Recommendation Dashboard

We recommend that IAF's chief information officer update the agency's system security plan to include controls in National Institute of Standards and Technology Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

We recommend that IAF's chief information officer develop and implement a plan, including tools and other resources, to remediate critical and high vulnerabilities within the timeframes specified in the agency's "Information System Security Program Standard Operating Procedures" (February 2022).

USAID West Bank and Gaza verify that Tech2Peace corrects the 3 instances of material noncompliance detailed on pages 25 to 27 of the audit report.

Develop and communicate guidance on post-award spot checks to include a more detailed definition of spot checks, illustrative procedures and opportunities for their use, and procedures for appropriately communicating their results, when warranted.

Develop and implement a process to track the status of organizational capacity reviews and ensure they are updated in accordance with Automated Directives System Chapter 308.

Develop and implement a formal follow-up mechanism to track the resolution of recommendations included in organizational capacity reviews.

We recommend that MCC's Chief Information Officer take the following action:
Recommendation 1. Implement level 3 event logging requirements in accordance with Office of Management and Budget Memorandum M-21-31.

USAID/ West Bank and Gaza verify that the auditee corrects the 3 instances of material noncompliance detailed on pages 22 to 24 of the audit report.

USAID/West Bank and Gaza verify that the auditee corrects the two material weaknesses in internal control detailed on pages 16 to 19 of the audit report.

Correct the six material weaknesses in internal control disclosed on page 17 of the audit report.

Determine the allowability of the questioned costs of $34,805 ($34,368 ineligible and $437 unsupported), on pages 10-12 of the audit report and recover any amount that is unallowable.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that Humanitarian Outcomes Ltd corrects the instance of
material noncompliance detailed on page 21 of the audit report.

We recommend that USAID/Kenya and East Africa verify that Liverpool Voluntary Care and Treatment Health provides University Research Company International and FHI360 with a copy of the findings raised in Ernst & Young LLP's audit report for their review (a) to determine the allowability of any ineligible questioned costs identified on page 20 of the audit report pertaining to their particular subawards; and (b) to take any corrective actions regarding the instances of material noncompliance related to the subawards detailed on pages 42 to 46 of the report.

We recommend that USAID/Kenya and East Africa determine the allowability of the $128,405 in ineligible questioned costs on page 20 of the audit report and recover any amount that is unallowable.

We recommend that USAID/Kenya and East Africa verify that Liverpool Voluntary Care and Treatment Health corrects the two instances of material noncompliance detailed on pages 45 to 46, and 48 of the audit report.

Enforce implemented policies to hold Approving Officials accountable for ensuring that cardholders under their purview properly maintain official records for all transactions made with their cards in accordance with Section VI of ADS 331MAA so that supporting documentation for card charges can be reviewed.

Enforce its policies to ensure that Approving Officials are performing their assigned duties to review and sign the signed Monthly Billing Bank Statements upon receipt from their respective cardholders.

Continue to counsel, retrain, and document any cardholder accounts found non-compliant.

We recommend that USAID/Southern Africa verify that Anova Health Institute NPC corrects the one instance of material noncompliance detailed on pages 52 to 53 of the audit report.