Open Recommendations

Evaluate and update Agile quality assurance checklists to include product backlog health, risk/issue traceability, and data integrity in the Agile project management software. Checklists should focus on quality assurance indicators for all areas, including user stories, that are more outcome-based and drive continuous improvement.

Update its guidance for Scrum sprint planning to indicate that all tasks in the Agile project management software should be assigned to one, and only one, owner, except in the case of pair or group work.

Update the quality assurance checklist for sprint planning to review low-level tasks for multiple owners if they occur frequently. This does not apply to other product backlog item types, such as user stories.

The IRS Human Capital Officer should design a corrective action plan focused on improving training, communication, and coordination between the BOD/function hiring representatives and the HR specialists throughout the hiring process to further assist with reducing delays in the application process.

The IRS Human Capital Officer should develop comprehensive, up-to-date reference materials that the HR specialists and the BOD/function hiring representatives can use as they process hiring actions.

The IRS Human Capital Officer should coordinate with the Chief, Facilities Management and Security Services, to update hiring process workflow instructions to include alerting applicants to upcoming deadlines in the fingerprinting process. These instructions should also ensure that applicants are informed to complete the fingerprinting process within a certain time frame that will allow the Personnel Security function sufficient time to complete the remaining initial security checks steps. If the applicant is unable to complete the fingerprinting process within the given time frame, then a reason should be provided and should be added to the prospective employee’s file.

The IRS Human Capital Officer should request from the OPM additional automation enhancements to USA Staffing to improve its information accuracy and reduce data input errors.

Develop and execute a plan with time frames to implement hiring practices Boardwide, such as anonymizing résumés, mandating the existing “Effectively Hiring Top Talent Without Bias” training for hiring managers, or adopting other, similar measures to reduce the risk of bias in the hiring process. If resource, budgetary, or cultural challenges persist, develop and execute a plan to address those challenges and implement hiring practices to reduce the risk of bias in the hiring process.

Coordinate to develop comprehensive Boardwide guidance that has baseline expectations and that covers the entire hiring process, including the hiring panel selection process, candidate selection process, and strategies for hiring without bias.

Develop and implement a policy requiring that strategy sessions be conducted and documented for nonofficer job postings unless a hiring manager participated in a recent session for a similar posting. For similar postings, determine the appropriate amount of time after which another strategy session should be held.

Update the strategy session template to ensure that leading practices for hiring a diverse workforce are discussed during strategy sessions, including using diverse hiring panels, balancing internal and external job postings, using neutral and unbiased language in job postings, and using a standard interview process.

Document procedure steps with clear roles and responsibilities for the applicant data collection process so that it can be repeated.

Automate internal controls to remove duplicate records within the applicant data collection process.

Develop a review process for the final applicant flow data extract report to ensure the data are valid, complete, and accurate prior to reporting.

We recommend the Natural Resources Conservation Service, in coordination with the EnterpriseGeospatial Management Office, develop and use an applicable geospatial data standard for the National Cooperative Soil Survey Soil Characterization database dataset.

Update policy for certain non-payment status codes (N05, N06, N18, N36, N39, and S06) we reviewed to: (1) clearly and consistently require employees to exhaust efforts to locate and contact recipients and obtain needed information before applying the suspension or denial and (2) provide examples in each updated policy that are relevant to the specific suspension or denial code to illustrate all aspects of proper development, including timeframes for initial and follow-up requests and determinations regarding sufficient information for eligibility, capability, change of payees, undeliverable mail, extension requests, and procedures to exhaust efforts.

Develop policy and procedures for the Offices of Retirement and Disability Policy and Chief Information Officer to coordinate systems changes to prevent the use of obsolete or temporarily prohibited non-payment status codes. If unable to make systems change, SSA should identify and review records placed into suspension or denied using prohibited non-payment status codes to ensure they are corrected timely.

Complete the implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5.

Update policies and procedures to require that system owners define the privacy requirements for the system and the environment of operation, including where those requirements should be documented.

Remind Agency personnel of National Archives and Records Administration regulations.

Identify and assign the senior accountable official for risk management.

Include the organizational risk tolerance and make explicit the threats, assumptions, constraints, and trade offs used for making investment and operational decisions in the Risk Management Strategy.

Document and implement procedures for conducting and updating an organization and system-level risk assessment.

Update the information security continuous monitoring strategy to include the monitoring requirements at the mission/business process and information system levels; the minimum monitoring frequency for implemented controls across the organization; and how ongoing assessments are to be conducted.

Update policies and procedures to require that the senior accountable official for risk management, or other designated official, review and approve the continuous monitoring strategy and retain evidence of the review and approval.