Open Recommendations

Establish controls to monitor COR reviews of contractor invoices and supporting documents.

In coordination with the Procurement Department, train CORs to properly review supporting documents before they approve or reject contractor invoices.

Implement procedures to formally retain review documentation that evidences how the review steps were performed and how conclusions (especially judgmental decisions) were drawn. Examples would be tickmarks, text boxes, comments, recalculations, reconciliations, supporting files researched, etc.

Develop more detailed checklists that outline how steps are completed and not just what needs to be completed.

We recommend PBGC management continuously monitor users’ Active Directory settings to make sure the system can recognize all users and entitlements that need to be recertified in a timely manner.

Enhance existing monitoring controls to mitigate risks associated with required role assignments that violate separation of duty requirements.

Create or update guidance to implement policies and procedures to guide and govern supply chain risk management activities related to attestations.

Update and maintain a complete Critical Software Inventory that staff may utilize to fulfill their responsibilities and provide transparency and tracking.

Revise its ASOC review procedures to require an annual reconciliation of SFA funds and to require the review analyst to conduct an analysis of material changes or outliers in the key elements to ensure full compliance with SFA conditions.

Implement a formal process that identifies roles and responsibilities, including information sharing, and cooperation with DOL and Treasury to improve SFA oversight and compliance over the Reinstatement of Benefits.