Recommendation Dashboard

USAID's chief information officer update the Agency's Vulnerability Management Standard Operating Procedure to (1) define the timeframe for applying system patches and (2) document and implement a process to validate that system patches are applied according to the timeframe
specified in the procedure.

USAID's chief information officer document and implement a process to validate that unsupported software is either upgraded or removed within 48 hours of identification, as specified in the Agency's Unauthorized/Unsupported Software Standard Operating Procedures, or document acceptance of the risk for allowing the unsupported software on the network.

USAID's chief information officer document and implement a process to fully automate the disabling of accounts after 90 days of inactivity and document the results.

USAID's chief information officer document and implement a process to validate that Agency account management policies are enforced for all USAID information systems, or formally document acceptance of the risk when implementing the account management policies is not feasible.

USAID's chief information officer document and implement a process to validate that USAID procedures are followed for testing, conducting security impact analysis of, and approving system changes.

USAID's chief information officer document and implement a process to validate that security assessment plans are documented and uploaded into the Cyber Security Assessment and Management tool.

USAID's chief information officer document and implement a process for reviewing plans of action and milestones on a regular basis to validate that scheduled completion dates, milestone updates, and quarterly updates are documented.

USAID's chief information officer document and implement a process to validate that USAID's privacy plan, policies, and procedures define personally identifiable information in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-122, and are reviewed and kept up-to-date at least on a biannual basis as recommended by NIST Special Publication 800-53 (revision 4).

USAID's chief information officer document and implement a process to complete the rollout of the role-based security training to all required individuals.

USAID/M/OAA/CAS/CAM determine the allowability of $123,749 in ineligible questioned costs on page 11 of the audit report and recover any amount that is unallowable.

USAID/M/OAA/CAS/CAM verify that KPMG East Africa Limited corrects the two instances of material noncompliance detailed on pages 17 to 19 of the audit report.

USAID/M/OAA/CAS/CAM verify that KPMG East Africa Limited corrects the one instance of material noncompliance emanating from prior periods and detailed on page 20 of the audit report.

USAID/Southern Africa verify that Africa Health Placements NPC corrects the two instances of material noncompliance detailed on pages 22 and 23 of the audit report.

USAID/Guinea determine the allowability of $2,371 ineligible questioned costs on pages 14 and 17 of the audit report and recover any amount that is unallowable.

USAID/Guinea verify that Organisation Catholique pour la Promotion Humaine Caritas Guinea corrects the one material weaknesses and two significant deficiencies in internal control detailed on pages 24 to 26 of the audit report.

USAID/Guinea verify that Organisation Catholique pour la Promotion Humaine Caritas Guinea corrects the two instances of material noncompliance detailed on pages 29 and 30 of the audit report.

USAID/Kenya and East Africa determine the allowability of $38,715 in questioned costs ($37,521 ineligible, $1,194 unsupported) on pages 12 and 17 of the audit report and recover any amount that is unallowable.

USAID/Kenya and East Africa verify that African Union-Interafrican Bureau for Animal Resources corrects the one significant deficiency in internal control detailed on page 25 of the audit report.

USAID/Kenya and East Africa verify that African Union-Interafrican Bureau for Animal Resources corrects the three instances of material noncompliance detailed on pages 29 to 32 of the audit report.

USAID/Nigeria determine the allowability of $98,820 in ineligible questioned costs on pages 19, 20, 25, and 26 of the audit report and recover any amount that is unallowable.

USAID/Nigeria verify that Interfaith Mediation Centre corrects the two material weaknesses in internal control identified on page 25 of the audit report.

MCC's Department of Administration and Finance and the Chief Financial Officer update the "Expense Accruals Financial Management Division Procedure Manual" to reflect the current grant accrual methodology.

MCC's Department of Administration and Finance and the Chief Financial Officer provide Millennium Challenge Accounts with written guidance on developing grant accrual estimates to ensure validity of the grant accruals estimate. The guidance should include, but not be limited to, the following: 1) Take into consideration the impact of contract advances and retentions for large works contracts in the accrual estimate. 2) Ensure that accrual estimates do not include costs that will not be paid with compact funds. 3) Consider historical questioned costs for contracts and grants that are significant in developing the accrual estimate.

MCC's Department of Administration and Finance and the Chief Financial Officer update the "Compact Grant Accrual Validation Data Call Desktop Manual" to include a time requirement for MCC to perform followup with Millennium Challenge Accounts so that errors in accrual estimates or validations are promptly identified and addressed.

MCC's Department of Administration and Finance and the Chief Financial Officer provide Millennium Challenge Accounts with written guidance to ensure that the Millennium Challenge Accounts perform grant accrual validation correctly to include, but not be limited to, validation of consultant contract costs.

MCC's Department of Administration and Finance and the Chief Financial Officer develop clear and complete written guidance for the Millennium Challenge Accounts' internal control over the data call process, provide effective training, and monitor the effectiveness of the internal control.

MCC's Department of Administration and Finance and the Chief Financial Officer develop, document, and implement a process to oversee and verify that the accountable Government entities conduct pre-Millennium Challenge Accounts compact procurements in accordance with the compact agreement and the Program Procurement Guidelines.

MCC's Department of Administration and Finance and the Chief Financial Officer update MCC's Program Procurement Guidelines to require the Millennium Challenge Accounts to document alternative procurement procedures so that all parties are aware of what is required, who is accountable for what, and how the procurement will be documented.

MCC's Department of Administration and Finance and the Chief Financial Officer develop, document, and implement policies and procedures for MCC's management oversight of transfer and retention of pre-Millennium Challenge Accounts compact procurement and related documents to the Millennium Challenge Accounts.

MCC's Department of Administration and Finance and the Chief Financial Officer inform the Millennium Challenge Accounts that the U.S. State Department's Terrorist Exclusion List should be documented separately, for all currently active awards and future awards, and update MCC's vendor eligibility verification guidance provided to the Millennium Challenge Accounts for completeness and accuracy.

MCC's Department of Administration and Finance and the Chief Financial Officer Identify the Millennium Challenge Accounts who are late with the vendor invoice payments, determine the reasons/causes for late payments, implement corrective actions, and monitor effectiveness of the corrective actions.

USAID/Haiti document and implement a detailed plan to conclude the Pilot Project for Sustainable Electricity Distribution that includes deliberate benchmarks and timelines for modernization and expansion to best position the utility for the private sector transfer strategy at the end of the project, and a formal contingency plan in case a private sector operator is not on track to take over the utility by the specified time.

USAID/Haiti implement a plan to address the longstanding staffing challenges at USAID/Haiti, reported repeatedly in the mission's Federal Manager's Financial Integrity Act of 1982 certifications, to enable the mission to better address the project oversight deficiencies identified in this report.

USAID develop and implement a governance structure so that the chief information officer position reports directly to the Administrator as required by the Federal Information Technology Acquisition Reform Act and the Clinger-Cohen Act.

USAID revise Automated Directives System 101 to give the chief information officer the roles, responsibilities, and authorities to oversee all annual and multiyear planning, programming, and budget execution decisions, and reports related to information technology resources, as required by the Federal Information Technology Acquisition Reform Act.

USAID develop and implement policies that give the chief information officer authority for formulating and executing the information technology budget and overseeing information technology resources, as required by the Federal Information Technology Acquisition Reform Act.

USAID revise Agency policies and procedures to provide the chief information officer with information needed for overseeing all information technology investments and acquisitions to prevent, detect, and correct shadow and hidden information technology.

USAID issue a written decision on whether to authorize DTRAMS, and take appropriate actions to comply with security assessment and authorization controls in National Institute of Standards and Technology Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations."

USAID document and implement an inventory validation process to accurately and completely document information technology investments, the information technology systems inventory, and the Federal Information Security Modernization Act reportable systems inventory.

USAID document and implement processes for maintaining accurate records for, and managing the consolidation and streamlining of, its information technology resources, systems, data centers, and other shared information technology services in compliance with Office of Management and Budget Memorandum M-15-14.

USAID revise Agency policies, procedures, and directives to adopt the definitions of terms and requirements presented in Office of Management and Budget Memorandum M-15-14, including (1) information technology budgetary resources, personnel, and facilities and (2) acquisitions and interagency agreements that include information technology and the services or equipment provided by such acquisitions or interagency agreements.

USAID document and implement a process to enforce the competency requirements for information technology staff, including those in information technology leadership positions, and complete the assessment of competency requirements for information technology staff.

USAID/Pakistan determine the allowability of $1,301,519 in questioned costs ($1,195,033 ineligible and $106,486 unsupported) as detailed in Table 1 on pages 3-4 of this memorandum, and recover any amount that is unallowable.

USAID/Pakistan determine (1) whether disposal was made for old pipes extracted from sites; (2) the amount of sales of the old pipes not reported to USAID; and (3) the allowability and recovery, if appropriate, of these questioned revenues, as detailed in Finding 4.3.16 on page 46 of the audit report.

USAID/Pakistan verify that the Local Government & Rural Development Department, Government of Khyber Pakhtunkhwa corrects the 17 material instances of noncompliance detailed in Table 1 on pages 3-4 of this memorandum.