Recommendation Dashboard

The Overseas Private Investment Corporation's Chief Information Officer implement a documented process for periodically reviewing service accounts to determine whether accounts are necessary, and disable accounts no longer required.

The Overseas Private Investment Corporation's Chief Information Security Officer implement a documented process for verifying that all personnel receive security and privacy training annually, and document the results.

The Overseas Private Investment Corporation's Chief Information Security Officer develop and implement documented, role-based information technology and security training for personnel.

The Overseas Private Investment Corporation's Chief Information Officer obtain and implement a memorandum of understanding for its Oracle E-Business Suite System.

The Overseas Private Investment Corporation's Chief Information Officer obtain and implement a documented interconnection security agreement for its Oracle E-Business Suite System.

The Overseas Private Investment Corporation's Chief Information Officer implement multifactor authentication for network user accounts and document the results. If management determines that using such controls is not feasible, document that decision formally and implement mitigating controls.

The Overseas Private Investment Corporation's Chief Information Officer document a risk assessment for OPIC Insight.

The Overseas Private Investment Corporation's Chief Information Officer document a system security plan for OPIC Insight.

The Overseas Private Investment Corporation's Chief Information Officer complete a security control assessment for OPIC Insight and document the results.

The Overseas Private Investment Corporation's Chief Information Officer document OPIC Insight's authorization to operate based on security assessments and acknowledging any operating risks.

The Overseas Private Investment Corporation require U.S. sponsors to be eligible (take ownership or risk) before it grants project clearance.

The Overseas Private Investment Corporation amend its policy to require policy clearance in advance of board approval.

Inter-American Foundation's Chief Information Officer either remediate vulnerabilities in the network identified by the Office of Inspector General's contractor, as appropriate, and document the results or document acceptance of the risks of those vulnerabilities.

The Inter-American Foundation's Chief Information Officer implement a documented process to validate the completeness of the vulnerability scans to determine whether all applicable vulnerabilities are identified and either remediated or accepted in a timely manner.

The Inter-American Foundation's Chief Information Officer document and implement procedures to review active network accounts that have not logged in over a specified period of time, as defined by the foundation, to determine whether accounts are necessary.

The Inter-American Foundation's Chief Information Officer document and implement a process to review service and administrator accounts to determine whether passwords are changed within defined periods.

The Inter-American Foundation's Chief Information Officer update and implement the Information System Security Program Standard Operating Procedures to reflect NIST Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations.

The Inter-American Foundation's Chief Information Officer implement a documented process to review and update the IAF Enterprise Network and Software Applications System Security Plan annually. At a minimum, this should include a determination whether the security requirements and controls for the system are documented adequately and reflect the current information system environment.

The Inter-American Foundation's Chief Information Officer implement multi-factor authentication with one factor separate from the system gaining access for the foundation's use of Google Mail.

The Inter-American Foundation's Chief Information Officer implement monitoring controls of humidity levels in the computer room and document the results.

The Inter-American Foundation's Chief Information Officer update the privacy notice on the foundation's public Web site to include: The choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII) and the consequences of exercising or not exercising those choices. The ability to access and have PII amended or corrected if necessary. PII the organization collects and the purpose(s) for which it collects that information; How the organization uses PII internally. Whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing. Whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent. How individuals may obtain access to PII and how the PII will be protected.

USAID's Bureau for Policy, Planning, and Learning instruct operating units in writing to follow the standardized template for mission orders on evaluation, use the specified forms for revising evaluation data between their initial and final submissions to the performance plan and report, and institute a review process at the operating unit to verify that annual submissions to the report are complete and accurate.

USAID's Bureau for Policy, Planning, and Learning determine whether the 3 percent provision is realistic for all operating units, and, if not, amend the evaluation policy and Automated Directives System to provide greater flexibility.

USAID's Bureau for Policy, Planning, and Learning provide written guidance to operating units about maintaining documentation on calculations and amounts spent on evaluations and deviations from the evaluation policy and Automated Directives System.

USAID's Bureau for Policy, Planning, and Learning determine the intent of the "large project" requirement, and if applicable, make changes in the evaluation policy and Automated Directives System.

USAID's Bureau for Policy, Planning, and Learning provide written guidance to missions on creating and maintaining records of their analysis and calculation of large projects.

USAID's Bureau for Policy, Planning, and Learning implement an online tutorial on the main differences between impact and performance evaluations, and make it available to all Agency employees.

USAID's Bureau for Policy, Planning, and Learning add a requirement to the evaluation policy and Automated Directives System that missions document the impact evaluations they plan for each development objective or an explanation of why one is not feasible.

USAID's Bureau for Policy, Planning, and Learning reiterate in writing that all external evaluations should include a statement of work as an annex.

USAID's Bureau for Policy, Planning, and Learning amend its evaluation policy and Automated Directives System to require that evaluation points of contact for each operating unit submit the start and release dates for the evaluation online to USAID's Development Experience Clearinghouse Web site within 30 days after the start of an evaluation.

USAID's Bureau for Policy, Planning, and Learning amend its evaluation policy and Automated Directives System to delete the requirement to submit draft evaluation reports to USAID's Development Experience Clearinghouse.

USAID/Burma prepare a written assessment of the sustainability and sufficiency of water, sanitation, and hygiene activities implemented in the first 2 years, and take corrective actions as necessary to increase access to safe water.

USAID/Burma issue written work-around procedures to mitigate risks from state.gov e-mail rejections.

USAID/Burma implement a plan to increase the number of sites visited and the frequency of visits for the Shae Thot Program.

USAID/Southern Africa develop indicators to
measure the effectiveness of its local solutions activities.

USAID/Southern Africa document its local solutions strategy and distribute it to staff and local partners.

USAID/Bangladesh require Pathfinder International to develop and implement a comprehensive sustainability plan, which includes other methods to raise program income beyond the 40 percent cost-recovery rate.

USAID/Bangladesh develop and implement procedures to ensure that nongovernment organizations' requests to use program income to expand clinic services are submitted, reviewed, and approved in a timely manner.

USAID/Bangladesh require Pathfinder International to determine how many other clinics have not paid their staff salaries on time, implement a plan to verify that nongovernmental organizations' program income funds are readily available to pay project expenses, and establish procedures to have nongovernmental organizations pay salaries on time.

USAID/Bangladesh establish a procedure for timely reviews and approvals of annual project budgets.

USAID/Bangladesh require Pathfinder International to work with the nongovernmental organization grantees to review the training model and implement a plan to address training needs of clinic employees.

USAID/Bangladesh require Pathfinder International to review the management information system and data processing procedures it developed for the project to verify that the system addresses user needs.

USAID/Bangladesh require Pathfinder International to set a deadline to complete the translation of the revised Surjer Hashi Management Guideline to Bangla and provide copies to all clinics.

USAID/Bangladesh require Pathfinder International to check whether clinics are using the revised Surjer Hashi Management Guideline and to incorporate this task into its monitoring process.

USAID/Bangladesh require Pathfinder International to provide training to clinics on the updated sections of Surjer Hashi Management Guideline and emphasize the importance of using the guideline.

USAID/Eastern and Southern Caribbean update its staffing plan to provide enough agreement and contract officer's representatives to oversee all projects in the region.

USAID/Eastern and Southern Caribbean instruct implementing partners to establish targets for all of the projects' performance indicators and periodically report progress on them.

USAID/Eastern and Southern Caribbean complete all data quality assessments for four projects: Reforms to the OECS Juvenile Justice System; Youth Development and Juvenile Justice in Suriname; Strengthening Second Chance Education in the Eastern Caribbean, and Skills and Knowledge for Youth Employment in Guyana.

USAID/Eastern and Southern Caribbean instruct implementing partners in writing to disaggregate data according to the requirements in their agreements.

USAID/Eastern and Southern Caribbean instruct all implementing partners in writing to comply with USAID's branding and marking requirements.

USAID/Eastern and Southern Caribbean update its regional development cooperation strategy to include Caribbean Basin Security Initiative indicators and activities; performance indicators to track reductions in crime and violence, school dropout rates, and unemployment; all planned activities; and activities being implemented in Guyana.

USAID/Eastern and Southern Caribbean update its mission-wide performance management plan to include key indicators, baseline data, and targets in the updated regional development cooperation strategy.

USAID/Eastern and Southern Caribbean complete project monitoring and evaluation plans that include project indicators and targets to measure progress on and align with the strategy and the mission-wide performance management plan.

USAID/Eastern and Southern Caribbean require the Organization of Eastern Caribbean States to submit a monitoring and evaluation plan for Reforms to the OECS Juvenile Justice System.

USAID/Eastern and Southern Caribbean reevaluate its project in Suriname; implement a plan to phase it out, if deemed appropriate; and invest the remaining funding in countries where it would have greater impact.

USAID/Eastern and Southern Caribbean incorporate counter-trafficking-in-persons requirements in the mission's regional development cooperation strategy.

USAID/Eastern Southern Caribbean provide counter-trafficking-in-persons training to its staff and disseminate the USAID field guide to all implementing partners.

USAID/Eastern and Southern Caribbean determine the total hours of participant training conducted for each of the projects and enter the data into the Training Results and Information Network in accordance with Automated Directives System 253.3.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, issue guidance for the Millennium Challenge Corporation and Millennium Challenge Account entities on market outreach, including planning and documentary requirements.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, issue guidance on the process, roles, and responsibilities of all Millennium Challenge Corporation and Millennium Challenge Account officials involved in developing Millennium Challenge Account terms of reference.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, implement measures to enforce the use of the Contractor Past Performance Reporting System by Millennium Challenge Accounts.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, issue formal quality assurance guidance for due diligence during compact development.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, direct the Millennium Challenge Account-Moldova to document and implement a plan for improving the viability of the water user associations.

We recommend that the Millennium Challenge Corporation's Vice President, Department of Compact Operations, issue guidance on the appropriate use and approval of administrative funds by resident country officials.