Open Recommendations

Report the OIG’s finding of non-compliance with the FY 2021 PIIA requirements, as outlined in OMB Memorandum M-21-19, Section VI.D, “Agency Responsibility When a Program is Non-Compliant”

Annually conduct an improper payment review in accordance with PIIA and
follow the guidance outlined in OMB Circular A-136, section II.4.5 [Payment Integrity Information Act Reporting]
 

Complete the OMB Annual Data Call reporting, and if necessary, contact OMB via email at
MBX.OMB.OFFM.PaymentIntegrity@omb.eop.gov to obtain access to the annual data call.
 

For purchase cards, EEOC management should create a control where management reviews, on a sample basis, the purchase card account closure documentation to ensure it adheres to the EEOC Purchase Card Audit Finding Update Memo.

We recommend EEOC ensure that emailed policy memos are promptly updated in the appropriate EEOC Directives Transmittal Order

For purchase cards, EEOC management should create a control where management reviews, on a sample basis, purchase cards transactions to ensure all obligating documents and purchase orders are in conformity with EEOC Directives Transmittal Order 360.003, Commercial Purchase Charge Card Program Practical User’s Guide. For travel cards, EEOC management should create a control where management reviews, on a sample basis, travel card transactions to ensure all travel authorization or vouchers and receipts are in conformity with EEOC Directives Transmittal Order 345.001, Travel and Transportation Administrative Policies and Procedures Manual.

We recommend EEOC management update its policies and procedures to include all required safeguards and internal controls to be compliant with the Government Charge Card Abuse Prevention Act of 2012. In addition, EEOC should create a monitoring control to review the policy when changes or updates are made to federal law or Office of Management and Budget or General Services Administration guidance. (Repeat Finding)

Implement an ongoing training series for all staff involved in the EEOC social media program.

Hire people with specialized expertise to manage the social media program and its assets, specifically a dedicated social media manager and part-time (or contract) graphic designer and multimedia specialist.

Use paid media to support improved reach and engagement.

Complete revisions to the social media handbook and provide to all staff managing social media channels.

Hire people with specialized expertise to manage the social media program and its assets, specifically a dedicated social media manager and part-time (or contract) graphic designer and multimedia specialist

Simplify the EEOC social media architecture by consolidating many of the existing social media channels and limiting creation of new channels.

. Begin quarterly reporting on social media outcomes, using an online dashboard to ease data collection

We recommend EEOC OIT provide specialized training for SharePoint administrators
and users to reduce the risk of exposing sensitive information and PII.

We recommend EEOC OIT review and remediate critical-risk, high-risk, and medium risk
vulnerabilities in accordance with EEOC OIT's assessment of risk. If the risk is not
remediated then we recommend EEOC OIT document the acceptance of the risk.

We recommend EEOC OIT conduct a privacy impact assessment of the SharePoint
system to identify privacy issues and risks associated with the security settings; and to
provide recommendations to mitigate potential privacy risk.

EEOC should ensure the existing policy in place is followed and documentation of the
process is reviewed by the CFO or their designee on a quarterly basis.

ASD should review and update the COR Appointment Letter as needed and specifically
address the maintenance of electronic contract files.

OCFO should revise EEOC Order 360.001 as needed to assist CORs in performing their
duties. Include implementation guidance for contract administration activities, such as
submitting contract modifications.

OCFO should review and update the Contract File Content Checklist to reflect current
documents maintained in the file.

We recommend the OIT review and remediate critical-risk, high-risk and moderate-risk vulnerabilities. These vulnerabilities should be resolved to avoid compromise to EEOC’s systems; or the Agency should document acceptance of the risk or reclassification of the risk

Ensure future process changes are implemented according to change management best
practices noted by GAO.

OFO and OFP, in partnership with OIT, should consider development of an IMS
training guide or document that is consistently updated and reviewed following
upgrades, enhancements or modifications of the software. This guide should include all
necessary codes for every action item in the process and should be available for all
product users. This guide should ensure that product users track all mandated steps in
IMS. Given that each office’s staff has their own needs within IMS: One guide should
be made for OFP legal techs, AJs, and SAJs. A separate guide should be available for
OFO CCD staff, attorneys and supervisory attorneys.

Evaluate and assess timeline improvement after the use of the new contractors. If
significant improvements are verified by data, consider improvements to the ongoing
staffing model and the possible addition of these contractor positions as permanent
roles. OFO should determine and monitor metrics, such as improvement of targeted
timelines from one step to another (data can be gathered from IMS).

The Office of Information Technology (OIT), in partnership with OFP and OFO, should
re-evaluate IMS requirements, and requirements for the framework of its successor
system, to determine what additional reporting functionalities are needed in order to
analyze data about staff and office productivity. A Voice of the Customer exercise or a
user requirement meeting could serve as starting point to gather current requirements
OFFICE OF INSPECTOR GENERAL SEMIANNUAL REPORT 10
from IMS main users (OFP and OFO) and to determine what other current systems need
to be integrated to make them function in alignment with IMS (Power BI, Complainant
Portal).

Examine the staffing model of the appeals intake process to determine if the dedicated
resources are sufficient for ensuring processes are completed in a timely manner.

Standardize on-boarding activities and training programs required for new AJs and
other staff working at the District and Field offices, so that the Federal hearings
experience is consistent for both complainants and agencies across offices.

OIT developers should meet directly with software users, such as OFO attorneys and
supervisory attorneys and OFP AJs and Supervisory AJs (SAJ) to determine additional
requirements.

Assign a target amount of days for intake so that management can determine if changes
implemented impact the efficiency of the process.

EEOC should develop a Trusted Internet Connection (TIC) program that meets OMB requirements to improve the agency’s security posture.

EEOC should conduct an e-authentication risk assessment for its digital systems and has not fully implemented multifactor authentication for logical and remote access for privileged and non-privileged users. (Repeat finding since FY 2008)

EEOC OIT should review and analyze critical, high, and medium vulnerabilities. These vulnerabilities should be resolved to avoid compromise of EEOC’s systems; or the agency should document acceptance of the risk or reclassification of the risk.

Develop and implement policies and procedures to address the safeguarding, transfer, storage, or disposal of classified information. The policy should include the requirements for Memorandums of Understanding between agencies.

Implement a formalized training program for individuals who use classified information as a part of their duties. If an external agency is to assume the responsibility of training these individuals, this agreement should be documented in an MOU.

Immediately correct any known weaknesses. If EEOC determines not to correct a noted weakness, EEOC should document this analysis and their acceptance of the associated risk.