Recommendation Dashboard

We recommend that the Millennium Challenge Corporation determine the allowability of $27,000 in ineligible questioned costs on pages 40 and 41 of the audit report and recover any amount that is unallowable.

USAID's Chief Information Officer conduct updated risk assessments for the two systems we identified

USAID's Chief Information Officer perform security controls assessments for the two systems we identified.

USAID's Chief Information Officer determine whether the Agency included cybersecurity duties in position descriptions and performance plans. If not, take corrective action, including addressing the causes for not doing so.

USAID's Chief Information Officer determine whether the Agency developed and implemented policies and procedures for maintaining data and metadata inventories for its various data types, including data from third-party providers. If not, take corrective action, including addressing the causes for not doing so.

USAID's Chief Information Officer determine whether the Agency implemented network monitoring and enforcement mechanisms to identify and disconnect or isolate noncompliant devices. If not, take corrective action, including addressing the causes for not doing so.

USAID or other U.S. government officials responsible for the administration and oversight of the direct budget support funds work with contractor KPMG to develop a plan to submit the required oversight deliverables to ensure U.S. government funds are being used as intended

USAID or other U.S. government officials responsible for the administration and oversight of the direct budget support funds develop and implement a plan to review the internally displaced persons expenditure category from June 2022 through December 2023 in the scope of work for future contracted audits of the Government of Ukraine to confirm that preventative controls screen beneficiaries for duplicate payments

USAID or other U.S. government officials responsible for the administration and oversight of the direct budget support funds work with the the Government of Ukraine to develop a plan to identify the extent to which payments were made to internally displaced persons living abroad between June 2022 and July 2023 that were reimbursed by USAID's contributions to the Public Expenditures for Administrative Capacity Endurance fund, and use the reconciliation process outlined in the World Bank's 2024 Project Operation Manual for any amounts determined to be ineligible

We recommend that USAID or other U.S. government officials responsible for the administration and oversight of the Dubai warehouse take the following actions: Update the warehouse contract to clarify requirements for temperature and humidity control, maintaining mechanical equipment, and inspecting commodities in the warehouse.

We recommend that USAID or other U.S. government officials responsible for the administration and oversight of the Dubai warehouse take the following actions: Update the statement of work for third-party inspections to clarify quarterly inspection requirements of Dubai warehouse conditions, such as pest control and temperature.

Verify that MCA Lesotho II Authority corrects the one material weakness in internal control detailed on pages 42 and 46 of the audit report.

Verify that MCA Lesotho II Authority corrects the one instance of material noncompliance detailed on pages 42 and 47 of the audit report.

We recommend that USAID verify that Amref Health Africa corrects the one instance of material noncompliance detailed on pages 59 to 61 of the audit report.

Conduct a comprehensive review of IAF's software and hardware inventories and update them to ensure that they are accurate and complete.

IAF's Chief Information Security Officer update IAF's procedures to include all elements for tracking the Agency's software and hardware assets. At a minimum these elements should include device type, location, and software license information.

IAF's Chief Information Security Officer conduct a security controls assessment for the two systems identified.

IAF's Chief Information Security Officer develop and implement procedures to hold system owners accountable for conducting security controls assessments and completing system security plans, and document which security controls are assessed and when.

IAF's Chief Information Security Officer update security plans for the two systems identified to include all required components as outlined in NIST Special Publication 800-53.

IAF's Chief Information Security Officer document the controls IAF is responsible for implementing for the external system identified and develop and implement a security plan for the system.

Determine the allowability of $68,272 in unsupported questioned costs on pages 20 to 24 of the audit report and recover any amount that is unallowable.

Verify that The Association Network for Building Peace corrects the instance of material noncompliance detailed on pages 37 to 38 of the audit report.

Finalize and implement a policy outlining responsibilities and procedures for using administrative funds for purchases, including procedures for documenting justifications and approvals of requests.

Determine the allowability of approximately $26,900 in questioned costs. 

We recommend that USAID verify that Baylor College of Medicine Children's Foundation Uganda corrects the one instance of material noncompliance detailed on page 31 of the audit report.