Develop and implement procedures to ensure that planning for the CPD grant accrual validation is done early in the accounting cycle to allow for: • Sufficient resources to be available to perform the validation of the prior year grant accrual. • Validation efforts to start earlier to allow for follow-up on non-responsive grantees or grantees that provided incomplete information. • Materiality risk to be considered when planning and evaluating the CPD grant accrual validation.

Revise CPD Validation Review Instructions to specify documentation requirements similar to those provided to the grantee and specify verification of dates for when the costs were incurred.

As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.

Establish a formal policy addressing HUD’s federal awarding agency responsibilities under 2 CFR § 200.513(c). The policy should identify those involved in the process and their roles in addressing this single audit oversight function. The policy should also address how it will be carried out and documented.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

HUD has made steady progress in building its Fraud Risk Management program. In FY 2024, HUD received Congressional approval to establish the Office of the Chief Risk Officer (OCRO). With its Fraud Risk Management Policy in place since 2022, OCRO worked with the HUD Risk Management Council to develop the Department’s approach and establish a cross-functional approach for Fraud Risk Management program accountability. The CRO also completed a fraud risk exposure assessment method that enables the Department to provide a risk-based approach to prioritize program fraud risk assessments and a department-level Fraud Risk Management Playbook to align HUD’s cross-functional activities and accountability to the GAO Fraud Risk Framework and CFO Council practices. The CRO is also working on tools and templates that are being customized for HUD program offices to help them complete their fraud risk assessments. Priority program offices are targeted to complete fraud risk assessments in 2025.

Analysis

While HUD has made progress in the area of fraud risk management, there is still work to be done for HUD to complete an entity-wide fraud risk assessment. HUD's exposure analysis will help it to determine where to focus its efforts. The Department still needs to conduct program-specific fraud risk assessments. Based on the demonstration by Multifamily Housing (MFH), we believe that MFH has made great progress in its fraud risk assessment, and we are encouraged that it has identified areas of weakness that it plans to target. However, Public and Indian Housing (PIH) and Community Planning and Development (CPD) have not been able to demonstrate progress in this area. We believe that the tools and templates the OCRO is developing, along with the continued support, will help PIH and CPD to complete these assessments.

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy, and that each HUD program office has established office-specific risk programs.

Develop and implement a procedure to collect and analyze reported suspected instances of fraud, along with other relevant data points, that can be leveraged to develop more robust antifraud risk mitigation tools.

Communicate to HUD program staff the differences between HUD’s enterprise risk management, PIIA, and financial risk management risk assessment processes to ensure an understanding of their roles and responsibilities within HUD’s fraud risk management program.

Develop and implement activities to raise awareness of fraud, such as participating in organized antifraud conferences or a newsletter that includes instances of recent fraud in Federal programs.

Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.

Collaborate with the Chief Risk Officer to conduct a workforce assessment to determine the level of dedicated full-time staff resources needed by the Chief Risk Officer to effectively (1) administer HUD’s enterprise and fraud risk management programs and (2) support program risk officers by increasing employee and stakeholder awareness of potential fraud schemes that could impact each program respectively.

If the workforce assessment determines that additional staff are needed, work with the Chief Risk Officer to staff the necessary positions.

We recommend that the Deputy Chief Financial Officer…In collaboration with all involved program offices, develop and implement a sampling methodology that allows for a sample size that reasonably allows for the testing of the complete payment cycle within the PIIA reporting timeframe.

Consult with OMB on the appropriate reporting for the untested portions of the payment cycle (such as reporting as unknown) and report accordingly.

Implement a procedure, which ensures that future improper and unknown payment testing that does not test the full payment cycle is reported in accordance with OMB’s guidance.

Coordinate with OMB to ensure that all of HUD’s data posted on OMB’s PaymentAccuracy.gov are accurate, including data before fiscal year 2021.

Update its procedures to include verifying all HUD data on PaymentAccuracy.gov immediately after the data are published on the public website to ensure that all data are accurate and if not, coordinate any corrections with OMB.

Develop and implement controls for use of the bulk grant closeout process going forward to ensure that grants are closed in accordance with all applicable requirements, including that administrative actions and required work under the grant award have been completed by the grantee before the grant is closed out. These controls should include but not be limited to increased collaboration and communication between headquarters and field offices.

Develop and implement controls to ensure that future grant data reporting to stakeholders is consistent and accurate, including defining how records should be counted and data should be presented and ensuring that accurate POP dates are maintained in HUD’s systems.

As part of the validation process for CPD’s accrued liabilities, improve its validation process to ensure that it is based on verifiable grantees responses and supporting documentation.

We are recommending OCFO reopen the following recommendation reported in audit report 2021-FO-0003-0001-D: 1B. As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.