Update its policies and procedures for tracking expenditures related to slow-spending grantees, including steps for assisting the grantees to expedite spending (including the grantee’s steps or actions to address slow spending), identifying the reasons for the delays with the grant, and documenting the outcome of its efforts.

Corrective Action Taken

CPD updated guidance addressing grantee slow spending through technical assistance, including actions grant managers can take when grantee expenditures do not appear to be “on pace” to meet the expenditure deadlines, and demonstrated it is providing technical assistance to grantees during monitoring. CPD also issued an additional Standard Monitoring Findings and Corrective Actions Guide for its staff to promote a consistent framework for crafting monitoring findings and the corrective actions needed to resolve identified deficiencies and prevent future occurrences. This new resource provides general guidance and examples for presenting Finding components in monitoring reports for fourteen topics including, “Failure to Meet Timeliness of Expenditures Requirements.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

The Office of the Chief Procurement Officer had agreed to an estimated completion date of March 2024. In April, The Office of the Chief Procurement Officer provided a status update and agreed to provide updated standard operating procedures once completed. However, no updated date for completion was provided.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in a defined IT acquisition process workflow standard operation procedure to ensure coordination across program offices.

Establish and implement a plan for the unused and unfunded vouchers to mitigate or prevent additional vouchers from becoming unused and unfunded […]

Corrective Action Taken

HUD established and implemented a plan for the unused and unfunded vouchers, aiming to mitigate or prevent additional vouchers from becoming unused and unfunded. PIH's plan included the following, among other actions:

• Determining the scope of HUD's statutory and regulatory authority to offset and reallocate vouchers.
• Issuing Office of Public and Indian Housing Notice 2020-29, titled Guidance for Running an Optimized Housing Choice Voucher Program.
• Continuing the work of HUD's landlord taskforce, engaging in listening sessions with major PHA industry groups, and conducting outreach to increase landlord participation in the HCV Program.
• Developing research by HUD's Office of Policy Development and Research on the best methods for adjusting fair market rents and addressing specific challenges in local communities to increase utilization in the HCV Program.

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Corrective Action Taken

OCHCO developed and implemented client profiles for each HUD program office to address knowledge loss and the need for offices to explain or reexplain their mission and functions. The profiles will serve as a central repository to learn about the various programs and missions of HUD and will allow OCHCO staff, other key HUD pro

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Status

October 2023, the Office of Multifamily Housing Programs reported that HUD was transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The Office stated that it had requested IT Technology Fund funding for FY 2024 for system enhancements to coordinate tenant complaints throughout Multifamily Housing including Multifamily field staff and the Multifamily Clearinghouse Call Center.

Analysis

In June 2024, the Office reported that because the FY 2024 funding was not approved by Congress, it will use the FHA Resource Center and its system that will allow for tracking and monitoring of customer calls. In addition, the Office will request assistance from its Project Based Contract Administrators to use a standard, Multifamily-wide reporting format to standardize and aggregate tenant complaints.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

October 2023, the Office of Multifamily Housing Programs reported that HUD was transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The Office stated that it had requested IT Technology Fund funding for FY 2024 for system enhancements to coordinate tenant complaints throughout Multifamily Housing including Multifamily field staff and the Multifamily Clearinghouse Call Center.

Analysis

In June 2024, the Office reported that because the FY 2024 funding was not approved by Congress, it will use the FHA Resource Center and its system that will allow for tracking and monitoring of customer calls. In addition, the Office will request assistance from its Project Based Contract Administrators to use a standard, Multifamily-wide reporting format to standardize and aggregate tenant complaints.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

For the MF-RAP, PIH-TRA, and CPD-HIM programs, ensure that the program's improper payments rate estimates adequately test for and include improper payments of Federal funding that are made by State, local, and other organizations administering these programs and adequately disclose any limitations imposed or encountered when reporting on improper payments, to a degree that fairly informs users of the respective reported information.

Status

This recommendation was closed by HUD. However, OIG continues to object to that closure and identifies this as a priority recommendation. After HUD closed this recommendation, it informed OIG that it would not be able to produce estimates of improper payments in these programs for FY 2023 and projected to the Office of Management and Budget that it may not be able to do so until FY 2027, dependent on funding.

For several years, we have reported that HUD was unable to test for improper payments in these programs because the Office of the Chief Financial Officer (OCFO) was unsuccessful in working with the Offices of Public and Indian Housing, Multifamily Housing Programs, and the Chief Information Officer to securely collect program files needed to test payments. This year, OCFO reported that HUD was again unable to complete improper payment testing because it was delayed in implementing a secure platform designed to collect supporting data and documentation and also because of limited staffing resources with technical knowledge of the payment cycles. The lack of proper planning and coordination from leadership in HUD’s program and support offices has prevented HUD from addressing the root causes behind the failure to comply with improper payment laws.

Due to this, HUD OIG issued a management alert to the HUD Deputy Secretary entitled Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments, on January 23, 2024. In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.

Analysis

HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. HUD’s sampling methodology did not test the full payment cycle. Further, the associated sample testing and statistical estimation of improper payments could not be completed in time for the required annual reporting of improper payment estimates in the Agency Financial Report (AFR), normally issued in November. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the AFR.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

Develop and issue a departmentwide policy that notes that radon is a radioactive substance and outlines HUD's requirements to test for and mitigate excessive radon levels in accordance with 24 CFR 50.3(i)(1) and 58.5(i)(2)(i).

Corrective Action Taken

None Given.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

In April 2024, the Office of the Chief Information Officer reported that it was in the process of implementing a software management tool that would allow it to control which software is authorized to access the network. This is the first step to create rules for allowing only authorized software to be used through HUD's endpoint security software. Final implementation of this new tool is expected by Quarter 2 of FY 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has an automated whitelist and implement as per the NIST Special Publication 800-167 or accept the risk and document mitigating measures via a Risk Based Decision memorandum.

Implementation of this recommendation will result in HUD having the capability to ensure only authorized software is used on HUD’s network based on its software asset listing.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

In April 2024, the Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, had completed 9 of 15 systems within the first phase, and will be delayed in completing the final system until the last quarter of FY 2024.

Analysis

Implementation of this recommendation will result in an enterprise-wide identity and access management solution which addresses the requirements in Executive Order 14028, titled “Improving the Nation’s Cybersecurity”. Users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

In April 2024, the Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, had completed 9 of 15 systems within the first phase, and will be delayed in completing the final system until the last quarter of FY 2024.

Analysis

Implementation of this recommendation will result in an enterprise-wide identity and access management solution which addresses the requirements in Executive Order 14028, titled “Improving the Nation’s Cybersecurity”. Users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Develop and implement an action plan that includes sufficient policies, procedures, and controls that address households living in multifamily housing units having a sufficient supply of safe drinking water […]

Status

As of June 2024, the Office of Multifamily Housing has revised its procedures and related documents and is waiting for final approval.

Analysis

To fully address this recommendation, HUD’s Office of Multifamily Housing must provide evidence of an action plan that includes its procedures that address households living in multifamily housing units to ensure that they have a sufficient supply of safe drinking water. We have not been provided a copy of the final procedures developed; therefore we cannot assess whether they will be sufficient to address the recommendation.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing units have a sufficient supply of safe drinking water.

In April 2024, HUD OIG met with HUD OCIO to discuss progress and requirements for closure of this recommendation. In addition, OIG reviewed this recommendation as part of the annual FY 2024 FISMA evaluation in April 2024 and learned from HUD OCIO that that there would be a procedure update that would implement the ingestion and monitoring of all inbound and outbound traffic. The OIG requested to be provided with these procedures when finalized and evidence of implementation on May 1, 2024.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Ensure that its staff appropriately determines exemptions from the Lead Safe Housing Rule and documents support of the determinations.

Corrective Action Taken

In June 2023, HUD publicly issued Notice 2023-16, Implementation of National Standards for the Physical Inspection of Real Estate (NSPIRE) Administrative Procedures, providing guidance covering the process and operational requirements for HUD’s public housing programs that clarifies for its staff (1) actions that should be taken by the PHA and (2) documentation that must be provided to support that a housing unit is exempt from the Lead Safe Housing Rule. The guidance describes the process that a PHA or property owners and/or agents must take when a NSPIRE inspection identifies deteriorated paint in a property or housing unit. Specifically, the PHA or property owners and/or agents should first verify that the property or housing unit is considered “target housing,” and if so, determine whether it is exempt from the Lead Safe Housing Rule. If an exemption applies, documentation such as, a lease or other residency agreement that affirms that the property is designated exclusively for occupancy by the elderly or persons with disabilities must be provided to HUD. Other residency agreements could include a HUD-approved designated housing plan, property deed or charter, or occupancy restrictions approved by HUD or the PHA’s board of commissioners. The PHA or property owners and/or agency must also affirm whether children under the age of 6 years reside in the property.

Ensure that its staff determines whether a child under 6 years of age resides in an exempted development. If a child is determined to reside in an exempted development take appropriate actions in accordance with its internal policies

Corrective Action Taken

The Office of Field Operations (OFO) updated the Lead-Based Paint Response Tracker’s Standard Protocol and Roles and Responsibilities to identify the roles and responsibilities of HUD’s headquarters and field office level staff in ensuring PHAs’ compliance with the Lead Safe Housing Rule (LSHR). The protocol provides that the OFO field office staff work directly with PHAs to resolve issues of noncompliance with the LSHR and other Lead-based paint (LBP) guidance by responding to or escalating questions/issues to the headquarters team, directing PHAs to available training and resources on HUD.gov or HUD Exchange, and working with PHAs to obtain sufficient documentation to close an LBP case in the LBP tracker promptly. In regards to a child under 6 years of age residing in an exempted development, staff from the field offices must upload supporting documentation determining whether a pregnant lady or child six years old or younger lives in the development, collect missing information, if applicable, coordinate with OFO team to close cases in the LBP response tracker, indicate in the LBP response tracker if the PHA has provided the documents or if the property is exempt and upload supporting documents.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

As of October 2023, the Office of Single Family Housing reported it will need additional tax information from the Internal Revenue Service to complete the planned action, and that the Office of the Chief Financial Officer will assist the Office of Single Family Housing. As of June 2024, no new update has been reported.

The final action target date was May 23, 2024, but was updated in June 2024 to May 23, 2025.

Analysis

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

Implement a change to regulations at 24 CFR Part 203 to require curtailment of preforeclosure interest and other costs that are caused by lender servicing delays, resulting in $413,513,975 in funds to be put to better use. This should include updating or seeking statutory authority to update HUD’s regulations as necessary and coordinating with HUD’s Office of Finance and Budget, well before any changes go through departmental clearance, to ensure that planned curtailment requirements can be consistently enforced through the claims process.

Status

This audit recommendations cannot be closed out without the publication of the Federal Housing Administration (FHA): Maximum Claim Rule. The proposed changes have been on HUD’s regulatory agenda since Spring 2020 but, as of June 2024, the Office of Single Family Housing does not have an estimated publication date.

Analysis

To fully address this recommendation, HUD must publish the FHA Maximum Claim Rule.

Implementation of this rule should result in HUD putting $413 million to better use.

Develop a method for using the Do Not Pay portal during the underwriting process to identify delinquent child support and delinquent Federal debt to prevent future FHA loans to ineligible borrowers to put $1.9 billion to better use.

Status

The Office of Housing has approved prioritization of funding for Integration between Do Not Pay portal and CHUMS. Funding was allocated to the CHUMS IT contractor on January 26, 2024, to integrate Treasury’s Do Not Pay system with CHUMS, and the IT development project was kicked off the week of February 5, 2024.

As of June 2024, the Office of Single Family Housing reported that it is working with OCIO and Treasury on the business needs for the project, and estimated that the project would be complete by September 30, 2024.

Analysis

To fully address this recommendation, HUD must provide evidence that it has implemented applicant screening against the Do Not Pay portal to identify delinquent child support and delinquent Federal debt to prevent future FHA loans going to ineligible borrowers.

Implementation of this rule should result in HUD putting $1.9 billion to better use.

Enforce the requirement for all HUD web applications and services to be approved by the CIO and ensure OCIO reviews and approves all IT contracts and services agreements dealing with creation or support of web applications or services.

Corrective Action Taken

In January 2023, HUD's Office of the Chief Information Officer developed and released a Web Applications Directive to all HUD program offices. This directive described how web applications are defined, approved, inventoried, and maintained, including processes for tracking, and monitoring such applications.