Open Recommendations

USAID's Office of Food for Peace assess and document its determination of the reasonableness of implementers' modified payment schedules.

USAID's Office of Food for Peace implement procedures to verify that implementers document the selection criteria each beneficiary meets to qualify for the program benefits.

USAID's Office of Food for Peace evaluate a total of $33,825 in funds ($5,145 of misallocated costs related to annual rent, $1,811 in misallocated costs related to the finance coordinator's salary, and $26,869 in budget overruns costs related to consultant payments), and determine any amounts that should be reprogrammed for better use.

Review the 187 loans that matched to a related COVID-19 EIDL or PPP loan with a fraud hold code for legitimacy and eligibility. If any of the 187 loans are found to be illegitimate, ineligible, or fraudulent, take appropriate action to 1) prevent disbursement of funds, 2) recover the funds, and 3) refer potentially fraudulent loans to OIG.

Clarify the Manual to ensure that supervisory activities that do not meet the minimum requirements for a full-scope examination, including visitations and limited-scope examinations, provide adequate documentation in support of conclusions and retain this documentation in the FDIC system of record.

Revise examiner guidance to ensure supervisory personnel consider significant delays in required financial filings and any associated perspectives of external auditors when assessing UFIRS ratings.

Revise the FDIC’s Internal Formal and Informal Actions Procedures to include specific process and documentation requirements related to circumstances in which an approved formal enforcement action is replaced with a less severe action.

Develop detailed guidance that clarifies what information should be considered when assessing whether it is appropriate to approve a brokered deposit waiver for “Adequately Capitalized” IDIs.

Develop a supply chain risk management strategy that includes (a) a supply chain risk appetite and tolerance, (b) an enterprise supply chain risk management governance structure, and (c) supply chain risk assessment processes that include migration strategies or controls.

Document and implement a baseline review and escalation process for data loss prevention alerts.

Reinforce the requirements for identifying and documenting system interconnections as part of the Board’s training on its cyber risk management application and require all relevant individuals to take the training.

Evaluate and implement options to enforce the agency’s existing guidance related to identifying and documenting system interconnections.

Develop and implement a mobile application scanning program that includes a vulnerability scanning solution and process to identify and remediate vulnerabilities.

Ensure that the Board’s Incident Notification and Breach Response Plan is reviewed, tested and approved annually.

Develop and implement a role-based privacy training program.

Incorporate targeted phishing exercises into the Board’s security awareness and training program and processes.

Update the Board’s standard contract language in cloud service provider contracts to ensure that it is consistent with Federal Risk and Authorization Management Program’s Incident Communications Procedures incident reporting requirements.

Complete finalization of an agencywide data classification policy that accounts for the sensitivity of the data maintained by the CFPB.

Ensure that data classification and sensitivity labels are incorporated into the CFPB’s data loss prevention program.

Strengthen flaw remediation processes by developing and implementing a process to clearly map identified vulnerabilities to system IP addresses, host names, and remediation owners within the CFPB’s configuration management database.

Ensure that adequate resources are allocated to reinvestigate CFPB systems users as required.

Develop and maintain a ransomware strategy and specific procedures that provide a formal, focused, and coordinated approach to responding to ransomware attacks.

Ensure that testing of mission-essential functions identified in the CFPB’s continuity of operations plan is periodically performed.

Renew the authorizations to use for the CFPB’s governance, risk, and compliance tool.

Implement a process that ensures the cyber risk information in the CFPB’s governance, risk, and compliance tool is accurate and maintained.