Recommendation Dashboard

Determine whether steps can be taken to mitigate risks associated with the ongoing contribution to Gavi for COVID-19 vaccination efforts.

Determine whether future contributions to Gavi for COVID-19 vaccines should include additional oversight clauses to mitigate the higher risk for fraud, waste, and abuse.

We recommend that USAID Office of Acquisition and Assistance, Cost, Audit and Support Division verify that Prague Civil Society Centre, nada?ní fond corrects the four instances of material noncompliance detailed on pages 21 to 26 of the audit report.

We recommend that USAID/Zimbabwe determine the allowability of $27,154 in ineligible questioned costs on pages 9 and 11 of the audit report and recover any amount that is unallowable.

We recommend that USAID/Zimbabwe verify that The Union Zimbabwe Trust corrects the seven instances of material noncompliance detailed on page 14 of the audit report and pages 7 to 16 of the management letter.

We recommend that USAID/Tanzania verify that Deloitte Consulting Limited corrects the five material weaknesses in internal control detailed on pages 33 to 36, and 40 to 45 of the audit report.

We recommend that USAID/Tanzania verify that Deloitte Consulting Limited corrects the two instances of material noncompliance detailed on pages 48, 49, and 52 of the audit report.

Develop and implement written procedures to:
- Periodically test the effectiveness of the rules for its data loss prevention tool and revise those rules when needed.
- Configure the Agency's data loss prevention tool to prevent the loss of other types of personally identifiable information (such as home addresses and dates of birth), in addition to Social Security numbers.
- Manage data loss prevention activities, including when staff should be notified of their violations.

Revise "Information Technology (IT) Security Training-Policy, Standards, Guidelines, and Plan" to document and implement a process for:
- Providing role-based privacy training to staff that are responsible for processing personally identifiable information.
- Providing role-based privacy training to staff at least annually.
- Training staff on how to identify new privacy risks and retention schedules for personally identifiable information as required in the role-based privacy training materials.

Update and implement the Agency's Social Security number reduction plan.

Update and implement the Agency's "System of Records Notices Standard Operating Procedure" to:
- Align with current requirements for reviewing and updating Agency system of record notices.
- Document decisions that system changes were not significant and, thus, related system of record notices do not need to be updated.
In addition, update the following system of record notices with the missing or incomplete elements identified in Appendix B of this document, as required by Office of Management and Budget Circular A-108:
- Personnel Security and Suitability investigations records;
- Google Apps;
- Personal Services Contract records;
- Congressional relations, inquiries, and travel records; and
- Litigation records.

Develop and implement a plan to maintain a complete, accurate inventory of the Agency's third-party websites-including periodic reminders to staff that implementing partners should notify the Agency when creating or deactivating public-facing, third-party websites-and take action, where needed, to post privacy notices on websites that collect personally identifiable information.

Determine the allowability of $1,058,723 in questioned costs (ineligible) as detailed in Table 1 on page 2 of this memorandum, and recover any amount that is unallowable.

Determine the allowability of $139,491 in questioned costs (ineligible) discussed on page 3 of this memorandum and further detailed in Finding 4.3.3 on page 59 of the report and recover, as appropriate.

Implement a review process incorporating charge card spending analytics on a monthly basis to identify potential areas of abuse.

Revise the receipt requirements for expenses susceptible to potential abuse such as ground transportation and miscellaneous charges.

Improve its voucher review process to identify travel claims that may be excessive or wasteful.

We recommend that USAID/Kenya and East Africa determine the allowability of $33,162 in unsupported questioned costs on page 19 of the audit report and recover any amount that is unallowable.

Revise Automated Directives System chapter 320 to clarify requirements to:
a. Require that language documenting the results of key waiver considerations and consultations be included in waiver requests.
b. File approved waivers in the Agency Secure Image and Storage Tracking system marking waiver cabinet.

Develop and implement a plan to identify all active branding and marking waivers granted by bureaus and missions and upload them into the Agency Secure Image and Storage Tracking system marking waiver cabinet.

Revise standardized designation letter models to include the responsibility for agreement officer representatives to monitor marking requirements for assistance awards.

Determine the allowability of $7,994,935 ($3,716,640 ineligible and $4,278,295 unsupported) in questioned costs as detailed in Table 1 on page 2 of this memorandum and recover any amount that is unallowable.

Determine the allowability of $3,357,910 ($2,516,906 ineligible and $841,004 unsupported) in questioned costs as detailed in Table 2 on page 3 of this memorandum and recover any amount that is unallowable.