Open Recommendations

KPMG recommends that the Office of the Chief Information Officer should continue to update and implement entity-wide policies and procedures and provide more direction and oversight to Program Offices for completing and appropriately overseeing certification and accreditation requirements and activities. In addition, documentation on application access permissions should be enhanced and linked with functional duties and procedures for granting logical and physical access needs to be refined to ensure access is granted only to authorized individuals. Finally, policies and procedures should be developed and implemented to ensure POA&Ms are accurate & complete.

We recommend that the Chief Operating Officer for Federal Student Aid instruct SLMA to adjust its special allowance billings for loans associated with Bond 93F that became ineligible for the 9.5 percent floor calculation, as described in the finding, and return alloverpayments to the Department (for which we estimate to be about $12.3 million).

We recommend that the Chief Operating Officer for Federal Student Aid instruct SLMA to identify the loans associated with Bonds 93B, 93G, and 93H that became ineligible for the 9.5 percent floor calculation, as described in the finding, and adjust its specialallowance billings for the affected loans in the quarters ended June 30, 2002, through June 30, 2005, and return all overpayments to the Department (for which we estimate to be about $10 million).

We recommend that the Chief Operating Officer for Federal Student Aid instruct SLMA to disclose any other instances, at any of its subsidiaries (e.g., NLMA, Southwest Student Services Corporation, Student Loan Funding Resources, Student Loan FinanceAssociation), of loans billed under the 9.5 percent floor calculation after the eligible taxexempt bond issue matured and after the loans were refinanced with funds derived from an ineligible funding source and, if necessary, adjust its special allowance billings for all affected loans and return all overpayments to the Department.

The OCIO should continue to update and implement entity-wide security policies and procedures and provide more direction and oversight to Program Offices for completing certification and accreditation requirements. In addition, documentation on application access permissions should be enhanced and linked with functional duties and procedures for granting logical access need to be refined to ensure access is granted only to authorized individuals.

The Bureau of Information Services should develop a comprehensive plan for the testing and evaluation of the agency’s contractor operations.

Recommendation not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

If an adverse determination is made for Recommendation 1, collect program payments subject to limitation for each year for which a scheme or device was adopted and for the subsequent year. (The producers’ payments subject to limitation totaled over $1.4 million for the 2000 through 2002 crop years. See exhibit E.)

The Bureau of Information Services should perform a physical inventory of information technology hardware and update the agency’s official fixed asset inventory system.

1.1 Require UIC to return to the Department the $1,018,212 in federal funds it received for the first three years of the grant

Take appropriate action pursuant to 34 C.F.R. § 74.62 to protect future GEAR UP grant funds.

Require UIC to return to the Department the $1,018,212 in federal funds it received for the first three years of the grant, (see footnote 9)

Take appropriate action pursuant to 34 C.F.R. § 74.62 to protect future GEAR UP grant funds.

Develop and implement a process to include compensating controls to_x000D_mitigate risk when accepting the risk of known vulnerabilities.

Document and implement a process to verify that laptops are encrypted and remediate instances of nonencrypted laptops.

Document and implement a strategy, policy, and procedures to manage supply chain risks with suppliers, contractors, and systems.

Develop and implement standard operating procedures to identify and calculate reliable drug control-related obligations.

Develop and implement a methodology that can be applied to data in NHTSA’s financial system to track drug control-related obligations, by budget decision unit and drug control function.

Develop a budget formulation methodology that provides a reasonable basis for consistent estimation of NHTSA’s drug control budget that fairly quantifies its financial commitment to drug control activities and provides the methodology to the Office of National Drug Control Policy for approval.