Recommendation Dashboard

USAID/India determine (1) whether all expenditures were properly classified; (2) the amount of expenditures that exceeded the budgeted amounts by category had the expenditures been properly classified; and (3) the allowability and recovery, if appropriate, of the excess of expenditures over budget.

USAID/India verify that Karnataka Health Promotion Trust corrects the significant deficiency in internal control discussed on page 2 of this memorandum related to misclassification of accounts.

USAID/Honduras verify that FHIS-DIM corrects the two material weaknesses in internal control detailed on pages 17 and 18 and pages 19 to 23 of the audit report.

USAID/Peru determine the allowability of $184,318 in ineligible questioned costs on pages 16 and 18 of the audit report and recover any amount that is unallowable.

USAID/Peru veify that DEVIDA corrects the two significant deficiencies in internal control detailed on pages 27 and 28 of the audit report.

USAID Peru verify that DEVIDA corrects the one instance of material noncompliance detailed on page 42 of the audit report.

USAID/Pakistan determine the allowability of $5,738,008 in questioned costs ($5,698,756 ineligible and $39,252 unsupported) as detailed in Table 1 on pages 3-4 of this memorandum, and recover any amount that is unallowable.

USAID/Pakistan determine (1) whether disposal was made for the dismantled materials; (2) the amount of sales of the dismantled materials not reported to USAID; and (3) the allowability and recovery, if appropriate, of these questioned revenues, as detailed in Finding 4.1.4 on pages 29-30 of the audit report.

USAID/Pakistan verify that the Provincial Reconstruction Rehabilitation & Settlement Authority, Government of Khyber Pakhtunkhwa corrects the 30 material instances of noncompliance detailed in Table 1 on pages 3-4 of this memorandum.

USAID/Cyprus determine the allowability and collect as appropriate, $34,112 in ineligible questioned costs as detailed in appendix A of PricewaterhouseCoopers report.

USAID/West Bank and Gaza require Development Alternatives, Inc. to establish and implement policies and procedures ensuring competitive contracting, as detailed on pages 19-21 of PricewaterhouseCoopers audit report.

USAID/West Bank and Gaza require Development Alternatives, Inc. to establish and implement policies and procedures ensuring proper incorporation of the required provisions in its sub-awards, as detailed on pages 22-24 of PricewaterhouseCoopers audit report.

USAID's chief information officer update the Agency's Vulnerability Management Standard Operating Procedure to (1) define the timeframe for applying system patches and (2) document and implement a process to validate that system patches are applied according to the timeframe
specified in the procedure.

USAID's chief information officer document and implement a process to validate that unsupported software is either upgraded or removed within 48 hours of identification, as specified in the Agency's Unauthorized/Unsupported Software Standard Operating Procedures, or document acceptance of the risk for allowing the unsupported software on the network.

USAID's chief information officer document and implement a process to fully automate the disabling of accounts after 90 days of inactivity and document the results.

USAID's chief information officer document and implement a process to validate that Agency account management policies are enforced for all USAID information systems, or formally document acceptance of the risk when implementing the account management policies is not feasible.

USAID's chief information officer document and implement a process to validate that USAID procedures are followed for testing, conducting security impact analysis of, and approving system changes.

USAID's chief information officer document and implement a process to validate that security assessment plans are documented and uploaded into the Cyber Security Assessment and Management tool.

USAID's chief information officer document and implement a process for reviewing plans of action and milestones on a regular basis to validate that scheduled completion dates, milestone updates, and quarterly updates are documented.

USAID's chief information officer document and implement a process to validate that USAID's privacy plan, policies, and procedures define personally identifiable information in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-122, and are reviewed and kept up-to-date at least on a biannual basis as recommended by NIST Special Publication 800-53 (revision 4).

USAID's chief information officer document and implement a process to complete the rollout of the role-based security training to all required individuals.

USAID/Pakistan verify that Trust for Democratic Education and Accountability corrects the one material weakness in internal control identified in the report on internal control on page 21 and further detailed in Finding 7.1 on page 25 of the audit report.

USAID/Pakistan verify that Trust for Democratic Education and Accountability corrects the two issues which we considered as material instances of noncompliance as discussed on page 2 of this memorandum and further detailed in Issues 1 and 2 of the management letter.

USAID/Kenya and East Africa determine the allowability of $38,715 in questioned costs ($37,521 ineligible, $1,194 unsupported) on pages 12 and 17 of the audit report and recover any amount that is unallowable.

USAID/Kenya and East Africa verify that African Union-Interafrican Bureau for Animal Resources corrects the one significant deficiency in internal control detailed on page 25 of the audit report.

USAID/Kenya and East Africa verify that African Union-Interafrican Bureau for Animal Resources corrects the three instances of material noncompliance detailed on pages 29 to 32 of the audit report.

USAID/M/OAA/CAS/CAM determine the allowability of $123,749 in ineligible questioned costs on page 11 of the audit report and recover any amount that is unallowable.

USAID/M/OAA/CAS/CAM verify that KPMG East Africa Limited corrects the two instances of material noncompliance detailed on pages 17 to 19 of the audit report.

USAID/M/OAA/CAS/CAM verify that KPMG East Africa Limited corrects the one instance of material noncompliance emanating from prior periods and detailed on page 20 of the audit report.