Open Recommendations

FHFA's DBR Deputy Director should ensure that ORAM evaluates its current internal model risk management practices in line with FHFA’s model risk management supervisory expectations (defined in AB 2013-07 and AB 2022-03) and design controls to (1) periodically review and maintain its model risk inventory (to include a risk-based validation schedule), (2) engage external resources to perform independent model validations in accordance with the validation schedule, and (3) conduct model performance tracking. Further, ORAM should update and finalize its policies and procedures to reflect the internal model risk management practices adopted.

FHFA's DBR Deputy Director should ensure that ORAM evaluates its current practices for maintaining documentation of the review and approval of inputs and outputs and implements policies and procedures to communicate requirements for maintaining this documentation.

FHFA's DBR Deputy Director should ensure that ORAM evaluates its current tracking mechanism for FHLBank requests for approval of market risk model changes and implement policies and procedures to ensure that the date that a complete model change approval request is received is tracked.

EXIM’s Office of the Chairman, in coordination with the Office of Policy Analysis and International Relations, the Office of Board Authorized Finance, and Office of General Counsel, should propose updated Environmental and Social Due Diligence Procedures and Guidelines for Board review and approval that incorporates, as necessary, revisions of applicable international standards.

EXIM’s Office of the Chairman, in coordination with the Office of Policy Analysis and International Relations, the Office of Board Authorized Finance, and the Office of General Counsel, should produce updated Environmental and Social Due Diligence Procedures and Guidelines for Board review and approval that clarify whether and, if so, how the ESPG relates to domestic transactions.

The Office of General Counsel should produce a written opinion on the circumstances under which Board members may withhold or approve transaction based upon environmental effects.

EXIM’s Office of Board Authorized Finance should establish policies and procedures establishing clear milestones for required environmental and social due diligence documentation.

EXIM’s Office of Board Authorized Finance should develop a plan to ensure the Engineering & Environment Division is properly resourced to conduct the required technical reviews and environmental assessments.

EXIM’s Office of Board Authorized Finance should develop a written policy or procedure that outlines the process for addressing when a project’s implementation does not align with EXIM’s Environmental and Social Due Diligence Procedures and Guidelines after the Board has approved the transaction.

EXIM’s Office of Board Authorized Finance should develop a written policy or procedure that defines when an environmental and/or social due diligence review is necessary for any restructuring or modifications requiring Board re-approval.

Develop and implement a contingency plan to address potential future staffing challenges that may arise, to mitigate delays in implementing necessary improvements across the applicable FISMA domains.

Establish and execute a monitoring plan to make sure that all information technology policies and procedures, including referenced standards and guidance, are reviewed and updated in accordance with the timeliness requirements defined by EAC policy.

Implement a continuous monitoring governance, risk, and compliance tool that enables the integration of cybersecurity risk management into the enterprise risk management reporting tool. Capture lessons learned to make any necessary adjustments to the process.

Implement a process to detect and prevent the use of untrusted removable media on the EAC’s network.

Fully document and implement a process that includes a clear business reason for risk acceptance in the event that untrusted removable media must be introduced on the EAC’s network.

Develop compensating controls to reduce the risk that vulnerabilities can be exploited that are caused by the use of untrusted removable media on the EAC’s network.

Schedule and complete annual contingency planning tests. Retain supporting documentation to demonstrate compliance during audits.

Develop a plan to ensure manual journal vouchers are justified, documented, and approved before they are entered into the Financial Management System and that they are reviewed after posting to verify accuracy and support compliance, transparency, and audit readiness.

Require ongoing training for all staff who prepare, review, or approve manual journal vouchers, including a process to ensure that new employees complete initial training and that refresher courses are provided when policies or tools are updated.

Clarify expectations for using macro-enabled journal voucher tools by defining when the standardized macro must be used; establishing a process to communicate macro tool updates and prompt the adoption of newly released versions; and providing guidance, training, and user support to promote correct and consistent application of the tools.

Define and communicate clear oversight responsibilities for Veterans Integrated Service Network financial managers by requiring routine monitoring of documentation and compliance at facilities.

Ensure privileged user access reviews for the [redacted] system are performed in accordance with FDIC policy.

Define the accounts, permissions, and roles that are considered privileged within [redacted].

Ensure privileged user access reviews for [redacted] are performed in accordance with FDIC policy.

Ensure a complete and accurate user listing is utilized for the [redacted] user access review as required by FDIC policy.