augmentation System includes a series of user engagements where soldiers interact with the system in a field environment and provide feedback to guide development and design. To fully implement this recommendation the Army will need to demonstrate that all of the technologies it is developing are matured in accordance with leading practices. Including soldier engagement in the development of the Integrated Visual Augmentation System is a positive step in that it uses operational experience to determine the utility of technologies on the battlefield. However, demonstrating that those technologies function as expected in an operational environment is equally important. Our past work has shown that demonstrations in an operational environment reduce the risk that technologies will not operate as intended or desired. It is important that the Army continue and expand its efforts to eliminate infeasible, or immature technologies across all of its development programs.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command takes steps to incorporate the experiences of the cross-functional teams in applying leading practices for effective cross-functional teams. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials, cross-functional teams routinely meet to discuss both successes and challenges. Additionally, senior Army leadership hosts weekly meetings with cross-functional teams to discuss decision points and concerns. Army Futures Command plans to include leadership from all cross-functional teams at future meetings to enhance knowledge sharing and ensure leadership viewpoints are communicated across the enterprise. These actions do incorporate elements of leading practices for cross-functional teams such as open and regular communication and senior management support. To fully implement this recommendation the Army should continue and expand this knowledge sharing as planned as well as ensure other elements of leading practices for effective cross-functional teams are implemented. These include the establishment of well-defined team operations with project-specific rules and procedures as well as appropriate training and learning environments for all cross-functional team members.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command executes a process for identifying and incorporating lessons learned from cross-functional team pilots into the new command. (Recommendation 3)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials an analyst from the Center for Army Lessons Learned has embedded a permanent analyst at Army Futures Command who is capturing lessons learned and best practices from across the cross-functional teams. The results of this analysis are provided across Army Futures Command and to other stakeholders. Additionally, Army Futures Command has established the Directorate of Systems Integration to act as a repository and action office for lessons learned. This office hosts recurring coordination events to further the communication of lessons learned .

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command fully applies leading practices for mergers and organizational transformations as roles, responsibilities, policies and procedures are finalized for the new command. (Recommendation 4)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials Army Futures Command is applying leading practices for mergers and organizational transformations as it continues to establish the command. These practices include total employee involvement in the transformation process with senior leadership championing the overarching transformation. In addition, the command has worked to identify processes that need improvement as it incorporates the organizations transferred from other commands. It also continues to evolve its staff and functions as needs are identified. According to officials, Army Futures Command continues to select high-performing team members to guide its transformation through selective recruitment and talent management as well as augmenting its growing staff with other Army personnel selected for temporary assignments. The command is also involving employees to obtain their ideas and gain their ownership for the transformation by encouraging them to share their thoughts and ideas. Importantly, according to officials, the command recognizes the need to have an enduring change model to consistently reassess and reorganize the command to consistently deliver products in relevant timeframes. These actions do demonstrate elements of leading practices for mergers and organizational transformations. However, to fully implement this recommendation, Army Futures Command should formalize and institutionalize its authorities, responsibilities, policies and procedures as they relate to these leading practices, especially as leadership within the command and the Army change.

Recommendation: The Secretary of Defense should ensure that the Chief of the National Guard Bureau take steps to ensure it issues a manual to accompany Chief National Guard Bureau Instruction 3100.01A, National Guard Counterdrug Support, by June 2019. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that the National Guard Bureau had begun updating Chief of the National Guard Bureau Instruction 3100.01A to comply with the most recent published Secretary of Defense guidance and that they planned to expedite the issuance of the accompanying manual. In August 2020, DOD provided GAO with a draft of the manual; however, officials from the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats noted that the manual was still being reviewed within DOD and expected that it would be finalized by the end of December 2020.

Recommendation: The Secretary of Defense should ensure that the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats, in coordination with the Chief of the National Guard Bureau, assess the revised process for reviewing states' plans for their counterdrug activities, and take actions based on the assessment to ensure the plans are approved by the Secretary of Defense before funding is provided to state counterdrug programs, as statutorily required. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats would continue to work with the National Guard Bureau to improve the State Plans review process for fiscal year 2020 and beyond. DOD's response noted that State Plans Guidance will reiterate that, in accordance with statute, funding may not be provided for a State's counterdrug program until the Secretary of Defense has approved its plan. In September 2019, DOD officials from the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats provided information showing improvements in the timing of the review process for approval of the State Plans, but noted more needed to be done in order to ensure all State Plans were approved by the Secretary of Defense prior to funding being provided to State counterdrug programs. In January 2020, officials from the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats stated they were continuing to monitor the updated process for fiscal year 2021 and hoped for further improvements.

Recommendation: The Secretary of Defense should ensure that the Chief of the National Guard Bureau incorporate the strategic counternarcotics priorities, to be outlined in DOD's counternarcotics and global threats strategic framework, into the National Guard Bureau's funding distribution process. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that officials from the Office of the Deputy Assistant Secretary of Defense for Counternarcotics and Global Threats would work with the National Guard Bureau to support its efforts to incorporate and align DOD strategic priorities into its planning and resource allocation processes. In February 2020, DOD documents noted that this recommendation was assigned to the Counterdrug Advisory Counsel and Threat Based Resourcing Model Target Team for action and estimated a December 2020 completion date.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau identifies and implements changes to align census field supervisor screening, authorities, and information flows to allow greater use of the census field supervisor position to provide supervisory support to enumerators. (Recommendation 2)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: In its February 2019 action plan, the Bureau indicated having updated the Census Field Supervisor hiring assessment to include questions on supervisory experience, in line with draft documentation provided near the end of our engagement. The Bureau also indicated that, by June 2019, it would communicate as part of supervisor training increased supervisory responsibilities and the need to more actively work with enumerators in answering casework questions. In August 2020, the Bureau informed us that the Bureau would not be altering the information flows for 2020 operations to ensure that census field supervisors receive the same guidance and procedural updates that managers within the area census office receive. To fully implement this recommendation for future fieldwork, the Bureau's planned or other actions will also need to demonstrate how the census field supervisors will have the information they need to carry out their responsibilities to provide supervisory support to enumerators.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau enables area census offices to prepare targeted, mid-operation training or guidance as needed to address procedural changes or implementation issues encountered locally during Non-Response Follow-Up. (Recommendation 3)

Agency: Department of Commerce
Status: Open

Comments: In its February 2019 action plan, the Bureau indicated that it plans, by June 2019, to give area census offices (ACOs) the ability to distribute training and informational updates to their local workforces through the Operational Control System. As of January 2020, we are reviewing updated Bureau training documentation on planned mid-operation procedural changes. In April 2020, the Bureau informed us that ACOs would not be empowered during 2020 operations to deliver to their workforces standardized, mid-operation guidance that would be targeted to specific issues being observed locally in the field. Officials noted that they would revisit this issue after 2020 operations have concluded. To fully implement this recommendation for future fieldwork, the Bureau will need to demonstrate the ability of ACOs to identify procedural or other implementation issues encountered locally and develop some form of actionable guidance disseminated systematically to its workforce in near-real time.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Health Affairs, in coordination with the military departments, perform an assessment of the suitability of federal civilian and contractor personnel to provide operational medical care and incorporate the results of the assessment into relevant policies, if warranted. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness require consideration of cost when making determinations regarding the mix of active and reserve component medical personnel. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Health Affairs, in collaboration with the Director of Cost Assessment and Program Evaluation and the military departments, develop full cost information for active and reserve component medical personnel, and the military departments use that information in its determinations regarding the mix of active and reserve component medical personnel. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of the Defense Health Agency develop a strategic total workforce plan which includes, among other things: (1) tailored human capital strategies, tools, and metrics by which to monitor and evaluate progress toward reducing personnel gaps, and; (2) integration of human capital strategies with acquisition plans, such as DOD's acquisition strategy for health care services at DOD's military treatment facilities. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense and the Secretaries of the Army, the Navy, and the Air Force, respectively, should ensure that accompanying the transfer of administrative responsibility for military treatment facilities to the Defense Health Agency, that the Defense Health Agency and the military departments develop policies and procedures for management of military personnel, including agreement on specific roles and responsibilities for the military departments and the Defense Health Agency in this process. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of General Services should take steps to improve agency-wide monitoring of exchange/sale activities within GSA by specifying the Office of Administrative Services' responsibilities and by defining the scope of its authority. (Recommendation 2)

Agency: General Services Administration
Status: Open

Comments: As of February 2020, GSA developed and distributed a Standard Operating Procedure that established the Office of Administrative Services as having jurisdiction and program oversight for all internal agency exchange/sale transactions. GSA's Office of Administrative Services had also taken steps to coordinate with other GSA offices to coordinate annual exchange/sale data reporting for the agency. We will continue to monitor GSA's actions in addressing the recommendation.

Recommendation: The VA's Deputy Assistant Secretary of Acquisition and Logistics, in collaboration with the Veterans Health Administration's Office of Procurement and Logistics, should revise VA's policy to include details on the exchange/sale authority, particularly those related to monitoring by Regional Offices and use of the authority for medical centers, and establish time frames with milestones for communicating such information. (Recommendation 3)

Agency: Department of Veterans Affairs
Status: Open

Comments: As of February 2020, VA's Office of Acquisition and Logistics, in conjunction with Veterans Health Administration's Procurement and Logistics Office, was working on updating the status of two policy notices to amend existing policy to include details on the exchange/sale authority and to collect data on exchange/sale usage within the agency as a basis for reviewing progress and compliance with VA utilization officers. We will continue to monitor the status of VA's actions to address our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided documentation regarding its IT budget procedures. However, DOE has not yet developed procedures that explicitly require that all transactions with an IT component be included in the expenditure reporting to the CIO. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided documentation regarding its IT budget procedures. However, DOE has not yet documented procedures for ensuring the CIO is included in budget decisions for all programs with IT resources, including those within NNSA and the national laboratories. We will continue to monitor the agency's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided charters that included the CIO as a member of department-level governance boards that inform IT decisions. However, DOE has not provided charters that include the CIO as a member of component-level IT governance boards. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 4)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided IT governance board and budget procedures. However, DOE has not documented procedures by which the CIO is to work with program leadership in planning IT resources for all programs, including those within NNSA and the national laboratories. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the process for the CIO's review and approval of the major IT investments portion of the budget request. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: The department has provided IT budget procedures. However, DOE has not documented procedures by which the CIO is to review and approve all major IT investments, including those within NNSA and the national laboratories. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the CIO's role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided IT budget procedures. However, DOE has not documented procedures for the CIO's review of IT resources that are to support major program objectives and significant increases and decreases in IT resources for department and component agency budget requests. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. The department has provided IT budget procedures. However, DOE has not developed procedures for documenting steps the CIO is to take to ensure that the IT portfolio includes appropriate estimates of all IT resources. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Energy should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 8)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes--such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data--for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 9)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with our recommendation and is planning to take steps towards implementing it. Specifically, DOE plans to implement the Technology Business Management Framework by December 2021. Additionally, the department is coordinating internally to update its financial and procurement systems to better identify IT spending. DOE anticipates that its updates will allow the agency to compare actual IT spending against estimates in the portfolio. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that establish agency-wide policy for the level of detail with which planned expenditures for all transactions that include IT resources are to be reported to the CIO. (Recommendation 10)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 11)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources. (Recommendation 12)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the process for the CIO's review and approval of the major IT investments portion of the budget request. (Recommendation 13)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the CIO's role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 14)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Administrator of NNSA should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 15)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with this recommendation and plans to develop relevant policies and procedures by June 2020. We will continue to monitor the agency's progress towards implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 16)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with this recommendation and is planning to take steps to implement it. Specifically, the agency intends to update its IT investment planning policy to include requirements for reporting expenditures that apply to all transactions with an IT component. We will continue to monitor the department's progress towards implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 17)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. Specifically, the agency intends to update its IT investment planning policy to amplify the CIO's role in the planning and budgeting stages for all programs with IT resources. Also, HHS intends to document procedures for ensuring that all delegated authorities are carried out. We will continue to monitor the department's progress towards implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 18)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation. The department has provided charters that included the CIO as a member of department-level governance boards that inform IT decisions. However, HHS has not provided charters that include the CIO as a member of component-level IT governance boards. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 19)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. For example, HHS plans to develop an asset management policy and introduce a pilot program to manage inventories across the agency. However, the department has not developed policies and procedures that incorporate the processes by which the program leadership are planning the IT portfolio with the CIO for existing investments greater than or equal to $20 million annually and for investments delegated to components. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the process for the CIO's review and approval of the major IT investments portion of the budget request. (Recommendation 20)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. Specifically, the department intends to update its IT investment planning policy to amplify the CIO's role in reviewing major investments. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the CIO's role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 21)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with this recommendation and has taken steps towards implementing it. Specifically, HHS documented procedures that require the CIO to hold annual IT investment review meetings with components to review changes in IT resources. However, HHS has not documented procedures for the CIO's role in reviewing major program objectives. We will continue to monitor the department's progress toward implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 22)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. Specifically, the department intends to assess and update its existing policies and procedures to document the steps the CIO is to take to review the IT portfolio for appropriate estimates of all IT resources. We will continue to monitor the department's progress toward implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should direct the department CIO to establish, for any OMB common baseline requirements that are related to IT budgeting that have been delegated, a plan that specifies the requirement being delegated, demonstrates how the CIO intends to retain accountability for the requirement, and ensures through quality assurance processes that the delegated official will execute such responsibilities with the appropriate level of rigor. (Recommendation 23)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. Specifically, the department intends to develop an IT governance policy to define the accountability of the CIO over all IT projects and establish processes detailing quality reviews and the level of rigor that should be applied by its IT governance board. We will continue to monitor the department's progress towards implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 24)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and is planning to take steps to implement it. Specifically, the agency intends to update its IT acquisition program policy and related processes. HHS also plans to document standard operating procedures for agency wide dissemination to ensure the effectiveness and efficiency of IT investment governance through transparent and repeatable procedures. We will continue to monitor the agency's progress in implementing our recommendation.

Recommendation: The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes--such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data--for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 25)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS agreed with the recommendation and are planning to take steps towards implementing it. Specifically, HHS established a working group and developed a roadmap for implementing the Technology Business Management Framework by fiscal year 2022. The agency anticipates that its strategy and approach will enable HHS to, among other things, link IT portfolio data, procurement system data, and financial system data. We will continue to monitor the department's progress towards implementing our recommendation.

Recommendation: The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 26)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 27)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the CIO's role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 28)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 29)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 31)

Agency: Department of Justice
Status: Open

Comments: The department agreed with the recommendation and has taken steps towards implementing it. Specifically, in October 2019, the DOJ CIO issued a memorandum requiring component CIOs to establish a process for providing IT investment information to the DOJ CIO. The component CIO's process is to either include the DOJ CIO as a member of component investment review boards or provide an alternative mechanism for obtaining the DOJ CIO's input on component IT investments. We will continue to monitor the department's progress in implementing our recommendation.

Recommendation: The FBI Director should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 34)

Agency: Department of Justice: Federal Bureau of Investigation
Status: Open

Comments: FBI agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 35)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 36)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 37)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the process for the CIO's review and approval of the major IT investments portion of the budget request. (Recommendation 38)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department's FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 39)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should direct the department CIO to establish, for any OMB common baseline requirements that are related to IT budgeting that have been delegated, a plan that specifies the requirement being delegated, demonstrates how the CIO intends to retain accountability for the requirement, and ensures through quality assurance processes that the delegated official will execute such responsibilities with the appropriate level of rigor. (Recommendation 40)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB's common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 41)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes--such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data--for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 42)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the department has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should take steps to improve existing information on federal asset management to reflect leading practices such as those described in ISO 55000 and the key characteristics we identified and make it readily available to federal agencies. These steps could include updating asset management guidance and developing a clearinghouse of information on asset management practices and successful agency experiences. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As of September 2020, OMB has developed guidance to help federal agencies implement the capital planning requirements described in OMB's November 6, 2019 Memorandum 20-3, "Implementation of Agency-wide Real Property Capital Planning." According to OMB officials, this guidance was distributed to agencies in July 2020. Agency plans were due to OMB by August 15,2020. This recommendation remains open pending further information from OMB on the status and contents of these plans.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense--in coordination with the military departments; U.S. Strategic Command; the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs; CAPE; and other relevant components of DOD--identify in the planned charter and DOD directive clear roles and responsibilities for the members of the NDERG. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation. In June 2019, in response to our recommendation, the Deputy Secretary of Defense issued a charter for the NDERG that included information about the roles and responsibilities for the members of the NDERG. The charter also indicated that this information should be included in the appropriate DOD directive and/or issuance. This effort is still in progress.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense--in coordination with the military departments; U.S. Strategic Command; the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs; CAPE; and other relevant components of DOD--establish in the planned charter and DOD directive methods for the NDERG to communicate and collaborate with other organizations that have oversight responsibilities for portions of the nuclear enterprise. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation. In June 2019, in response to our recommendation, the Deputy Secretary of Defense issued a charter for the NDERG that included information about the roles and responsibilities for the members of the NDERG. The charter also indicated that this information should be included in the appropriate DOD directive and/or issuance. This effort is still in progress.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense and Chairman of the Joint Chiefs of Staff--in coordination with the Vice Chairman of the Joint Chiefs of Staff, the Under Secretary of Defense for Acquisition and Sustainment (as the Council on Oversight of the National Leadership Command, Control, and Communications System (NLC3S Council) co-chairs), and U.S. Strategic Command--update the applicable DOD guidance (such as the NLC3S Council's and Executive Management Board's charters) and identify whether there is a need to request changes to statutory or presidential guidance in order to clarify changes to roles and responsibilities for NC3 oversight. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation. As of July 2020, according to DOD officials, DOD is working to update applicable guidance.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense and Chairman of the Joint Chiefs of Staff--in coordination with the Vice Chairman of the Joint Chiefs of Staff, the Under Secretary of Defense for Acquisition and Sustainment (as NLC3S Council co-chairs),and U.S. Strategic Command--update the applicable guidance to establish methods for communication and collaboration among organizations that have oversight responsibilities for portions of the nuclear enterprise as changes are considered for charters, guidance, and laws to reflect the changes to NC3 oversight. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation. As of July 2020, according to DOD officials, DOD is working to update applicable guidance.

Recommendation: FERC should provide standard language and procedures to its staff on how to record information collected during inspections, including how and where to record information about safety deficiencies, in order to facilitate analysis of safety deficiencies across FERC's portfolio of regulated dams. (Recommendation 1)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: In February 2020, GAO confirmed that FERC had developed new standard operating procedures related for tracking deficiencies and follow-up items arising from dam safety inspections and other dam safety reviews. In addition, FERC told GAO that they plan to update their tracking system beginning in fiscal year 2021, which will facilitate the complete recording and subsequent analysis of safety deficiencies from inspections across FERC's portfolio of regulated dams. GAO will continue to monitor FERC's efforts to implement this recommendation.

Recommendation: FERC should use information from its inspections to assess safety risks across its portfolio of regulated dams to identify and prioritize safety risks at a national level. (Recommendation 2)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: In January 2019, FERC told GAO that it had begun developing a screening-level risk-assessment program to assess safety risks across the inventory of regulated dams and to help guide safety decisions. In February 2020, GAO confirmed that FERC had completed this screening-level risk assessment, and conducted some preliminary analysis of the results. In addition, FERC told GAO that the results of the screening level risk analyses will be used to revise the potential timing, frequency, and technical disciplines represented on dam safety inspections; to confirm or revise the urgency of existing and potential new follow up dam safety actions; and to identify previously unrecognized dam safety concerns and issues; to identify new dam safety priorities. GAO will continue to monitor FERC's efforts to implement this program.

Recommendation: The Under Secretary for Benefits should develop and implement a new regional office performance measure that allows it to better measure the accuracy of each regional office's work. (Recommendation 3)

Agency: Department of Veterans Affairs: Veterans Benefits Administration
Status: Open

Comments: VBA is working to develop and implement a new measure to assess the accuracy of each regional office. We will close this recommendation once VA has finalized and implemented the new measure.

Recommendation: Once VA's new software for managing authorizations has been fully implemented, the Undersecretary for Health should monitor data on secondary authorization requests approval decision time frames to ensure VA medical facilities are in adherence with VA policy, assess the reasons for nonadherence with the policy, and take corrective actions as necessary. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA agreed with our recommendation and stated that it has already taken steps to improve compliance with secondary authorization request approval timeframes.by identifying challenges, agreeing on improvement actions, and providing training. According to VA, its new Health Share Referral Manager system, which VA expects will be fully implemented across all medical facilities by December 2019, will automate secondary authorization request reporting and tracking. According to VA, it will utilize this new system to ensure compliance with secondary authorization request approval time frames.

Recommendation: The Undersecretary for Health should collect data and monitor compliance with the Choice Program contractual requirements pertaining to customer service for community providers, and take corrective actions as necessary. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA agreed with our recommendation and stated that it currently does not have the ability to monitor and assess the performance of customer service operations under the Choice Program contracts. VA has included additional requirements for customer service in the Veterans Community Care Network request for proposals and plans to monitor compliance with these requirements under the Veterans Community Care Program. VA expects to implement this recommendation by December 2019.

Recommendation: The Postmaster General should identify and adopt a set of internal control standards that can be used as the basis for operational internal-control activities, such as those for scanning competitive products. (Recommendation 1)

Agency: United States Postal Service
Status: Open

Comments: USPS has completed a cost study to adopt an operational internal control framework. USPS has targeted December 31, 2020, for completion and implementation of this new internal control framework.

Recommendation: The Administrator of SBA should conduct and document reviews of staff compliance with procedures associated with HUBZone certification and recertification. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: In January 2020, SBA officials told us that the agency is re-aligning resources and developing standards to reflect new processing times for certifications and recertifications, which will include revised employee performance elements and quarterly performance reviews. When SBA has completed these changes, we will assess whether the agency is conducting and documenting reviews of staff compliance.

Recommendation: The Commissioner of Internal Revenue should direct the Chief of Appeals, in coordination with the IRS Human Capital Office, to conduct a skills gap analysis specific to Appeals mission needs and develop a strategy for mitigating any identified gaps. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. As of April 2020, the Office of Appeals stated that it is working with the IRS Human Capital Office to design a questionnaire for all Appeals managers to identify the technical and organizational skills necessary to meet organizational short and long-term needs for the Appeals Officer position. This information will be used to conduct a skills gap analysis on the current Appeals workforce and to enhance the selection/hiring process to ensure future hires possess necessary skills. IRS plans to complete these actions by October 2020, and Appeals stated that time frame for this corrective action may be affected by budgetary and resource constraints. GAO will continue to monitor IRS's implementation of this recommendation.

Recommendation: The Commissioner of Internal Revenue should evaluate the existing monitoring for collection due process appeal requests and address deficiencies in collection staff meeting the requirement for timely transfer to the Office of Appeals. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In July 2019, IRS evaluated the existing monitoring for collection due process appeal requests to identify any impediments to collection staff timely transferring these requests to the Office of Appeals and provided the studies and related recommendations to GAO. The affected IRS collection units have developed action plans to address deficiencies in case transfer time. These plans include modifying inventory software to alert both staff and managers on the number of days collection due process requests have been under review. IRS also plans to update relevant IRM documentation in early 2020 to ensure that receipt dates of collection due process appeal requests are recorded for all cases and that there is appropriate notation of reasons why certain cases exceed established timeframes for transfer to the Office of Appeals. To fully implement this recommendation, IRS will need to provide GAO copies of the updated IRM as well as evidence of other corrective actions outlined in its evaluations of its monitoring procedures for collection due process appeal requests. GAO will continue to monitor the implementation of this recommendation.

Recommendation: The Commissioner of Internal Revenue should establish timeframes and monitoring procedures for timely transfer of taxpayer appeals requests by examination compliance units to the Office of Appeals. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: IRS agreed with this recommendation. All four IRS business operating divisions have a corrective action plan and established and documented time frames for timely appeal transfer as of February 2020. While three business operating divisions have reporting procedures planned for monitoring timely appeal transfer, one division has not provided a plan for monitoring its timeliness in transferring cases to the Office of Appeals. To fully implement this recommendation, IRS needs to assess whether the planned monitoring actions will result in timely transfer of examination appeals. As of February 2020, data tracking the time from taxpayer request for appeal to when it is received by the Office of Appeals indicated that the actual transfer times are longer than the established time frames. Delays in transferring such requests can result in increased interest costs for taxpayers because interest continues to accumulate on the tax liability during the appeal process. Further, taxpayers unsure of their appeal status may call or write to IRS, tying up other IRS staff to respond to inquiries about appeals delayed in transfer. GAO will continue to monitor IRS's implementation of this recommendation.

Recommendation: The Commissioner of Internal Revenue should direct the Chief of Appeals to regularly report and share with each compliance unit the data on the time elapsed between when a taxpayer requests an appeal to when it is received in the Office of Appeals. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In February 2019, IRS stated that the Chief of Appeals will share with each compliance unit data on the time elapsed between when a taxpayer requests an appeal to when it is received in the Office of Appeals. Appeals will also conduct an assessment with IRS compliance units of the time elapsed between when a taxpayer requests an appeal to when it is received in the Office of Appeals and implement improvements based on that assessment. As of February 2020, Appeals demonstrated that it provided to compliance units initial example data that tracks the time from taxpayer request for appeal to when it is received by the Office of Appeals. As of April 2020, it continues to refine the format of these reports. Appeals said it plans to do an assessment of the data with compliance units and will provide an example of this analysis when it is complete. IRS plans to complete these actions by October 2020, and GAO will continue to monitor IRS's implementation of this recommendation.

Recommendation: The Commissioner of Internal Revenue should provide more transparency to taxpayers on historical average total appeal resolution times. This could include publishing average total resolution times by workstream on an Office of Appeals web page as well as including total expected times in the Appeals welcome letter. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In February 2019, IRS stated that the Chief of Appeals will review appeal resolution times and participate in IRS-wide efforts to improve transparency of resolution timeframes. As of June 2019, the Office of Appeals explained that IRS was beginning to simplify its website, including the Appeals website, with a focus on making it more customer friendly. IRS plans to complete these actions by June 2020, and GAO will continue to monitor IRS's implementation of this recommendation.

Recommendation: The Secretary of the Treasury, consistent with its responsibilities under GPRAMA and Executive Orders for customer service, should ensure that the Commissioner of Internal Revenue takes action to make Appeals customer service standards and performance results more transparent to the public. This could include publishing customer service standards and related performance measure results on the Office of Appeals web page on IRS.gov. (Recommendation 6)

Agency: Department of the Treasury
Status: Open

Comments: Treasury agreed with this recommendation and plans to monitor IRS implementation. In February 2019, IRS stated that it will publish customer service standards and related performance measure results on the Office of Appeals web page on IRS.gov. As of April 2020, the Office of Appeals stated it plans to use information from its redesigned customer satisfaction survey to address this recommendation and is determining how to include the performance information on its website. IRS plans to complete these actions by June 2020, and GAO will continue to monitor IRS's implementation of this recommendation.

Recommendation: The Secretary of the Treasury, consistent with its responsibilities under GPRAMA and Executive Orders for customer service, should ensure that the Commissioner of Internal Revenue takes action to develop a mechanism to solicit and consider public input and customer feedback on a regular basis on current and proposed IRS appeal policies and procedures. This could include leveraging existing IRS advisory bodies or establishing an Office of Appeals advisory body representing the taxpaying public, the tax practitioner community, and businesses to solicit customer perspectives. (Recommendation 7)

Agency: Department of the Treasury
Status: Open

Comments: Treasury agreed with this recommendation and will monitor IRS implementation. In February 2019, IRS stated that it will leverage existing IRS advisory bodies to solicit customer perspectives. In January 2020, the Office of Appeals reported that it had begun to meet with the IRS Advisory Committee (IRSAC) to solicit customer perspectives, with its first interactions beginning in November 2019. The Office of Appeals stated that, in addition to this action, its leadership continues to meet with other external bodies to capture public input and customer feedback on an ad hoc basis. As of April 2020, the Office of Appeals stated it plans to participate in IRSAC's public meetings. Since the Office of Appeals has only begun leveraging IRSAC to solicit customer perspectives in November 2019 in a working session, GAO will continue to monitor the implementation of this recommendation to ensure sustained interaction with IRSAC through working sessions, as well as public meetings.

Recommendation: The Secretary of Education should enroll loan servicers in FSA's continuous monitoring program and, in the interim, require these entities to report the results of security controls testing at an FSA-defined frequency. (Recommendation 1)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and the agency stated that loan servicers are scheduled to be enrolled in its ongoing security authorization program beginning in fiscal year 2019. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should enroll private collection agencies in FSA's continuous monitoring program, and, in the interim, require these entities to test all controls at an FSA-defined frequency and regularly report the results. (Recommendation 2)

Agency: Department of Education
Status: Open

Comments: FSA stated that it concurred with this recommendation, but the actions it said it planned to take would not fully address it. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should modify FSA's agreements with guaranty agencies to specify a required baseline of security controls based on the impact level of the information shared with these agencies, as determined by FSA. (Recommendation 3)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and described planned actions to address it. In November 2019, FSA officials told us that this recommendation has a pending date of 5/31/2020 for completion When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should establish a process for continuous monitoring of guaranty agencies' implementation of security and privacy requirements between on-site assessments, to include testing all controls at an FSA-defined frequency and regularly reporting results. (Recommendation 4)

Agency: Department of Education
Status: Open

Comments: FSA partially concurred with this recommendation and described actions it planned to take in response. However, we believe the entire recommendation is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should include specific security and privacy requirements in agreements with the Federal Family Education Loan (FFEL) Program lenders based on FSA's categorization of the information shared with the lenders. (Recommendation 5)

Agency: Department of Education
Status: Open

Comments: FSA stated that it partially agreed with this recommendation; however, if effectively implemented, the planned actions it described would address this recommendation. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should develop policies and procedures to gain assurance that FFEL lenders have appropriate security and privacy controls in place and that these controls are being regularly tested and monitored. (Recommendation 6)

Agency: Department of Education
Status: Open

Comments: FSA did not concur with this recommendation. However, we believe it is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: WMATA's General Manager should conduct a comprehensive assessment of the financial risks to which WMATA is exposed from its pension plans and communicate the results to its pension plan trustees and other stakeholders, such as its Board of Directors. This assessment should include information about WMATA's current and potential future required payments and unfunded liabilities, including under potentially adverse economic scenarios. (Recommendation 1)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA stated that the authority periodically evaluates the risks posed by the unfunded liabilities for its pension plans and other post-employment benefits. Specifically, WMATA officials stated that consulting agencies are used to conduct sensitivity analysis regarding the funded status of WMATA's five pension plans under various economic scenarios. However, WMATA has not yet provided GAO with these analyses to assess what information they contain and whether they include information on potential future required payments and unfunded liabilities under adverse scenarios. GAO will continue to work with WMATA to obtain these analyses and monitor WMATA's progress in addressing this recommendation.

Recommendation: WMATA's General Manager should develop a strategic workforce planning process that (1) sets a strategic direction for WMATA's workforce planning and involves employees and other stakeholders in developing and communicating the process, and (2) includes a data-driven assessment of the critical skill and competencies WMATA needs to fill any gaps. (Recommendation 2)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA officials stated that the Authority did not provide funding in 2019 to obtain a consultant to assist with authority-wide strategic workforce planning, as WMATA had previously planned. WMATA officials told us that the Authority is evaluating funding availability for this effort in the upcoming fiscal year, but in consideration to the impacts of the coronavirus crisis, broad economic uncertainties, and other challenges facing the Authority. WMATA did not provide information as to whether it would be conducting additional workforce planning efforts using its in-house staff and resources. GAO will continue to monitor WMATA's efforts to address this recommendation.

Recommendation: WMATA's General Manager should establish comprehensive policies and procedures for both of its performance management systems that document the goals of the systems and individuals' responsibilities for implementing these systems; align employee performance objectives with all of WMATA's strategic goals; and define performance objectives, rating categories, and competencies tailored to individual positions' responsibilities. (Recommendation 3)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA created documented procedures for managers and staff who are not represented by a union to use in the performance management cycles for fiscal years 2019 and 2020. These included guidance, instructional videos, or other tools for setting employee performance objectives in relation to WMATA's strategic priorities, and conducting mid-year reviews and end-of year performance evaluations. WMATA reported that it also intends to develop procedures to support performance management for some of its union-represented employees, starting in fiscal year 2021 with the Metro Transit Police Department. WMATA expects to implement changes for other represented employee groups beginning in fiscal year 2022. GAO will continue to monitor WMATA's progress in addressing this recommendation.

Recommendation: WMATA's General Manager should establish controls to ensure supervisors fully and accurately complete employee performance reviews and submit them to human resources within established timeframes. (Recommendation 4)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA has taken steps to establish controls for its employee performance management system. Specifically, WMATA developed an automated tool to track employee and supervisor compliance with WMATA's performance management requirements, and provided GAO with information on how WMATA used this tool to set employee performance objectives and complete mid-year reviews in the fiscal year 2020 performance cycle. WMATA reported that end-of-year performance evaluations would be completed by the end of July 2020. GAO will review WMATA's completion of the 2020 performance cycle to process to assess whether WMATA has fully implemented our recommendation.

Recommendation: WMATA's General Manager should develop a documented process to use employee performance management information to monitor progress toward WMATA's strategic goals. (Recommendation 5)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA officials told us that its automated performance management tool will provide information on employee performance information across the organization and allow for data-driven decision making. Specifically, WMATA stated that managers can view year-end ratings and other information for every employee within their chain of command, and WMATA's senior leadership have a global view of the ratings to compare performance ratings distributions across departments. WMATA reported that it is currently completing its fiscal year 2020 performance cycle, which ends July 31, 2020. GAO will continue to follow WMATA's progress addressing this recommendation, including assessing whether the information in its automated performance management tool will help WMATA monitor progress toward achieving its strategic goals.

Recommendation: The Secretary of DHS should ensure that the Commissioner of Customs and Border Protection through the Executive Assistant Commissioner for Operations Support updates the 2013 workforce assessment to account for the independent requirements organization's current workforce needs. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. Customs and Border Protection provided an estimated completion date for their workforce assessment of September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Administrator of the Federal Emergency Management Agency establishes a policy for requirements development. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The Federal Emergency Management Agency plans to establish a policy for requirements development by September 30, 2020, about one year after it completes changes to its governance processes.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes a policy for requirements development. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes the planned independent requirements development organization within Immigration and Customs Enforcement. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes component specific training for requirements development. (Recommendation 11)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate finalizes and promulgates the National Protection and Programs Directorate's draft policy for requirements development. (Recommendation 12)

Agency: Department of Homeland Security
Status: Open

Comments: The National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency in January 2018. DHS concurred with this recommendation. The Cybersecurity and Infrastructure Security Agency estimates that it will have a final policy by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate establishes the planned independent requirements development organization within the National Protection and Programs Directorate. (Recommendation 13)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates that it will establish an independent requirements organization by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates it will complete an assessment to account for an independent requirements organization's workforce needs by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Director of the U.S. Citizenship and Immigration Services establishes the planned independent requirements development organization within U.S. Citizenship and Immigration Services. (Recommendation 21)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The U.S. Citizenship and Immigration Services estimates that it will establish an independent requirements development organization by September 30, 2020.

Recommendation: The Administrator of CMS should complete a comprehensive, national risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated based on areas of highest risk. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS has taken steps to conduct a comprehensive national risk assessment. As of October 2019, CMS had developed a standard tool to assess risk and staff capacity. The agency indicated that once the assessment is complete, CMS will identify opportunities to increase resources, review the current allocation of financial staff, and determine the appropriate allocation of staff by state. We will continue to monitor CMS's action to complete this assessment.

Recommendation: The Administrator of CMS should clarify in internal guidance when a variance analysis on expenditures with higher match rates is required. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In October 2019, CMS indicated that the agency held meetings to clarify internal guidance on the variance analysis and is the process of drafting updated guidance for the CMS-64 review. We will continue to monitor CMS's actions to update the guidance.

Recommendation: The Administrator of CMS should revise the sampling methodology for reviewing expenditures for the Medicaid expansion population to better target reviews to areas of high risk. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In October 2019, CMS indicated that given their current resources, they believe the sampling methodology is sufficient and have no plans to revise it. The agency noted that the current methodology requires a minimum sample size but gives reviewers the flexibility to expand the size of the sample if warranted by risk and as resources permit. We continue to believe that the current methodology does not sufficiently target areas of high risk.

Recommendation: The Director of the Office of Management and Budget should issue guidance that addresses the 12 CIO responsibilities discussed in this report that are not included in existing OMB guidance--in particular those relating to IT workforce matters. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The agency partially agreed with the recommendation, and planned to issue guidance that addressed eight of the 12 CIO responsibilities discussed in this report that were not included in existing OMB guidance. As of July 2020, the agency had not issued such guidance and asserted that its existing Circular A-130 guidance is adequate to address this recommendation. However, the Circular A-130 does not address these 12 CIO responsibilities. We will continue to monitor the steps the agency takes to address these requirements.

Recommendation: The Director of the Office of Management and Budget should define the authority that CIOs are to have when agencies report on CIO authority over IT spending. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The agency agreed with the recommendation to define the authority that Chief Information Officers (CIOs) are to have when agencies report on CIO authority over information technology spending. However, as of July 2020, the agency had not updated its definition. We will continue to monitor the steps the agency takes to address this recommendation.

Recommendation: The Secretary of Agriculture should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 4)

Agency: Department of Agriculture
Status: Open

Comments: The agency agreed with the recommendation and, in May 2019, the agency revised its departmental policies to address 21 of the 22 responsibility gaps identified in the report. The remaining responsibility is for the Chief Information Officer (CIO) to report annually to the head of the agency on progress made in improving IT personnel capabilities. In particular, while USDA's CIO is required to conduct an annual assessment on IT personnel, there is no indication that the results are reported to the agency head. We will continue to monitor the steps the agency takes to address these requirements.

Recommendation: The Secretary of Commerce should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 5)

Agency: Department of Commerce
Status: Open

Comments: The agency agreed with the recommendation and, in October 2018, described a a number of steps it planned to take to address the responsibility gaps identified in the report. We will continue to monitor the steps the agency takes to address these requirements.

Recommendation: The Secretary of Defense should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: We will provide updated information when we confirm what actions the agency has taken in response to this recommendation.

Recommendation: The Secretary of Education should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 7)

Agency: Department of Education
Status: Open

Comments: We will provide updated information when we confirm what actions the agency has taken in response to this recommendation.

Recommendation: The Secretary of Energy should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 8)

Agency: Department of Energy
Status: Open

Comments: The department planned to complete several steps by the end of 2019. When we confirm these actions, we will provide updated information.

Recommendation: The Secretary of Health and Human Services should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 9)

Agency: Department of Health and Human Services
Status: Open

Comments: The agency agreed with the recommendation and revised its policies to address three of the 23 responsibility gaps identified in the report. In particular, it has addressed the responsibilities for the Chief Information Officer to: 1) report directly to the agency head or that official's deputy, 2) improve the management of the agency's IT through portfolio review (PortfolioStat), and 3) maintain an inventory of data centers. We will continue to monitor the steps the agency takes to address the remaining responsibilities.

Recommendation: The Secretary of Homeland Security should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: The agency agreed with the recommendation, and revised and provided additional departmental directives and delegations to address 19 of the 21 responsibility gaps identified in the report. The remaining responsibilities are for the Chief Information Officer (CIO) to 1) review and approve IT contracts, acquisition plans, or strategies; and 2) ensure that all personnel are held accountable for complying with the agency-wide information security program. In particular, while the DHS CIO has the authority to coordinate with the Chief Acquisition Officer on acquisition strategies, coordination is not the same as reviewing and approving. Regarding holding agency personnel accountable for information security, DHS's Sensitive Systems Policy Directive gives that authority to the heads of DHS's components, rather than the DHS CIO. We will continue to monitor the steps the agency takes to address these requirements.

Recommendation: The Secretary of Housing and Urban Development should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 11)

Agency: Department of Housing and Urban Development
Status: Open

Comments: The department indicated that it has work underway to address this recommendation, which it plans to complete in March 2020. When we confirm those actions, we will provide updated information.

Recommendation: The Secretary of the Interior should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 12)

Agency: Department of the Interior
Status: Open

Comments: The department planned to review its policies and take corrective actions, as necessary. When we confirm those actions, we will provide updated information.

Recommendation: The Attorney General should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 13)

Agency: Department of Justice
Status: Open

Comments: Justice concurred with our recommendation and started work to address it. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Labor should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 14)

Agency: Department of Labor
Status: Open

Comments: Labor has taken a number of steps in response to this recommendation. However, the agency's policies did not address the six key areas of responsibility for CIOs.

Recommendation: The Secretary of State should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 15)

Agency: Department of State
Status: Open

Comments: The department has begun changing its policies to address this recommendation. When we review those changes, we will provide updated information.

Recommendation: The Secretary of Transportation should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 16)

Agency: Department of Transportation
Status: Open

Comments: DOT agreed with many of the responsibilities in our recommendation, and in September 2019, the agency planned to leverage their technical infrastructure modernization initiative to further define the CIO responsibilities identified in the 18 responsibility gaps identified in the report. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 17)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the four areas we identified. (Recommendation 18)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA agreed with our recommendation and, as of January 2020, is working to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Environmental Protection Agency should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 19)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA neither agreed nor disagreed with our recommendation, but agreed that CIO authorities should be adequately documented in appropriate policies. EPA officials have stated that they continue to work to address this recommendation. When we confirm what actions the agency has taken to address the 20 responsibility gaps identified in the report, we will provide updated information.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 21)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with our recommendation and stated that the agency was updating its policies to address the responsibilities identified in the report. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the National Science Foundation should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 22)

Agency: National Science Foundation
Status: Open

Comments: NSF agreed with our recommendations, and in February 2020, the agency issued a new CIO Authorities Policy and revised other departmental policies to address 22 of the 23 responsibility gaps identified in the report. The remaining responsibility for the CIO to benchmark agency processes against private and public sector performance has not been established through the agencies' policies. When we confirm what actions the agency has taken in response to the remaining responsibility, we will provide updated information.

Recommendation: The Chairman of the Nuclear Regulatory Commission should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 23)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC disagreed with our recommendation but generally agreed with our findings, and the agency had departmental policies to address three of the 15 responsibilities identified in the report. In March 2020, the agency stated it was identifying the appropriate agency policy to amend to address the remaining responsibility gaps. It anticipated that it would complete those updates by the end of the second quarter of FY 2020. We will continue to monitor the steps the agency takes to address this requirement.

Recommendation: The Director of the Office of Personnel Management should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 24)

Agency: Office of Personnel Management
Status: Open

Comments: OPM agreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Small Business Administration should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 25)

Agency: Small Business Administration
Status: Open

Comments: SBA agreed with most of our recommendations and, in September 2018, the agency said it is revising its departmental policies to address the responsibility gaps identified in the report. SBA's Data Center Optimization Initiative (DCOI) Strategic Plan's revised in 2019 addresses two of the 19 responsibility gaps identified in the report. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA takes steps to work with Defense Finance and Accounting Service (DFAS)--DSCA's financial service provider--and other DOD components, as appropriate, to improve the reliability of the data the DSCA obtains on all DOD components' use of FMS administrative funds, including actual execution data, at an appropriate level of detail, such as by object class. (Recommendation 1)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In February and May 2019, DSCA informed us that it had taken some steps to implement this recommendation, including establishing an automatic interface with certain DOD components' accounting systems to provide DSCA with daily information and data on those components' actual spending of FMS administrative funds. DSCA noted that it is working toward establishing automatic interfaces for the other components that receive these funds. In October 2019, DSCA informed us that implementation is ongoing. As of August 2020, we continue to monitor DOD's ongoing actions to implement this recommendation .

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS to conduct regular reconciliations of the data that DSCA collects on DOD components' use of administrative funds, to help ensure that the data are reliable. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: In May 2019, DSCA noted that it is undertaking an initiative to incorporate reconciliation capabilities into its oversight of components' use of FMS administrative funds. In October 2019, DSCA informed us that efforts to implement this recommendation are ongoing. As of August 2020, we continue to monitor DOD's actions to implement this recommendation .

Recommendation: The Director of DSCA should follow its requirement to conduct at least two annual reviews of military department business processes for administrative funds. (Recommendation 3)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In October 2019, DSCA informed us that it had conducted two business process reviews for military departments in 2019. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation.

Recommendation: The Director of DSCA should conduct periodic (e.g., annual or biennial) reviews of other DOD components' (e.g., other than military departments) business processes for administrative funds, based on a risk-based approach. Such an approach could include consideration of whether an entity has received a prior review or representative sampling over time, as well as consideration of factors such as the results of prior audits or other identified risks. (Recommendation 4)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In October 2019, DSCA informed us that it planned to conduct one review for another DOD component (e.g., other than a military department) in fall 2019. In January 2019, it collaborated with other DOD components that receive FMS administrative funds to develop risk-based criteria for selecting components for periodic business process reviews . DSCA also provided updated policies and procedures for these reviews, which state that DSCA will conduct at least one review for another DOD component annually. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation.

Recommendation: The Director of DSCA should create and maintain a complete list of military department organizations or offices that receive administrative funds and are subject to DSCA's business process reviews. (Recommendation 5)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In May 2019, DSCA provided supporting documentation to show that, as part of its annual budget review cycle, it had required DOD components to provide a list of sub-components/organizations that receive FMS administrative funds. In October 2019, DSCA provided a list of sub-components/organizations that DSCA obtained as part of the 2019 annual budget cycle. As of August 2020, we continue to monitor DSCA's actions to implement this recommendation.

Recommendation: The Director of DSCA should update DSCA's policy for selecting military department organizations for reviews of their business processes for administrative funds, to better ensure that it reflects a risk-based approach. (Recommendation 6)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In May 2019, DSCA provided updated standard operating procedures for selecting military department organizations for reviews of their business processes for administrative funds. As of August 2020, we are reviewing the documentation provided and following up with DSCA to determine the extent to which the new procedures reflect a risk-based approach.

Recommendation: The Director of DSCA should clarify guidance to ensure that the DSCA officials conducting reviews of business processes for administrative funds periodically track action items until they are completed. (Recommendation 7)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it had updated its policies and procedures to reflect that it will track action items from business process reviews every 30 days, until the action items area completed. DSCA needs to providing supporting documentation for its efforts to track action items. As of August 2020, we continue to monitor DSCA's ongoing actions to implement this recommendation .

Recommendation: The Director of DSCA should develop a process for conducting periodic (e.g., quarterly or annual), targeted reviews of DOD components' use of administrative funds, including transactions testing, to verify that actual costs incurred are allowable and approved. (Recommendation 8)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it was in the process of conducting "mock" audits of DOD components' use of FMS administrative funds, and that it was undergoing efforts to ensure that a process is in place for the financial review of components' actual spending of these funds. DSCA noted that these efforts were ongoing in October 2019. As of August 2020, we continue to monitor DSCA's ongoing efforts to implement this recommendation.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA takes steps to work with DFAS and other DOD components, as appropriate, to improve the reliability of the data that DSCA obtains on all DOD components' use of CAS funds, including actual execution data, at an appropriate level of detail, such as by object class. (Recommendation 9)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In February and May 2019, DSCA informed us that it had taken some steps to implement this recommendation, including establishing an automatic interface with certain DOD components' accounting systems to provide DSCA with daily information and data on those components' actual spending of FMS CAS funds. DSCA noted that it is working toward establishing automatic interfaces for the other components that receive these funds. In October 2019, DSCA informed us that implementation is ongoing. As of August 2020, we continue to monitor DOD's ongoing actions to implement this recommendation.

Recommendation: The Secretary of Defense should ensure that the Director of DSCA works with DFAS to conduct regular reconciliations of the data that DSCA collects on DOD components' use of CAS funds, to help ensure that the data are reliable. (Recommendation 10)

Agency: Department of Defense
Status: Open

Comments: In May 2019, DSCA noted that it is undertaking an initiative to incorporate reconciliation capabilities into its oversight of components' use of FMS CAS funds. In October 2019, DSCA informed us that efforts to implement this recommendation are ongoing. As of August 2020, we continue to monitor DOD's actions to implement this recommendation

Recommendation: The Director of DSCA should develop a process for conducting periodic (e.g., quarterly or annual), targeted reviews of DOD components' use of CAS funds, including transactions testing, to verify that actual costs incurred are allowable and approved. (Recommendation 11)

Agency: Department of Defense: Defense Security Cooperation Agency
Status: Open

Comments: In February 2019, DSCA noted that it was in the process of conducting "mock" audits of DOD components' use of FMS CAS funds, and that it was undergoing efforts to ensure that a process is in place for the financial review of components' actual spending of these funds. As of October 2019, DSCA noted that these efforts were ongoing. As of August 2020, we continue to monitor DSCA's ongoing efforts to implement this recommendation.

Recommendation: The Secretary of Commerce should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams, identify strategies for mitigating any gaps identified, and report this information to Congress. (Recommendation 1)

Agency: Department of Commerce
Status: Open

Comments: Department of Commerce (Commerce) officials concurred with our recommendation and planned to evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams, and to identify strategies for mitigating any gaps identified. As of August 2020, Commerce had not provided sufficient evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: The Secretary of Energy should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: Department of Energy (DOE) officials concurred with our recommendation and planned to evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams using the National Initiative for Cybersecurity Education (NICE) certification mapping that is due for release in November 2018. DOE officials plan to develop criteria to identify personnel who are prepared to take certification exams and will perform a department-wide evaluation, after which they plan to report to Congress by a target date of September 30, 2019. As of August 2020, DOE had not provided evidence that it had implemented this recommendation. We will continue to monitor the situation.

Recommendation: The Secretary of the Interior should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 11)

Agency: Department of the Interior
Status: Open

Comments: Department of the Interior (Interior) concurred with our recommendation. Officials from the department stated they were developing a plan to assess the workforce's preparedness to complete and maintain certifications. Interior officials stated that they were planning to leverage its learning and performance management system for assessing the level of preparedness of cybersecurity personnel to take certification exams and planned to report to Congress by March 2021. As of August 2020, HUD had not provided evidence that it had implemented this recommendation. We will continue to monitor the situation.

Recommendation: The Administrator of the National Aeronautics and Space Administration should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 16)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: National Aeronautics and Space Administration (NASA) did not concur with our recommendation and has not yet provided evidence that it has implemented the recommendation as of August 2020. We will continue to monitor the situation.

Recommendation: The Administrator of the Small Business Administration should conduct a baseline assessment of the department's cybersecurity workforce that includes (1) the percentage of personnel with IT, cybersecurity, or other cyber-related job functions who hold certifications; (2) the level of preparedness of other cyber personnel without existing credentials to take certification exams; and (3) a strategy for mitigating any gaps identified with appropriate training and certification for existing personnel. (Recommendation 25)

Agency: Small Business Administration
Status: Open

Comments: Small Business Administration (SBA) officials concurred with our recommendation. SBA officials stated that they have made significant progress in the workforce assessment area, and have recently completed an assessment of the SBA's IT workforce and reported on existing skills gaps. SBA officials stated that they plan to execute against the IT workforce plan to include addressing requirements within the Federal Cybersecurity Workforce Assessment Act of 2015. As of August 2020, SBA had not provided evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: The Administrator of the Small Business Administration should submit a report of its baseline assessment of its existing cybersecurity workforce to the appropriate congressional committees of jurisdiction. (Recommendation 26)

Agency: Small Business Administration
Status: Open

Comments: Small Business Administration (SBA) officials concurred with our recommendation. SBA officials stated that they have made significant progress in the workforce assessment area, and have recently completed an assessment of the SBA's IT workforce and reported on existing skills gaps. SBA officials stated that they plan to execute against the IT workforce plan to include addressing requirements within the Federal Cybersecurity Workforce Assessment Act of 2015. As of August 2020, SBA had not provided evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: The Administrator of SBA should use its on-site and off-site reviews to routinely collect information on lenders' use of credit elsewhere criteria as part of its monitoring of lender practices related to the credit elsewhere requirement. (Recommendation 2)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Administrator of SBA should analyze information on lenders' use of credit elsewhere criteria obtained from its reviews to identify lenders that may be at greater risk of noncompliance and to inform its selection of lenders for further review for credit elsewhere compliance. (Recommendation 3)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Director of BLM should require cognizant officials in headquarters and state offices to conduct top-level reviews of field offices' monitoring of oil and gas lease suspensions, as well as of official lease files and databases to ensure they are current and complete. (Recommendation 3)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: BLM concurred with this recommendation. However, the Bureau has yet to provide information concerning the current status of this recommendation. We will update the recommendation's status when we receive such information.

Recommendation: The Director of NSF should revise the agency's policies for developing schedules for large facilities projects, and for reviewing those schedules, to better incorporate the best practices in GAO's schedule guide. (Recommendation 2)

Agency: National Science Foundation
Status: Open

Comments: NSF agreed with this recommendation and, as of November 2019, had updated its internal guidance to include a new section related to schedule reviews. The updated guidance states that the NSF Large Facilities Office will lead analysis of the schedule for each proposed major facilities project, which will include a technical evaluation by the sponsoring office. As further steps to implement this recommendation, NSF planned to develop (1) a new section of the Major Facilities Guide on schedule development, estimating, and analysis and (2) new internal guidance on including project schedules as part of external panels' oversight reviews. NSF anticipated completing these actions by mid-fiscal year 2020. We will continue to monitor and provide updates on NSF's actions to address this recommendation.

Recommendation: The Director of OMB should develop guidance on how agencies test to identify improper payments, such as using a risk-based approach to help ensure that key risks of improper payments, such as eligibility, are addressed through testing processes. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB partially concurred with this recommendation. On July 31, 2019, we met with the Office of Management and Budget (OMB). At the meeting, OMB officials indicated that OMB's position has not changed since the issuance of the GAO report and what OMB had already communicated to GAO at the exit conference. Specifically, OMB stated that it should not have to develop more specific guidance as each program and activity has its own risks. Instead, inspectors general are better equipped and positioned to review the sampling and estimation plans as part of their annual Improper Payments Elimination and Recovery Act of 2010 compliance audits and that agencies, their statisticians, and inspectors general should work out the best testing procedures for their agencies. We continue to believe that OMB could provide suggestions during OMB's annual town meeting related to improper payments for areas that inspectors general may consider. Further, although we agree that programs and activities may face different risks of improper payment, we continue to believe that guidance from OMB on how agencies test to identify improper payments, such as using a risk-based approach, could help ensure that agencies address the specific risks they identify when developing improper payment estimates. In February 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Director of OMB should develop guidance clarifying the appropriate treatment of nonresponse cases during improper payment testing. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB concurred with this recommendation. On July 31, 2019, we met with the Office of Management and Budget (OMB). At the meeting, OMB officials indicated that OMB's position has not changed since the issuance of the GAO report and what OMB had already communicated to GAO at the exit conference. At the meeting, OMB officials stated that OMB will "consider" updating guidance in OMB Circular A-123, Appendix C, to direct agencies to treat nonresponse cases such as improper payments and to include a new category for tracking such cases but only after assessing the impact such guidance would have on the agencies testing and reporting of improper payments. OMB has not taken action to develop this guidance. In February 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Director of OPM should assess the processes to estimate Retirement improper payments to determine whether they effectively address key risks of improper payments--including eligibility and whether older claims face different risks of improper payments than new claims--and take steps to update the processes to incorporate key risks that are not currently addressed. (Recommendation 4)

Agency: Office of Personnel Management
Status: Open

Comments: The Office of Personnel Management (OPM) partially concurred with this recommendation. Prior to 2006, the improper payment estimate sampling methodology used by OPM included both new and old adjudicated claims. After analyzing several years of data using this methodology, OPM found that including older claims in the sample could result in claimant's records being sampled multiple times. In addition, OPM also found that the variance in the number of errors detected in new claims versus old claims was very low. OPM also looked at the resources used in performing the audit of old and new claims and based on these factors, management determined that it was not an efficient use of resources to include both old and new claims in the review. The methodology was updated to make the process more efficient. By using new claims only, OPM was able to provide feedback to program managers more timely. As a result, management can address issues negatively impacting the improper payment rate and prevent improper payments promptly. OPM agrees with the intent of our recommendation; however, OPM does not agree with our recommendation regarding a risk assessment on eligibility. Eligibility is determined before annuity/survivor benefits are fully adjudicated. As part of its correction plan, OPM stated that it will conduct an audit of older claims to determine if there are different risks to new claims. In February 2020, OPM indicated that it is currently in the process of pulling/gathering the cases that should be in the universe of this audit. OPM plans to complete the corrective action by end of 4th quarter of fiscal year 2020. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense for Acquisition and Sustainment to update the policy or guidance for MAIS business programs. Specifically, the update should include the following elements: (1) establishment of initial and current baseline cost and schedule estimates, (2) predetermined threshold cost and schedule estimates to identify the point when programs may be at high risk, and (3) quarterly and annual reports on the performance of programs to stakeholders. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: In January 2020, the Under Secretary of Defense for Acquisition and Sustainment issued an updated instruction on defense business systems requirements and acquisition, which included guidance on establishing baseline cost and schedule estimates and considering progress against the baselines at key decision points. However, the instruction does not make a distinction between initial and current baselines. Further, it did not include thresholds for cost and schedule variances or specify periodic reporting of program performance information to stakeholders. According to an official in the office of the Under Secretary of Defense for Acquisition and Sustainment, the office does not intend to add the elements of the recommendation related to thresholds and reporting. Specifically, according to the official, the office considers specifying predetermined threshold cost and schedule estimates and frequency for status reporting to be matters for implementation guidance issued by department components or determined by a program decision authority. However, until the department demonstrates that it has fully addressed the recommendation, it is limited in its ability to ensure that effective system acquisition management controls are implemented for each major business system investment and that stakeholders have the information needed to make informed decisions for managing and overseeing these investments. We will continue to monitor the department's implementation of the recommendation.

Recommendation: The Secretary of Defense should direct the Director of the Defense Health Agency to direct the program manager for the Defense Healthcare Management System Modernization program to: (1) finalize and approve its requirements management plan, (2) identify and document changes that should be made to plans and work products resulting from changes to the requirements baseline, and (3) quantify costs and benefits of risk mitigation within its program-level risk mitigation plans. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: As of November 2019, the Department of Defense had made progress addressing the intent of the recommendation related to requirements management; however, it needs to do more to improve DHMSM program risk management. Specifically, in March 2019, the DHMSM program manager approved a requirements management plan, which includes identifying and documenting changes that should be made to plans and work products resulting from changes to the baseline requirements. Specifically, it includes forward and backward configuration and change management of the baselined requirements and managing traceability of requirements to design artifacts, test cases, defects, and change requests. However, the program has not demonstrated that it quantifies costs and benefits of risk mitigation in its risk mitigation plans. Specifically, it did not demonstrate that it had updated its guidance to require that costs and benefits of risk mitigation plans be included in these plans. We will continue to monitor the department's efforts to implement the recommendation.

Recommendation: The Administrator should direct the Chief Information Officer to address, in conjunction with the Chief Human Capital Officer, gaps in IT workforce planning by fully implementing the eight key IT workforce planning activities noted in this report. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA did not concur with this recommendation. As of October 2019, the agency reported that the Office of the Chief Information Officer was beginning its involvement with the agency's Mission Support Architecture Program which aims at re-aligning mission support functions from a decentralized model to an enterprise model. The office's participation in the re-alignment effort has an estimated completion date in fiscal year 2023.

Recommendation: The Administrator should direct the Chief Information Officer to address weaknesses in oversight practices and ensure routine oversight of all investments by taking action to document criteria for escalating investments among governance boards and establish procedures for tracking corrective actions for underperforming investments. (Recommendation 6)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that the agency intended to address this recommendation by documenting its approach for governing IT investments. In February 2020, NASA reported that the agency remained committed to taking action to address this recommendation and reported that the Office of the Chief Information Officer had established a process to govern IT investment funds and had planned additional modifications for that framework. The agency now expects to complete actions to address this recommendation by November 2020.

Recommendation: The Administrator should ensure that the Chief Information Officer fully defines policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio. (Recommendation 7)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that it had begun updating policies and procedures for developing the portfolio criteria. In April 2019, NASA provided copies of its updated guidance. Among other things, the guidance described criteria for the portfolio and defined policies and procedures for creating the portfolio. As of April 2020, the agency had not yet provided evidence that it had developed policies and procedures for evaluating the portfolio. We plan to continue following up on the status of efforts to address this recommendation.

Recommendation: The Administrator should direct the Chief Information Officer to establish an agency-wide approach to managing cybersecurity risk that includes a cybersecurity strategy that, among other things, makes explicit the agency's risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, response strategies and approaches for monitoring risk over time, and priorities for risk management investments. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that it had hired a Chief Cybersecurity Risk Officer in April 2018 and that it had also approved a charter for an agency-wide Cybersecurity Integration Team. As of September 2020, NASA reported that it intends to deliver a cybersecurity risk management strategy that addresses the elements outlined in this recommendation by 2021.

Recommendation: The Administrator should direct the Chief Information Officer to establish an agency-wide approach to managing cybersecurity risk that includes policies and procedures with well-defined roles and responsibilities that are integrated and reflect NASA's current security practices and operating environment. (Recommendation 10)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. As of September 2020, NASA reported that the Chief Information Officer had initiated a review of the agency's cyber policy management framework and that any related updates were expected to be completed by 2021.

Recommendation: The Director of the Defense Security Service should determine how it will collaborate with stakeholders as it pilots a new approach to overseeing contractors with cleared facilities (DSS in Transition), including identifying roles and responsibilities and the related resources needed. (Recommendation 1)

Agency: Department of Defense: Defense Security Service
Status: Open

Comments: DOD agreed with this recommendation and as of February 2019, stated that it continues to pilot DSS in Transition at cleared facilities and use information gathered from stakeholders, including key government and industry stakeholder organizations to refine the process. On August 12, 2020, DOD stated that DSS was in the process of drafting a Corrective Action Plan. At that time, DOD officials explained that this plan would be completed in the fourth quarter of fiscal year 2019. As of September 2020, this plan has not been completed.

Recommendation: The Secretary of Defense should direct the Office of Special Needs (OSN) to assess the extent to which each Service is (1) providing sufficient resources for an appropriate number of family support providers, and (2) developing services plans for each family with special needs, and to include these results as part of OSN's analysis of any gaps in services for military families with special needs in each annual report issued by the Department to the congressional defense committees. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. In April 2019, DOD officials noted they plan to pilot a staffing tool that will help the Services determine the number of family support providers needed at each installation. The pilot currently includes multiple Services and is expected to last two years. DOD officials also noted that DOD is in the process of standardizing its case management processes for military families with special needs through its family needs assessment form. Among other things, this form is meant to help family support providers address requirements for individualized services plans and gain a better understanding of each family's current needs and goals. In its 2018 annual report to the congressional defense committees, DOD noted the National Defense Authorization Act for Fiscal Year 2010 requirement to develop and continuously update an individualized services plan for each military family with special needs. However, DOD said OSN may propose legislative changes to this requirement that would require an individualized services plan to be developed and updated only for those families that request services from family support providers. As of June 2020, we will consider closing this recommendation when the staffing tool is finalized and OSN has assessed each Service's number of family support providers and efforts to develop services plans.

Recommendation: The Secretary of Defense should direct the Office of Special Needs (OSN) to develop common performance metrics for assignment coordination and family support, in accordance with leading practices for performance measurement. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. In April 2019, DOD officials noted that each Service submits data for assignment coordination and family support to the EFMP data repository on a quarterly basis. According to DOD officials, in 2018, the data repository was expanded to include a full year of quarterly data for each Service, and OSN is currently developing additional performance metrics for assignment coordination and family support. DOD also noted that it will continue to use the data repository to identify gaps and trends related to assignment coordination and family support, including collecting data from each installation. As of June 2020, we await documentation that OSN has developed performance metrics for assignment coordination and family support and uses them to identify gaps and trends across the Services.

Recommendation: The Secretary of Defense should implement a systematic process for evaluating the results of monitoring activities conducted by each Service's EFMP. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. In April 2019, DOD said the family support component is monitored and evaluated through the each Service's certification process which includes specific standards for the EFMP. In addition, OSN participated in a monitoring site visit to Marine Corps Base Quantico in December 2018 and plans to participate in additional site visits that are coordinated by each Service's certification team. As of June 2020, we will consider closing this recommendation when DOD implements a process to evaluate the results of each Service's certification process.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials, based on IRS's research and determination, design and implement the corrective actions necessary to reasonably assure that IRS effectively resolves and records unpostable transactions in a timely manner, including establishing clearly defined time frames in the Internal Revenue Manual (IRM) by which the IRS operating divisions should correct unpostable transactions and appropriate related oversight and review processes. (Recommendation 18-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. As of September 30, 2019, three of the four operating divisions involved in this recommendation designed and implemented the corrective actions necessary to reasonably assure that IRS effectively resolved and recorded unpostable transactions in a timely manner. In March 2019, one operating division determined that based on the research performed, no actions needed to be taken by the operating division to effectively resolve and record unpostable transactions in a timely manner. We will continue to evaluate IRS's actions to address this recommendation during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the Submission Processing internal control review. These policies should include or be accompanied by procedures to (1) assess and update the review questions and cited IRM criteria to reasonably assure they align with the controls under review; (2) periodically evaluate and document a review of the error threshold methodology to assess its current validity based on changes to the operating environment; (3) report findings identified in the Findings and Corrective Actions Report; and (4) assess and monitor (a) safeguarding internal control activities across all work shifts, particularly during peak seasons, (b) safeguarding internal control activities for the appropriate use and destruction of hard copy taxpayer information, and (c) the results of relevant functional level reviews. (Recommendation 18-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, IRS developed policies in the Internal Revenue Manual (IRM) for conducting and monitoring the Submission Processing internal control review. Specifically, the IRM addresses the (1) designated roles and responsibilities among IRS business units for ensuring the review questions and associated criteria are assessed and updated to align with internal controls under review; (2) requirements for periodically evaluating the error threshold methodology used in the review; (3) procedures for the review to assess and monitor (a) internal control activities across work shifts and (b) internal control activities for appropriate use and destruction of hard-copy taxpayer information. However, the IRM did not include requirements for reporting findings identified during all components of the internal control review and for assessing and monitoring results of relevant functional level reviews. Since IRS developed the relevant IRM policies and procedures after we had already performed our fiscal year 2019 internal control testing, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the Audit Management Checklist review. These policies should include or be accompanied by procedures for IRS management responsible for establishing policies related to safeguarding controls to (1) periodically monitor the results of the review; (2) clarify the minimum requirements for how frequently the review should be completed at its various facilities while considering factors that may affect the most appropriate timing of these reviews, such as changes in personnel, operational processes, or information technology; and (3) reasonably assure that corrective actions for all identified deficiencies are tracked until fully implemented. (Recommendation 18-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS notified stakeholders of the added procedures to the Internal Revenue Manual (IRM) for (1) conducting the Audit Management Checklist reviews, including how frequently the reviews should be completed; (2) developing corrective actions for deficiencies; and (3) tracking the status of the corrective actions until fully implemented. Since IRS provided us the IRM procedures after the end of our fiscal year 2019 audit, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the All Events History Report review. These policies should include or be accompanied by procedures for IRS management responsible for establishing policies related to safeguarding controls to (1) periodically monitor the results of the review and (2) reasonably assure that corrective actions for all identified deficiencies are tracked until fully implemented. (Recommendation 18-05)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS notified stakeholders of the added procedures to the Internal Revenue Manual (IRM) for conducting the All Events History Report reviews, including developing and monitoring corrective actions for deficiencies until fully implemented. Since IRS provided us the IRM procedures after the end of our fiscal year 2019 audit, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: The Administrator of General Services should ensure that the appropriate GSA offices develop guidance including, but not limited to, how agencies can use telework as a strategic space-planning tool for reducing and optimizing office space efficiency and that the offices make the guidance readily available. (Recommendation 1)

Agency: General Services Administration
Status: Open

Comments: As of February 2020, GSA has provided GAO with some documents that indicate steps toward addressing this recommendation. For example, the documents cover topics on workplace and space design. GSA officials said that they are working on a document that focuses on the relationship between space planning and telework that will more directly address this recommendation. The estimated completion date for this document is the end of fiscal year 2020.

Recommendation: The Federal Reserve should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following three elements: (1) processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; (2) processes for disclosing the methodology--including criteria for assessing significant economic impact and a substantial number of small entities--and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; and (3) processes for considering to the extent practicable a rule's potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities. (Recommendation 5)

Agency: Federal Reserve System
Status: Open

Comments: In June 2019, Federal Reserve staff told us that they continue to review their policies and procedures to ensure compliance with RFA requirements. While Federal Reserve staff said that they use an RFA handbook developed by the SBA Office of Advocacy to support their analyses, the Federal Reserve has not made changes to its policies and procedures based on our recommendations. Until the Federal Reserve develops and implements RFA policies and procedures consistent with the recommendation, it remains open.

Recommendation: The Commodity Futures Trading Commission should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following four elements: (1) processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; (2) processes for disclosing the methodology--including criteria for assessing significant economic impact and a substantial number of small entities--and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; (3) processes for considering to the extent practicable a rule's potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities; and (4) in developing policies and procedures for section 610 reviews, include processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, maintaining documentation supporting the analysis and conclusions of RFA-required considerations, and establishing procedures for publicly disclosing the review or summaries (such as in the Federal Register or on the agency's website). (Recommendation 8)

Agency: Commodity Futures Trading Commission
Status: Open

Comments: In June 2019, CFTC staff told us that they formed a working group to enhance its implementation of RFA requirements. While this working group has begun drafting compliance procedures for RFA reviews, the procedures are incomplete and CFTC staff said it will have to finish updating the "small entity" definition before it can complete these procedures. CFTC staff told us that the working group has focused much of its work on updating the agency's definition of "small entity" because the definition was outdated. The identification of "small entity" is an important preliminary step for RFA analysis. CFTC staff does not expect to publish a proposal to amend the "small entity" definition until the summer 2020. Until CFTC finalizes and implements the new procedures for RFA reviews, this recommendation remains open.

Recommendation: SEC should publicly disclose its section 610 reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results in the Federal Register or on the agency's website. (Recommendation 10)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: In March 2019, SEC provided us with supplemental policies and procedures it developed for compliance with the Regulatory Flexibility Act (RFA), including section 610 reviews. The procedures require staff to publish on SEC's website a notice that section 610 reviews have been completed and, if the agency plans any further actions, a published RFA agenda would so indicate. Although these notices communicate with interested entities about the status of ongoing as well as completed section 610 reviews, they will not include any details about the basis for SEC's conclusions during the review. Therefore, they do not full implement GAO's recommendation, which remains open.

Recommendation: The Secretary of HHS should direct ACF to provide additional guidance and technical assistance to states to address known challenges and enhance their understanding of CAPTA requirements, including the requirements for health care providers to notify CPS of substance-affected infants and the development of a plan of safe care for these infants.

Agency: Department of Health and Human Services
Status: Open

Comments: HHS did not agree with this recommendation. The agency stated that it clarified guidance in the areas we raised. HHS also believes it is necessary to allow states the flexibility to meet the requirements in the context of their state CPS program. However, we found that states reported issues with the guidance and it did not address a key ongoing challenge regarding CAPTA requirements. HHS indicated that it will continue to provide technical assistance to states and fund demonstration sites to establish or enhance collaboration across community agencies and courts. Although continuing to provide technical assistance to states should be beneficial, our findings demonstrate that additional guidance is also needed. We continue to believe our recommendation is warranted. As of February 2020, the agency continues to disagree.

Recommendation: The Administrator of CMS should issue written criteria for when CMS will allow limited evaluation of a demonstration or a portion of a demonstration, including defining conditions, such as what it means for a demonstration to be longstanding or noncomplex, as applicable. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS agreed with this recommendation. In November 2019, HHS reported that it was applying limited evaluation requirements to certain demonstration types, including routine family planning demonstrations. In July 2020, CMS stated that it continues to work with states as they apply for new or extensions of approved demonstrations to determine whether the demonstrations as a whole or certain components would qualify for limited evaluation. The agency, however, reiterated that it needs more experience before developing generalized guidance and that was not a priority for 2020. We will continue to monitor CMS's progress and will review whether to close the recommendation when these criteria are issued.

Recommendation: The Secretary of VA should, in collaboration with ISC, review and revise VA's risk management policies for VHA facilities to ensure VA incorporates ISC standards, as appropriate. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: Shortly after the issuance of the report, VA notified GAO that it was in the process of working with the lnteragency Security Committee (ISC) to update its vulnerability assessment program, with a target completion date of January 2019. Despite multiple attempts, as of June 2020, VA has not provided any information on its progress in updating its program.

Recommendation: The Secretary of VA should develop an oversight strategy that allows VA to assess the effectiveness of risk management programs at VHA facilities system-wide. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: Shortly after the issuance of the report, VA notified GAO that it had identified OS&LE as the internal entity responsible for conducting a complete review of VA's current risk management policies and processes for VA facilities and that it was reviewing an ISC-certified risk assessment tool for possible implementation consideration. Despite multiple attempts, as of June 2020, VA had not provided an update on its efforts to implement this recommendation.

Recommendation: The Commissioner of CBP should develop a monitoring system to help ensure that CBP officials comply with license verification policies and procedures. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a monitoring system that observes agency verification of licenses for imported radiological materials to ensure CBP officials are complying with existing policies and procedures.

Recommendation: The Commissioner of CBP should develop a system that better identifies shipments of radiological material that pose the greatest risk and revise CBP's policies and procedures as necessary to verify licenses for these shipments. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a system to better identify which shipments of radiological material pose the greatest risk and revise their policies and procedures for verification of the licenses for these shipments accordingly.

Recommendation: The Secretary of Agriculture should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: The agency concurred with our recommendation, and in June 2018, USDA CIO delegated the review and approval of acquisition plans and strategies to the Capital Planning and Information Technology Governance Division (CPITGD) through the Associate CIO of the Information Resource Management Center. However, as of June 2020, the agency had not provided evidence to demonstrate that these reviews and approvals are taking place as required by OMB's guidance. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of Commerce should ensure that the office of the CAO is involved in the process to identify IT acquisitions. (Recommendation 4)

Agency: Department of Commerce
Status: Open

Comments: In a March 2018 response to our report, the agency agreed with our recommendation and stated that the CIO and the Senior Procurement Executive will issue a memo to their acquisition and CIO member offices clarifying the offices joint responsibilities to ensure that all IT acquisitions are submitted to the CIO for review and approval. The memo is also to provide guidance on the process by which the CIO will review proposed contract actions. However, as of February 2020, the agency had not responded to requests for updates. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of Commerce should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 5)

Agency: Department of Commerce
Status: Open

Comments: In a March 2018 response to our report, the agency agreed with our recommendation and stated that it intended to clarify its policies and procedures to comply with OMB rules, including the IT acquisition checklist, which must be completed for every proposed contract action. In addition, the CIO and Senior Procurement Executive will work together to review existing acquisition plan review and approval processes. However, as of February 2020, the agency had not responded to requests for updates. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of HHS should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 10)

Agency: Department of Health and Human Services
Status: Open

Comments: The agency agreed with our recommendation and in an April 2018 update stated that HHS has a policy for the HHS IT acquisition review process for acquisition strategies. However, as of February 21, 2020, the agency had not provided evidence that the CIO (or designee) was reviewing and approving IT acquisition plans, as required. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of State should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 22)

Agency: Department of State
Status: Open

Comments: The agency agreed with our recommendation, and in a December 2019 update provided information on the agency's CPIC process and a template for IT acquisition strategies. However, it is not clear whether the CIO is reviewing and approving IT acquisitions plans through the CPIC process and the template does not provide a place for the CIO review and approval. In addition, we have requested evidence of CIO approval of selected IT acquisitions. We will continue to monitor the implementation of this recommendation

Recommendation: The Secretary of the Treasury should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 23)

Agency: Department of the Treasury
Status: Open

Comments: The agency did not state whether it agreed or disagreed with the recommendation. In March 2019, Treasury issued a memo that requires the CIO to review and approve IT acquisition plans for acquisitions with a total value of $68 million or more, or for actions with a period of performance longer than 5 years. The review and approval of all other IT acquisition plans are delegated to the component CIOs or Chief Technology Officers. However, the agency had not yet provided evidence that the CIO (or designee) was reviewing and approving selected IT acquisition plans, as required. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of Transportation should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 26)

Agency: Department of Transportation
Status: Open

Comments: The agency concurred with the recommendation. In October 2019, Transportation issued guidance requiring that the CIO or designee to review and approve all IT acquisition plans. We have requested that the agency provide us evidence of CIO-approved IT acquisition plans. The agency stated that it planned to respond by May 15, 2020. We will continue to monitor the implementation of this recommendation.

Recommendation: The Secretary of VA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 28)

Agency: Department of Veterans Affairs
Status: Open

Comments: The agency concurred with the recommendation. In November 2019, VA issued guidance that requires the CIO, in conjunction with the Chief Acquisition Officer, to review and approve all IT acquisition strategies and plans. Specifically, the CIO is to review and approve IT acquisitions valued at $15 million or more. The CIO has delegated the review and approval of IT acquisitions less than $15 million to other designees, based on the value of the contract. However, the agency had not provided evidence that the CIO (or designee) was reviewing and approving selected IT acquisition plans, as required. We will continue to monitor the implementation of this recommendation.

Recommendation: The Administrator of NASA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 32)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The agency concurred with the recommendation, and in September 2017, NASA's CIO delegated the review and approval authority of IT acquisitions to the Center CIOs. We have requested evidence of CIO-approved IT acquisitions. We will continue to monitor the implementation of this recommendation.

Recommendation: The Director of the Office of Personnel Management should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 34)

Agency: Office of Personnel Management
Status: Open

Comments: The agency concurred with the recommendation and in an April 2020 updated stated that OPM has contracted with a third-party vendor to evaluate the OPM IT human capital, architecture, and governance processes from planning to acquisition to implementation. The agency further stated that it is working to fully implement an IT governance process where the OPM CIO fully reviews and approves IT acquisition plans and processes. We will continue to monitor the implementation of this recommendation.

Recommendation: GAO recommends that the Director of OMB consider developing a goal that addresses a coordinated federal approach to child well-being among its next set of cross-agency priority (CAP) goals, including working with relevant agencies to ensure their strategic plans include goals and objectives related to the CAP goal. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: OMB neither agreed nor disagreed with this recommendation. In November 2017, OMB staff noted that the agency was developing its next set of CAP goals, which are usually reserved for a limited set of priorities, and expects to announce these goals concurrent with the FY19 budget. As part of the process, agency staff said they consult relevant Congressional committees and other stakeholders. As of September 2019, OMB had not provided an update on its efforts.

Recommendation: The Assistant Secretary of Labor for Occupational Safety and Health should take additional steps to encourage workers to disclose sensitive concerns during OSHA inspections of meat and poultry plants; for example, by considering additional off-site interviews or exploring other options to obtain information anonymously. (Recommendation 1)

Agency: Department of Labor: Occupational Safety and Health Administration
Status: Open

Comments: OSHA stated that it agrees that workers should be able to report injuries, illnesses, and hazards free of intimidation. OSHA noted that its Field Operations Manual prescribes procedures for facilitating the free and open exchange of information, such as conducting onsite worker interviews without management present. OSHA further stated that when workers indicate interest in offsite interviews, the agency will conduct those interviews as prescribed by the Field Operations Manual. We note in our report that because inspectors inform plant management which workers they want to speak with, supervisors know the identity of workers interviewed onsite. Workers and worker advocates we spoke with expressed concerns about this. OSHA told us that inspectors interview meat and poultry workers offsite infrequently, since these interviews can be challenging and take additional time, and OSHA also may be challenged to find an acceptable venue when the employee is available. In June 2020, DOL informed us that OSHA had signed an alliance with several meat and poultry-related industry associations and that they expect this alliance to help improve overall safety and health for the industry's workers. We continue to believe that there are additional steps OSHA can take to better encourage workers to disclose sensitive concerns, and we look forward to learning how OSHA will draw upon this alliance to help take these steps.

Recommendation: The Assistant Secretary of Labor for Occupational Safety and Health should gather more information, such as by asking workers during meat and poultry plant inspections, to determine the extent to which bathroom access is a problem and how to address any identified issues. (Recommendation 2)

Agency: Department of Labor: Occupational Safety and Health Administration
Status: Open

Comments: OSHA stated that meat and poultry workers should have bathroom access as prescribed by the agency's regulations. They noted that if it is observed that processes indicate lack of bathroom access, or if a worker indicates there is an issue, the agency will investigate. Our report identified a mismatch between the concerns we heard from workers about lack of bathroom access and the problems reported by OSHA. We also reported that workers may not volunteer information about lack of bathroom access unless specifically asked. OSHA may choose to address this issue without routinely asking workers about bathroom access, such as by selectively querying workers based on criteria determined by the agency. In June 2020, DOL informed us that OSHA had signed a national alliance with several meat and poultry-related industry associations, and that bathroom access is one of the topics that will be addressed within this alliance, with a goal of developing educational materials. We note that this is a positive step forward, and we continue to stand by our recommendation.

Recommendation: The Assistant Secretary of Labor for Occupational Safety and Health should update its guidance for employers on how to manage their health units to address the challenges of managing these units. (Recommendation 3)

Agency: Department of Labor: Occupational Safety and Health Administration
Status: Open

Comments: In June 2020, DOL informed us that OSHA continues work on updating its guidance for employers on how to manage their health units to address the challenges of managing these units, and that OSHA anticipates initiating clearance of the draft updated guidance in fall 2020. We will consider closing this recommendation when this effort is complete.

Recommendation: The Assistant Secretary of Labor for Occupational Safety and Health should work with FSIS to assess the implementation of the MOU and make any needed changes to ensure improved collaboration; and set specific timeframes for periodic evaluations of the MOU. (Recommendation 4)

Agency: Department of Labor: Occupational Safety and Health Administration
Status: Open
Priority recommendation

Comments: In February 2020, OSHA reported that OSHA and FSIS drafted an updated MOU, which both parties are reviewing. The two agencies met in Summer 2019 to discuss workplace safety, collaboration between the two agencies, and the implementation of the MOU. During a series of working meetings, they discussed each aspect of the MOU, including training and coordination activities. FSIS and OSHA will continue to meet routinely and review the MOU to determine whether adjustments are needed, as appropriate. We will consider closing this recommendation when this effort is complete.

Recommendation: The FSIS Administrator should work with OSHA to assess the implementation of the MOU and make any needed changes to ensure improved collaboration; and set specific timeframes for periodic evaluations of the MOU. (Recommendation 5)

Agency: Department of Agriculture: Food Safety and Inspection Service
Status: Open
Priority recommendation

Comments: FSIS stated that it already has directives in place to recognize and report hazards affecting FSIS employees, and acknowledged that the MOU was designed to additionally have FSIS employees report hazards affecting plant employees due to the regular presence of its inspectors in plants. FSIS noted that in collaborating with OSHA, FSIS will need to ensure its primary mission is not compromised by undertaking activities that take time and resources away from its food safety inspection responsibilities. In January 2019, OSHA reported that it met with FSIS several times to discuss chemical exposures, referrals, and issues of jurisdiction in state plan states. FSIS subsequently shared the results from a NIOSH health hazard evaluation that was conducted, as well as the efforts to track the source of the infected birds. To fully implement this recommendation, FSIS should strengthen the MOU and develop a mechanism to regularly evaluate it would help ensure that the goals of the MOU are met; leveraging FSIS's presence in plants provides the federal government with a cost-effective opportunity to protect worker safety and health.

Recommendation: The FSIS Administrator should develop a process to regularly share the worker safety information it collects during its review of new chemicals with FSIS inspectors, plant management, OSHA, and the Centers for Disease Control and Prevention's National Institute for Occupational Safety and Health (NIOSH). (Recommendation 6)

Agency: Department of Agriculture: Food Safety and Inspection Service
Status: Open

Comments: FSIS stated that the agency already has a process for sharing chemical safety information with its inspectors. However, FSIS has not provided us with evidence that it has shared the worker safety information it collects related to new chemicals, such as safety information that is specific for dilution levels and conditions of use at plants, as noted in the report. FSIS also stated that it would take certain steps to share information about approval of chemicals with other agencies such as OSHA and NIOSH, but the steps identified did not include sharing worker safety information. Incorporating worker safety information would further help enhance this information sharing. FSIS further stated that some of the information collected during its review of new chemicals may be proprietary.

Recommendation: The Secretary of Agriculture should ensure that the CIO of USDA establishes an agency-wide policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes: a description of the CIO's role in the certification process; a description of how CIO certification will be documented; and a definition of incremental development and time frames for delivering functionality, consistent with OMB guidance. (Recommendation 9)

Agency: Department of Agriculture
Status: Open

Comments: In September 2019, a Department of Agriculture official stated that the department was working to establish a policy to include the information noted in our recommendation and planned to finalize a policy by the end of December 2019. We will continue to monitor the department's progress on these efforts.

Recommendation: The Secretary of Veterans Affairs (VA) should ensure that the CIO of VA updates the agency's policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes a description of the CIO's role in the certification process and a description of how CIO certification will be documented. (Recommendation 10)

Agency: Department of Veterans Affairs
Status: Open

Comments: The Department of Veterans Affairs (VA) has taken action, and stated that it would draft a policy to address our recommendation. In November 2019, a VA official stated that the department is working to address our recommendation but did not identify timeframes for when all activities would be completed. We will continue to evaluate the department's progress in implementing this recommendation.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should ensure that the CIO of EPA establishes an agency-wide policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes: a description of the CIO's role in the certification process; a description of how CIO certification will be documented; and a definition of incremental development and time frames for delivering functionality, consistent with OMB guidance. (Recommendation 11)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) concurred with our recommendation and stated that it planned to develop a policy to implement this recommendation and other FITARA issues. Specifically, EPA officials reported in July 2019 that the agency was continuing to work to address the recommendation but did not provided a time frame for when a policy would be finalized. We will continue to monitor EPA's progress on these efforts.

Recommendation: The Administrator of the National Aeronautics and Space Administration (NASA) should ensure that the CIO of NASA establishes an agency-wide policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes: a description of the CIO's role in the certification process; a description of how CIO certification will be documented; and a definition of incremental development and time frames for delivering functionality, consistent with OMB guidance. (Recommendation 13)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation and reported that the agency was in the process of addressing it. Specifically, NASA officials reported in June 2020 that its guidance is currently being updated to include the information noted in our recommendation and will be finalized by September 2020. We will continue to monitor NASA's progress on these efforts.

Recommendation: The Director of the Office of Personnel Management (OPM) should ensure that the CIO of OPM updates the agency's policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes a description of the CIO's role in the certification process and a description of how CIO certification will be documented. (Recommendation 16)

Agency: Office of Personnel Management
Status: Open

Comments: The Office of Personnel Management (OPM) concurred with our recommendation and stated that it would update its policies and processes to include the elements we recommended. Specifically, OPM officials reported in November 2019 that guidance on CIO certification was being developed but the agency had not yet determined a time frame for finalizing the policy. We will continue to monitor OPM's progress on these efforts.

Recommendation: The Director of the Office of Allowances (ALS) should clearly document how the conditions at relevant posts meet the criteria for Director Points to ensure that hardship pay rates for overseas posts are consistently determined across posts and tenures of ALS Directors. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: In commenting on our report, State concurred with our recommendation. As of January 2020, the Director of ALS has not granted any Director Points since the subject GAO review was completed. According to State officials, should points be necessary in the future, ALS will document why the conditions at relevant posts require the use of Director Points connected with hardship pay rates. We will continue to follow-up on this.

Recommendation: The Undersecretary of Management should assess the cost-effectiveness of State's policies and procedures for stopping and starting hardship pay for employees who temporarily leave their assigned overseas posts. (Recommendation 2)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation, and reported that the department is taking a two-pronged approach to reviewing the issue. First, the Department is conducting a comprehensive review of all costs associated with the processing of hardship and other associated allowance and differential cables through reviews of post-level and central expenditures. This review is expected to be complete by October 2020. Second, the Department is costing out alternative methods of addressing allowance and differential costs that reduce the manual effort on the Department but address the need to support costs incurred by Foreign Service Officers overseas. Meetings with Foreign Service Officer staff to understand variances in the current model were held in the summer of 2019. Highlights from those sessions are being incorporated into a proposal to coincide with the review of costs from the first phase. The final proposal is expected to be complete by the end of 2020.

Recommendation: The Department's Comptroller should analyze available diplomatic cable data from overseas posts to identify posts at risk of improper payments for hardship pay, identify any improper payments, and take steps to recover and prevent them. (Recommendation 3)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation. According to State, it continues to identify and seek repayment of improper payments and communicate the importance of timely actions to the regional bureaus and posts to ensure improper payments do not occur. In addition, the Bureau of the Comptroller and Global Financial Services (CGFS) supports the roll out of the Overseas Personnel System, which will centralize the collection of arrival and departure data for the calculation of improper payment notification and risk analysis. To fully implement the recommendation, the Bureau of Human Resources (HR) must complete worldwide deployment of the Overseas Personnel System, and both HR and CGFS would need to complete integration work to enable arrival and departure data to flow in an automated fashion between the two systems. CGFS would then need to provide documentation that the system allows it to more easily identify and prevent improper payments. Preliminary development of the integration will begin in the summer of 2020 while the OPS roll-out continues.

Recommendation: To provide reasonable assurance that USRAP applicant fraud prevention and detection controls are adequate and effectively implemented, the Secretaries of Homeland Security and State should conduct regular joint assessments of applicant fraud risk across USRAP.

Agency: Department of Homeland Security
Status: Open

Comments: We reported that the Department of State and DHS's U.S. Citizenship and Immigration Services (USCIS) have not jointly assessed applicant fraud risks across the U.S. Refugee Admissions Program (USRAP), consistent with federal internal control standards and leading practices for fraud risk management. Specifically, we reported that although State and USCIS perform a number of fraud risk management activities and have responded to individual instances of applicant fraud in the program, these efforts do not position State and USCIS to assess fraud risks program-wide for USRAP or know if their controls are appropriately targeted to the areas of highest risk in the program. Therefore, we recommended that the Secretaries of Homeland Security and State conduct regular joint assessments of applicant fraud risk across USRAP. USCIS concurred with our recommendation. In response, State reported that it will work together with USCIS to conduct joint risk assessments by jointly developing a risk assessment framework. According to DHS and State documentation, the departments finalized a joint framework in January 2018. In February 2019, DHS and State provided us with the interim progress report on their efforts to conduct an assessment of applicant fraud risk across USRAP. In June 2019, USCIS reported that DHS and State have completed the planned analysis and the draft report is being prepared for leadership review and clearance. DHS estimated that the report will be completed by September 30, 2020. To fully address the recommendation, State and USCIS should jointly conduct regular fraud risk assessments across USRAP.

Recommendation: To provide reasonable assurance that USRAP applicant fraud prevention and detection controls are adequate and effectively implemented, the Secretaries of Homeland Security and State should conduct regular joint assessments of applicant fraud risk across USRAP.

Agency: Department of State
Status: Open

Comments: We reported that the Department of State and DHS's U.S. Citizenship and Immigration Services (USCIS) have not jointly assessed applicant fraud risks across the U.S. Refugee Admissions Program (USRAP), consistent with federal internal control standards and leading practices for fraud risk management. Specifically, we reported that although State and USCIS perform a number of fraud risk management activities and have responded to individual instances of applicant fraud in the program, these efforts do not position State and USCIS to assess fraud risks program-wide for USRAP or know if their controls are appropriately targeted to the areas of highest risk in the program. Therefore, we recommended that the Secretaries of Homeland Security and State conduct regular joint assessments of applicant fraud risk across USRAP. USCIS concurred with our recommendation. In response, State reported that it will work together with USCIS to conduct joint risk assessments by jointly developing a risk assessment framework. According to DHS and State documentation, the departments finalized a joint framework in January 2018. In February 2019, DHS and State provided us with the interim progress report on their efforts to conduct an assessment of applicant fraud risk across USRAP. In June 2019, USCIS reported that DHS and State have completed the planned analysis and the draft report is being prepared for leadership review and clearance. DHS estimated that the report will be completed by September 30, 2020. To fully address the recommendation, State and USCIS should jointly conduct regular fraud risk assessments across USRAP.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement the audit plans for the 12 systems and applications that we reviewed in the production computing environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, but the agency provided some evidence of its progress in implementing this recommendation. When IRS fully implements this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should ensure that system administrators and security operations analysts are alerted in the event of audit processing failures.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should regularly update configuration standards and guidelines for network devices to incorporate recommendations from industry leaders, security agencies, and key practices from IRS partners to address known vulnerabilities applicable to IRS's environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement a compliance verification application, or other appropriate process, to ensure configuration policies are comprehensively tested on the mainframe.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should identify and review service organizations' listing of user controls that are deemed relevant and test those controls to appropriately draw conclusions about the operating effectiveness of controls.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: In order to improve employee misconduct policies and procedures, the Secretary of Homeland Security should direct the FEMA Administrator to document policies and procedures to address potential Surge Capacity Force misconduct.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency (FEMA) had developed and documented misconduct policies and procedures for most employees, but not its entire workforce. Specifically, FEMA had not documented misconduct policies and procedures for Surge Capacity Force members, who may augment FEMA's workforce in the event of a catastrophic disaster. As a result, we recommended that FEMA document policies and procedures to address potential Surge Capacity Force misconduct. In September 2017, FEMA officials reported taking action to address this recommendation. Specifically, FEMA distributed a memorandum to Federal Coordinating Officers and Federal Disaster Recovery Coordinators providing guidance on how and to whom to report allegations of misconduct by Surge Capacity Force members, coordination efforts regarding investigations, and how to address the member's duty status during the course of an investigation. FEMA stated that it will further address this recommendation by updating the FEMA Human Capital Plan for the Surge Capacity Force. As of August 2020, FEMA was finalizing a comprehensive Human Capital Guide based on lessons learned during the 2017 disaster season, which will address the Surge Capacity Force. This recommendation will remain open until the Human Capital Guide is completed.

Recommendation: In order to improve employee misconduct policies and procedures, the Secretary of Homeland Security should direct the FEMA Administrator to document Reservist disciplinary options and appeals policies and procedures that are currently in practice at the agency.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency's (FEMA) policies and procedures for Reservist employees did not outline disciplinary options to address misconduct or address the appeals process available for Reservists. As a result, we recommended that FEMA document Reservist disciplinary options and appeals policies and procedures that are currently in practice at the agency. In September 2017, FEMA reported that the Office of Response and Recovery was drafting an addendum to the FEMA Reservist program manual. As of August 2020, FEMA was finalizing a FEMA Reservist Performance Management Directive which will provide agency-wide guidance for Reservist management and discipline. FEMA expects the directive to be completed by November 2020. This recommendation will remain open until the directive is complete.

Recommendation: In order to better identify and address trends in employee misconduct, the Secretary of Homeland Security should direct the FEMA Administrator to, once the quality of the data is improved, conduct routine reporting on employee misconduct trends.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency (FEMA) did not regularly conduct trend analysis on misconduct cases, and that the quality of the data restricted the agency's ability to identify and address trends. As a result, we recommended that, once steps were taken to improve the quality of the data, FEMA should conduct routine reporting on employee misconduct trends. As of July 2020, FEMA's Office of Professional Responsibility (OPR) changed plans on which information system to use for reporting purposes due to cyber security concerns. According to FEMA officials, OPR will be using a DHS enterprise system and the system will be able to generate regular reporting. FEMA anticipates reporting functionality by October 2020. We will continue to monitor FEMA's efforts to address the recommendation.

Recommendation: The Secretary of the Treasury should direct the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, to improve corrective action plans for (1) treaties and international agreements, (2) additional audit procedures for intragovernmental activity and balances, and (3) the Reconciliation Statements so that they include sufficient information to address the control deficiencies in these areas effectively.

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remained open. Treasury believes that its current remediation plan, including its various corrective action plans (CAPs), is comprehensive, appropriate, and effective, with robust and ongoing monitoring processes in place. However, we continue to note that the CAPs in these three areas do not include sufficient steps to effectively address related control deficiencies involving processes used to prepare the CFS. We will follow-up on progress made by Treasury and OMB as part of our fiscal year 2020 CFS audit.

Recommendation: To more fully address stakeholder concerns and help ensure FirstNet's resources reflect expected changes in responsibilities, FirstNet should request that the Public Safety Advisory Committee's Tribal Working Group fully explore tribal concerns and propose actions, as needed, to address those concerns.

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: As of March 2020, FirstNet had taken some action in response to this recommendation but had not fully implemented it. Once we confirm that FirstNet has taken additional action, we will provide updated information.

Recommendation: To improve consistency in CMS oversight of federal spending under section 1115 demonstrations, the Secretary of Health and Human Services should require the Administrator of CMS to develop and document standard operating procedures for monitoring spending under demonstrations that (1) require setting reporting requirements for states that provide CMS the data elements needed for CMS to assess compliance with demonstration spending limits; (2) require consistent enforcement of states' compliance with financial reporting requirements; and (3) require consistent tracking of the amount of unspent funds under demonstration spending limits.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services (HHS) has taken steps to improve the consistency of oversight of federal spending under section 1115 demonstrations. In November 2018, HHS officials reported that they have developed draft guidance, including a standard reporting tool for states, to better ensure consistent reporting of the elements needed to assess compliance with demonstration spending limits and was in the process of testing the tool with two states. In addition, the agency is developing standard operating procedures for agency staff to require consistent tracking of unspent funds under the spending limit. As of November 2019, HHS has not provided any updates. GAO will continue to monitor HHS's actions and once procedures are in place, GAO will assess whether they address our recommendation.

Recommendation: To improve management and oversight of the SAVE program, the director of USCIS should develop and implement a mechanism to oversee agencies' completion of training on additional verification in accordance with SAVE MOA provisions and program policies.

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In March 2017, we found that USCIS does not track or monitor whether SAVE users have completed training and therefore does not have reasonable assurance that users have mastered SAVE policies and procedures prior to accessing the system. We recommended that USCIS develop and implement a mechanism to oversee agencies' completion of training on additional verification in accordance with SAVE provisions and program policies. The USCIS Verification Division reported that it planned to address providing additional training for SAVE users developed by December 31, 2017. The SAVE Program would then offer training events for agencies on the new material reflecting the agency user requirements for additional verification as well as system enhancements. In September 2017, the Verification Division implemented part one of this recommendation, a monthly webinar training session on user agency responsibilities and additional verification. This training can also be delivered to user agencies upon request. For part two of this recommendation, the SAVE program also developed training features to oversee agencies' completion of training. These training features are a system enhancement that will be incorporated into SAVE's overall modernization effort and was expected to be completed by September 30, 2019. In the interim, SAVE is implementing several other enhancements that will reduce the number of cases sent to additional verification, including the completion of modernized matching logic and initial verification screens and retiring less efficient access methods. In September 2019, SAVE officials told us that SAVE has reduced the number of cases sent to additional verification by retiring inefficient access methods and completing modernization of SAVE matching logic and initial verification screens. However, SAVE officials said they also determined that they must update the SAVE tutorial platform and content to account for these and other changes. Officials said that while SAVE is updated, the program continues to provide training, resources, and other support to user agencies to help ensure they are performing additional verification in accordance with SAVE MOA provisions and program policies. The new estimated completion date is February 28, 2021.

Recommendation: To ensure future large-scale rehabilitation projects are in line with leading project management practices, WMATA should develop a policy that requires and includes relevant procedures specifying that, prior to starting large-scale projects, WMATA should use detailed data on the conditions of assets to develop project objectives and scope.

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of July 2020, WMATA is managing three efforts focused on improving WMATA's asset inventory and condition assessment processes. Specifically, WMATA reported that it is developing Data Governance and Standards rules and working with contractors to improve WMATA's asset inventory and condition assessment processes. These efforts should all be complete by the end of 2020. GAO will continue to monitor WMATA's efforts to address this recommendation.

Recommendation: To ensure future large-scale rehabilitation projects are in line with leading project management practices, WMATA should develop a policy that requires and includes relevant procedures specifying that, prior to starting large-scale projects, WMATA should evaluate and compare alternative ways of accomplishing the project objectives, including estimates for the alternatives' costs and impacts.

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of July 2020, WMATA has implemented a new process to evaluate major projects. More specifically, WMATA's new initiative includes a process for assessing and presenting alternative strategies for selected major projects. WMATA currently has a number of cases moving through this process for the first time, and GAO will assess the outcomes of these cases as well as the extent to which this process is codified in WMATA policies later in 2020.

Recommendation: To ensure future large-scale rehabilitation projects are in line with leading project management practices, WMATA should develop a policy that requires and includes relevant procedures specifying that, prior to starting large-scale projects, WMATA should develop a comprehensive project management plan for the selected alternative--to include key elements such as detailed plans for managing the project's scope, schedule, and cost--for those projects that may not be designated major capital projects.

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of July 2020, WMATA is updating its Infrastructure Project Implementation Manual, which would cover projects such as new construction and rehabilitation of facilities and systems. WMATA is planning to issue the update for the Project Implementation Manual by end of September 2020. GAO will continue to monitor WMATA's progress in addressing this recommendation.

Recommendation: To improve the reliability and usefulness of program evaluations for agency program and budget decisions, the Chief Executive Officer of MCC, the Administrator of USAID, the Secretary of Agriculture, the Secretary of Defense, the Secretary of State, and the Secretary of Health and Human Services (in cooperation with State's Office of the U.S. Global AIDS Coordinator and Health Diplomacy) should each develop a plan for improving the quality of evaluations for the programs included in our review, focusing on areas where our analysis has shown the largest areas for potential improvement.

Agency: Department of Agriculture
Status: Open

Comments: In response to the Foreign Aid Transparency and Accountability Act (FATAA), the USDA Foreign Agricultural Service (FAS) - Food Assistance Division (FAD) updated its Monitoring and Evaluation policy in February 2019. In addition, in May 2019, USDA provided GAO with a draft evaluation quality checklist (EQC) that the FAS - FAD will use to review draft evaluations. The checklist includes specific questions about the evaluation's design, methodology, findings, and conclusions, among other items. USDA FAS-FAD indicated that the criteria used in the checklist were developed in alignment with our report, the quality checklist developed for an assessment of USAID evaluations, and its own internal criteria. As of July 2019, the EQC was in internal clearance. In November 2019, USDA stated that it was piloting a draft of the EQC, however, a re-organization within USDA had affected the timetable for implementing it. USDA stated that it would wait to finalize the EQC until it was able to potentially adjust it to reflect any new duties or priorities under the agency re-organization. We will continue to follow-up with USDA FAS-FAD to determine whether the checklist has been finalized and implemented.

Recommendation: To better ensure that the evaluation findings reach their intended audiences and are available to facilitate incorporating lessons learned into future program design or budget decisions, the Chief Executive Officer of MCC should adjust MCC evaluation practices to make evaluation reports available within the timeframe required by MCC guidance.

Agency: Millennium Challenge Corporation
Status: Open

Comments: MCC concurred with the recommendation but noted that its then-forthcoming revised policy on monitoring and evaluation would state that "MCC expects to make each interim and final evaluation report publicly available as soon as practical after receiving the draft report." This revised guidance did not set a specific time frame for the reviews. In a letter provided to GAO in May 2017, MCC stated that it had initiated a re-design of its evaluation monitoring information system to provide MCC with detailed timelines of each component of the evaluation review and publication process. MCC provided additional information regarding actions taken in follow-up to our recommendations in April 2018. In December 2018, MCC provided GAO with a list of evaluation reports that had been released in calendar years 2017 and 2018. Of the 18 reports that were released in 2017 and 2018, 9 were released in six or fewer months after the date of the report and 9 were released more than six months after the date of the report. These review times represented only a modest improvement over what we found at the time of our report. In our report, we found that 6 of the 16 reports we examined were released within six months of MCC receiving the report, and 10 were released more than six months after MCC received the report. We requested an updated list of evaluation reports from MCC in January 2020 and will continue to review the timelines for release of reports.

Recommendation: To better ensure that the evaluation findings reach their intended audiences and are available to facilitate incorporating lessons learned into future program design or budget decisions, the Secretary of Agriculture should implement guidance and procedures for making FAS evaluations available online and searchable on a single website that can be accessed by the general public.

Agency: Department of Agriculture
Status: Open

Comments: In February 2019, the USDA Foreign Agricultural Service (FAS) - Food Assistance Division (FAD)'s updated Monitoring and Evaluation policy required that all final versions of USDA evaluation reports be made publicly available on the FAS website and that evaluators provide a copy of the evaluation reports that is free of personally identifiable and proprietary information. As of May 2019, USDA has published seven non-sensitive evaluations on the publicly available Development Experience Clearinghouse (DEC) website. As of July 2019, FAS was drafting internal standard operating procedures (SOPs) for making future and past evaluations publicly available on the DEC. In November 2019, USDA stated that it was piloting a draft of the SOPs, however, a re-organization within USDA had affected the timetable for implementing them. USDA stated that it would wait to finalize the SOPs until it was able to potentially adjust them to reflect any new duties or priorities under the agency re-organization. We will continue to follow-up with USDA FAS-FAD to determine whether the SOPs have been finalized and implemented.

Recommendation: To support the consistent application of agency telework policy throughout the agency, the Secretaries of the Departments of Education and Labor and the Chair of the Securities and Exchange Commission should implement controls to verify that supervisors have completed telework training prior to entering into telework agreements with their employees and that completion of this training is documented.

Agency: Department of Labor
Status: Open

Comments: In a letter to GAO dated May 26, 2017, the Department of Labor stated that the department currently offers interactive manager/supervisor telework training to all supervisors, the completion of which is documented in the manager and supervisor training records. However, officials said this training was strongly encouraged but not required. In fiscal year 2019, telework training was added as a mandatory course for all managers and supervisors, the completion of which is documented in manager and supervisor training records and reported to departmental leadership. As of August 2020, the Department of Labor was developing and testing a telework tracking application system that will require and document completion of manager/supervisor telework training through the Department's internal learning development system before a supervisor can use the system to approve telework agreements. The Department of Labor anticipates the system will be ready for implementation in FY 2021. We will continue to follow up with the Department of Labor on this and will provide an update when available.

Recommendation: To help ensure that telework agreements accurately reflect telework participation, and to further ensure the accuracy of telework data reported internally and externally, the Secretary of the Department of Labor, the Administrator of the General Services Administration, and the Chair of the Securities and Exchange Commission should require documentation of regular or periodic reviews of all telework agreements in agency telework policies.

Agency: Department of Labor
Status: Open

Comments: In a letter to GAO dated May 26, 2017, the Department of Labor stated that the current policy requires supervisors to conduct an annual review of telework agreements to ensure the arrangement is current and the needs of the agency are being met. In October 2019, Department of Labor officials stated the department is revising its telework processes to include a defined procedure for managers/supervisors to document and report the annual reviews. As of August 2020, the Department of Labor was developing and testing a telework tracking application system that will require and document annual telework agreement recertification for all telework program participants and their supervisors to ensure a regular review of telework agreements. The Department of Labor anticipates the system will be ready for implementation in FY 2021. When we confirm that Labor has fully completed these actions, we will provide updated information.

Recommendation: To improve the accuracy of telework data transmitted to OPM, the Secretary of the Department of Labor should direct the Chief Human Capital Officer to work with the Telework Managing Officer to develop and implement a plan to modernize Labor's telework agreement tracking system to enable more timely access to accurate telework data.

Agency: Department of Labor
Status: Open

Comments: In a letter to GAO dated May 26, 2017, the Department of Labor stated that it will benchmark best practices used by other federal agencies to explore options for utilizing its existing telework agreement tracking system to facilitate more timely access to telework agreement data. As of October 2019, Labor is developing a telework tracking application to improve access to telework data and the quality of telework data reported by its agencies. It is projected this tracking application will be launched as part of a broader internal web-based collaborative platform in FY 2021. When we confirm that Labor has fully completed these actions, we will provide updated information.

Recommendation: To provide additional guidance to agencies and encourage the elimination of barriers to increased telework opportunities consistent with the act, and to ensure the accuracy of telework information OPM annually reports to Congress, the Director of OPM should strengthen controls for reviewing, validating, and reporting telework data in annual Status of Telework in the Federal Government reports. Specifically, OPM should follow up with agency officials on data outliers, including significant changes in year-to-year data.

Agency: Office of Personnel Management
Status: Open

Comments: In a letter dated May 16, 2017, the acting director stated that OPM did not agree with the recommendation. While OPM recognizes the importance of data accuracy to effectively evaluate federal telework programs, OPM does not agree that the Telework Enhancement Act imposes any obligation on OPM to allocate significant resources necessary to validate telework data collected from agencies or that a year-over-year comparison of survey data is needed or advantageous to ensuring a reasonable and rigorous data analysis. We agree that OPM should not independently validate agency data, but OPM should take the steps necessary to identify and explain data outliers and limitations. Because OPM is the agency responsible for reporting telework data, OPM should ensure its annual reports to Congress include a clear discussion of data reliability limitations. Following up on data outliers and large year-to-year changes can help OPM identify data errors that could be corrected by agencies and provide OPM with the opportunity to discuss data limitations with agencies. Including such information clearly in the annual telework reports to Congress can make them more useful to Congress and to others. As of January 2020, OPM has not taken action on this recommendation. If we confirm that OPM does take action in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS is adding a bullet that states that the Federal awarding agency must "ensure that audits are completed and reports are received in a timely manner and in accordance with the requirements of 2 CFR 200.512(a)." FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will help FNS to meet the intent of our recommendation with regards to designing policies. However, to fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS stated that it is expanding upon an existing bullet that states that the Federal awarding agency must "issue a management decision on audit findings within six months after receipt of the audit report....". FNS indicated this section of the manual will be expanded to include the four elements that a management decision must clearly state in writing as prescribed in 2 CFR 200.521(a). FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will help FNS to meet the intent of our recommendation with regards to designing policies. However, to fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Agriculture
Status: Open

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS is adding a bullet stating that the cognizant agency is responsible for "developing a risk-based approach to manage high-risk and recurring single audit findings to identify problems so that adequate resources can be dedicated to address the problem." FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will partially help FNS to meet the intent of our recommendation with regards to designing policies. When designing policies, we believe FNS also needs to clearly provide guidance on the risk management strategy over high-risk and recurring single audit findings, including the steps to follow for identifying problem areas and setting priorities for addressing them. To fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated that it has developed a disbursement report that will capture disbursements equal to or greater than $750,000 and is currently documenting that process and creating instructions for the program areas. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated it has developed a Management Decision Manual template that the program areas will use and is currently creating instructions for the program areas. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Agriculture
Status: Open

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated that it has developed a process to rate each single audit finding. According to RD, the ratings will be tracked in an Access Database, where it will generate reports indicating reoccurring and high-risk findings by borrower and by program. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Housing and Urban Development should direct the Principal Deputy Assistant Secretary for the Office of Community Planning and Development to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Housing and Urban Development
Status: Open

Comments: The Department of Housing and Urban Development's (HUD) Office of Community Planning and Development (CPD) stated that it did not agree with GAO's emphasis on high risk/recurring single audit findings. Nevertheless, in March 2019, HUD's CPD stated that it is working towards a redesigned model for analyzing risk as a basis for monitoring. In August 2020, HUD informed us that CPD is finalizing the beta test for the risk model. Although the risk model will be further defined and enhanced in fiscal year 2021 for fiscal year 2022, CPD plans to roll out the beta test of the risk model to develop the fiscal year 2021 risk rankings. Single audit will be one factor that is included in calculating the risk scores. CPD will validate and assess the results of the beta test and make adjustments as needed. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Secretary of Housing and Urban Development should direct the Principal Deputy Assistant Secretary for the Office of Public and Indian Housing to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Housing and Urban Development
Status: Open

Comments: The Department of Housing and Urban Development's (HUD) Office of Public and Indian Housing (PIH) agreed with this recommendation. On May 7, 2018, PIH stated that it had implemented a Risk Based Approach Tool designed to identify and manage high-risk and recurring single audit findings. The Risk Based Approach tool was intended to track and focus on audit findings reported as material weaknesses or significant deficiencies and was designed to determine the resources needed and available to assist in mitigating the audit findings. However, in March 2019, PIH informed us that in late 2018, PIH began to work toward repositioning goals, priorities and identification of key risk indicators. PIH stated that it is now focused on aligning risk indicators to the HUD and PIH priorities. PIH priorities for fiscal year 2019 include addressing Public Housing Authorities insolvency which may be identified through an Independent Public Accountant audit or through other means. PIH stated that it no longer uses the assessment tool that included over 100 risk indicators. PIH indicated that it has a revised risk mitigation framework proposal that will be presented to the Enterprise Risk Counsel in the near future. In fiscal year 2020, we have sent additional follow-up questions to the agency and are currently waiting for a response. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Secretary of the Army should direct the Accountability and Audit Readiness Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to enhance the directorate's policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs.

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. The Army stated that the Accountability and Audit Readiness Directorate has completed actions to enhance its current standard operating procedures to include (1) updating its corrective action plan (CAP) database and reporting tool, (2) documenting its reporting procedures, and (3) updating its CAP template to include additional elements recommended by the Implementation Guide for OMB Circular A-123. In addition, the Army stated that its policies and procedures include steps to incorporate external financial management-related audit findings assigned to the Accountability and Audit Readiness Directorate by the Internal Review Directorate and that the existing process the Army uses to prioritize findings and the related CAPs and to monitor the progress and status of CAPs has been documented. We reviewed Army's documentation that was provided in January 2020. Army's documentation did not show that it has a process for ensuring that all financial management related findings and recommendations are identified and tracked. To implement this recommendations Army needs to enhance their policies and procedures related to tracking and monitoring the status of these audit findings.

Recommendation: The Secretary of the Air Force should design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that it continues to develop a process for identifying and tracking financial management-related findings and recommendations from all audit sources by updating its process guidance. In August 2019, we received draft guidance that Air Force is developing as guidance and procedures for a universe of financial management-related findings and recommendations. In January 2020, we also received a list of the Air Force deficiencies being tracked in the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database. After assessing the provided documentation, we found that the draft does not include procedures for identifying GAO, DODOIG, and Air Force Audit Agency (AFAA) findings and the database did not include deficiencies identified by those external auditors. As a result of our review of the documentation provided, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: The Secretary of the Air Force should update the Air Force's written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources and for developing and monitoring CAPs so that they include sufficient details. These procedures should include the following details: (1) The process to be followed for prioritizing the financial management-related findings and recommendations from audit sources. (2) The guidance for developing CAPs for all financial management-related audit findings and recommendations from all audit sources to include complete details, including the elements recommended by the Implementation Guide for OMB Circular A-123. (3) The process for monitoring the status of the CAPs for all financial management-related audit findings and recommendations from all audit sources, including the documentation to support any corrective actions taken, as recommended by the Implementation Guide for OMB Circular A-123.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that its Air Force Deficiency Remediation Tracking processes and guides were being refined. In December 2019, Air Force provided a document titled "NFR Prioritization Process." We found that this document included Air Force's priority categories. However, the document does not include information on determining the priority level or applying the priority levels when addressing the deficiencies. We also received a copy of Air Force's guide for the Corrective Action Plan (CAP) process dated July 2019. We found that this guide does not fully incorporate CAP development for deficiencies from all sources. Additionally, the guide does not provide information on the process for (1) determining resources and other requirements for remediating the deficiency, (2) conducting a cost benefit analysis, and (3) developing criteria for validating that the deficiency has been remediated. The guide also includes a template for conducting a root cause analysis. However, the instructions for conducting a root cause analysis are somewhat limited for determining the initial cause or underlying reason for the deficiency. Per the guide, the Air Force uses the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database to monitor and report on Air Force's deficiencies and remediation CAP status. We obtained a listing of the NFRs and related CAPS in the database as of December 2019. We found that deficiencies from all audit sources were not included in the listing, only the independent public accountant's NFRs. The results of our review of a limited number of CAPs indicate that Air Force staff does not always comply with the Air Force's CAP requirements. As a result of our assessment of the Air Force documentation, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: To improve DOD management's process for monitoring the military services' audit remediation efforts and to provide timely and useful information to stakeholders as needed, the Secretary of Defense should direct the Secretary of the Army, the Secretary of the Navy, and the Secretary of the Air Force to prepare and submit to the Under Secretary of Defense (Comptroller), on at least a bimonthly basis for availability at the FIAR Governance Board meetings, a summary of key information included in the CAPs that at a minimum contains the data elements recommended by the Implementation Guide for OMB Circular A-123 for each CAP related to critical capabilities for achieving audit readiness.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation. DOD stated that it solicits input on a bi-monthly basis, on critical capability corrective action plans (CAPs) at a summary level. This information is provided routinely at regularly scheduled FIAR Governance Board meetings. DOD also stated that an updated notice of finding and recommendation (NFR) form template is being developed and will be provided to the military services to use for reporting this information so that it will include the recommended standard data elements outlined in OMB Circular A-123 to provide greater transparency into the nature of remediation plans. DOD also stated that FIAR Guidance will be updated to explicitly state that military services should include the OMB recommended standard data elements in CAPs. To implement this recommendation, DOD needs to provide documentation that shows that the military services are able to provide a summary of key information in the corrective action plans that at a minimum contains data elements recommended by the Implementation Guide for OMB Circular A-123. .

Recommendation: To reasonably assure that DOD management and external stakeholders have a comprehensive picture of the status of corrective actions needed for audit readiness throughout the department, the Secretary of Defense should direct the Under Secretary of Defense (Comptroller) to prepare a consolidated CAP management summary on a bimonthly basis that includes the data elements referred to above on the status of all CAPs related to critical capabilities for the military services and for the service providers and other defense organizations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD partially concurred with this recommendation. According to DOD, the military services already provide summary-level updates on their critical capability corrective action plans (CAPs) at FIAR Governance Board meetings. It also stated that the template that is used to present CAPs to the FIAR Governance Board meetings at the summary level has been updated to align CAPs to critical capabilities. DOD still needs to address how all of the data elements from the Implementation Guide for OMB Circular A-123 will be summarized or otherwise reported for all CAPs pertaining to critical capabilities across the Department. In addition, DOD stated that because the Under Secretary of Defense (Comptroller) takes responsibility for maintaining, monitoring, and reporting on the status of CAPs for the service providers and other defense organizations and of DOD-wide issues, the Comptroller will also summarize this information. However, DOD has not clarified what information from the military services will be summarized. To implement this recommendation, DOD needs to provide documentation that shows the Comptroller has prepared a consolidated CAP management summary on a bimonthly basis.

Recommendation: To improve oversight of states' payment structures for MLTSS, the Administrator of CMS should require all states to collect and report on progress toward achieving MLTSS program goals, such as whether the program enhances the provision of community-based care.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of June 2020, CMS has not informed us of any additional actions taken to implement this recommendation. CMS previously reported that it is working to develop guidance on how states report on progress towards achieving MLTSS program goals, such as the extent to which the program enhances the provision of community-based care. CMS has contracted with a vendor to produce recommendations for what would be included in the state reporting. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve oversight of states' payment structures for MLTSS, the Administrator of CMS should establish criteria for what situations would warrant exceptions to the federal standards that the data used to set rates be no older than the three most recent and complete years.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of June 2020, CMS has not informed us of any additional actions taken to implement this recommendation. CMS previously reported that it has monitored rate certifications and the data used for rating periods starting on or after July 1, 2017. CMS said that it has not had any states set rates that do not meet the federal standards for the data being no older than the three most recent and complete years and, therefore, does not believe that it should publish guidance on what situations would warrant exceptions. In order to better determine whether there is a need for such guidance, we believe that CMS should continue to monitor rate certifications and assess the data being used, particularly as additional states are developing or considering implementation of MLTSS programs. We will update the status of this recommendation as CMS conducts reviews of other states' payment structures and data used to establish them.

Recommendation: To improve oversight of states' payment structures for MLTSS, the Administrator of CMS should provide states with guidance that includes minimum standards for encounter data validation procedures.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of June 2020, CMS has not informed us of any additional actions taken to implement this recommendation. CMS previously reported to GAO that it has convened a workgroup to develop an Encounter Data Toolkit, which will provide best practices for encounter data submissions and validation procedures. The workgroup is also discussing minimum standards for states to determine if the encounter data are complete and accurate for purposes of rate setting. The workgroup met in June and July 2018, and two additional workgroup meeting are planned prior to the drafting of the toolkit. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve care for women veterans, the Secretary of Veterans Affairs should direct the Under Secretary for Health to strengthen the environment of care inspections process and VHA's oversight of this process by expanding the list of requirements that facility staff inspect for compliance to align with VHA's women's health handbook, ensuring that all patient care areas of the medical facility are inspected as required, clarifying the roles and responsibilities of VA medical facility staff responsible for identifying and addressing compliance, and establishing a process to verify that noncompliance information reported by facilities to VHA Central Office is accurate and complete.

Agency: Department of Veterans Affairs
Status: Open

Comments: As of October 2018, VA has taken some actions to address this recommendation, but additional actions are needed to fully implement it. We will update the status of this recommendation when we receive additional information from VA.

Recommendation: To improve care for women veterans, the Secretary of Veterans Affairs should direct the Under Secretary for Health to monitor women veterans' access to key sex-specific care services--mammography, maternity care, and gynecology--under current and future community care contracts. For those key services, monitoring should include an examination of appointment scheduling and completion times, driving times to appointments, and reasons appointments could not be scheduled with community providers.

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: As of June 2017, VHA still lacks data and performance measures for the availability under Choice of sex-specific care, such as mammograms, maternity care, or gynecology. In contrast, for another VA care in the community program, PC3 (a program that the Choice third party administrators also administer) VHA collects data and has performance measures to evaluate women veterans' access to mammography and maternity care. To fully implement this recommendation, VHA needs to extend the collection of data to include care delivered through the Choice Program and other community care programs and establish related performance measures. VA is in the process of letting contracts for its new community care program and is expected to have contracts in place for all regions of the country in fiscal year 2019

Recommendation: To achieve a better understanding of the effect of certain Personal care services (PCS) services on beneficiaries and a more consistent administration of policies and procedures across PCS programs, the Acting Administrator of CMS should collect and analyze states' required information on the impact of the Participant-Directed Option and Community First Choice programs on the health and welfare of beneficiaries as well as the state quality measures for the Participant-Directed Option and Community First Choice programs.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Centers for Medicare & Medicaid Services (CMS) concurred with GAO's recommendation. On December 30, 2016, the agency issued guidance on the Community First Choice program to assist states in submitting information to CMS on the health and welfare of beneficiaries. In March 2019, CMS officials stated that the agency is currently developing the process for states to report this information to CMS. Agency officials also stated they are exploring the value of collecting this information for the Participant-Directed Option program given the limited number of states currently operating under this authority. In February 2020, CMS officials stated that the agency continues to develop policy related to this recommendation.

Recommendation: To provide agencies access to SSA's more complete set of death data, Congress should consider amending the Social Security Act to explicitly allow SSA to share its full death file with Treasury for use through the DNP working system.

Agency: Congress
Status: Open

Comments: In fiscal year 2020, the Senate passed S.4104, which included language to address the recommendation. In the context of the Do Not Pay (DNP) working system, the bill, if enacted, would authorize comparison of the Social Security Administration's (SSA) full death file with personally identifiable information reviewed through the working system and would allow redisclosure of such comparison of information to any federal or state agency authorized to use the working system. As of July 15, 2020, the House has not introduced a related bill for fiscal year 2020. Additionally, in February 2020, the administration released its President's 2021 Budget, which proposes legislation to allow the DNP Business Center full access to the SSA full death file. This proposal would include the Department of the Treasury and the SSA working together to determine the most efficient manner to make full death information available for use in preventing improper payment and fraud. We will continue to monitor congressional legislation to address this recommendation. .

Recommendation: To better monitor agency use of the DNP working system once a strategy has been developed, the Director of OMB should develop and implement monitoring mechanisms--such as goals, benchmarks, and performance measures--to evaluate agency use of the DNP working system.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB agreed with the concept of monitoring mechanisms and will continue to work with agencies to reduce improper payments and encourage agencies to establish goals to improve payment accuracy that will be monitored and evaluated by OMB. In fiscal year 2019, OMB provided us a status update on July 31, 2019, stating that Treasury does this monitoring and reports updates to OMB on a quarterly basis and that monitoring will occur in conjunction with the President's Management Agenda. In August 2020, Treasury provided us examples of reports that it provides to OMB to assist OMB with evaluating agency use of the DNP working system. We plan to meet with OMB to discuss how it uses these reports and will continue to monitor OMB's actions to address this recommendation.

Recommendation: To reasonably assure that agency-reported information on use of the DNP working system is reliable, the Director of OMB should develop a process for comparing agency reporting on the use of the DNP working system to available sources, such as OMB guidance and DNP working system adjudication reports.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) agreed with the concept of ensuring that data are reliable and will consider the feasibility of a process to compare agency submissions to available sources to reasonably assure that agency-reported information on use of the Do Not Pay working system is reliable. OMB provided us a status update on July 1, 2019, stating that OMB will work with Treasury to determine feasibility of doing this review and establishing a process during fiscal year 2019. As of February 2020, OMB has not provided any new status updates for this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: To reasonably assure that agency-reported information on use of the DNP working system is complete, the Director of OMB should revise its guidance to clarify whether agencies should report on their uses of all of the functionalities of the DNP working system in their agency financial reports.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) agreed with ensuring the completeness of data and will continue to work with agencies and the Chief Financial Officer community to ensure that agency-reported information on the use of the Do Not Pay (DNP) working system is complete. In fiscal year 2019, OMB provided us a status update on July 1, 2019, stating that this recommendation was addressed in OMB's Circular A-136. Additionally, we met with OMB officials on July 31, 2019. During the meeting, OMB officials informed us that the OMB Circular A-136, Section II.4.5 (bullet 3) (dated June 28, 2019) states that "Agencies should provide a brief narrative of the reduction in improper payments that is attributable to the DNP Initiative, as applicable. See OMB Circular A-123, Appendix C, Part V for a thorough overview of the roles and responsibilities of agencies to use centralized data sources such as the Treasury Working System and other government databases to prevent improper payments." We have reviewed OMB Circular A-136 and confirmed that the circular does contain the statements above. However, we do not believe that the OMB Circular A-136 meets the intent of our recommendation. GAO issued its recommendation, in part, because GAO found that OMB guidance does not indicate whether agencies should report on all uses of the DNP working system, including those outside payment integration that the DNP working system does not track. For this reason, GAO report concluded that without complete and reliable data and clear guidance on what information agencies should report, OMB cannot effectively monitor and evaluate the use of the DNP working system. Therefore, we do not believe that the OMB Circular A-136 sufficiently clarifies whether agencies should report on their uses of all of the functionalities of the DNP working system in their agency financial reports. As of February 2020, OMB has not provided any new status updates for this recommendation. We will continue to monitor OMB's actions to address this recommendation.