Develop a secure platform for the collection and storage of PIIA data that contain PII and formally assign a staff with adequate training and skillsets to administer the data and application (including maintaining and managing access controls of a chosen application that will be used to store the PIIA data with PII).

Reevaluate the methodology and reassess the weight assigned to each risk factor to ensure that appropriate weight is given to risks associated with non-Federal administrators or consider doing one risk assessment for HUD’s internal payment cycle and another risk assessment for the non-Federal entities that administer HUD’s program funds.

Until program-specific fraud risk assessments are completed, revise the PIIA fraud risk questionnaire process to compensate for the lack of program-specific fraud risk assessments.

Reassess the Homeless Assistance Grants program as part of the fiscal year 2023 risk assessment.

We recommend that the Director for HUD’s Office of Disaster Recovery require grantees to support or repay to its program $2,551,375, from nonfederal funds, for the 9 vouchers that did not have adequate supporting documentation for expenditures.

We recommend that the Director for HUD’s Office of Disaster Recovery work with its grantee to resolve or correct program income balances for the three grants that had program income balances outstanding.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that program income balance discrepancies are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that untimely FFRs are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery establish a mechanism to train grantees and HUD staff on existing guidance regarding supporting documentation for expenditures, FFRs, and program income balances on a recurring basis. Additionally, provide guidance and establish recurring training for HUD staff to monitor grantees for program income and submission of the FFRs..

We recommend that the Director for HUD’s Office of Disaster Recovery implement quality control procedures to ensure that HUD staff completes the action plan and QPR checklists.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that grantees’ policies and procedures related to program income are adequate.

We recommend that the Director for HUD’s Office of Disaster Recovery provide training to grantees regarding the reporting, tracking, and expenditure of program income.

Require lenders to execute indemnification agreements covering a period of at least 5 years for each of the 20 loans for which the lenders did not comply with the temporary endorsement policy and related instructions, including loans for which the lenders did not execute an agreement when required or that were otherwise ineligible for insurance, and properly store the agreements and record the agreement data to put up to $1,811,238 to better use by avoiding potential losses.

Obtain guidance from the Office of General Counsel regarding the implications of allowing lenders to retroactively apply forbearance in cases in which the borrower requests forbearance after the lender submits the loan for endorsement to ensure that it consistently handles such cases.

Request and analyze data from lenders for the 3,024 loans at risk of noncompliance to identify loans that should have been subject to the temporary endorsement policy or were otherwise ineligible for insurance. The data requested should include but not be limited to the dates when the borrower requested forbearance, the loan became subject to forbearance, and the loan was submitted for endorsement.

For any of the 3,024 loans found to be subject to the temporary policy or otherwise ineligible for insurance, require the lenders to execute indemnification agreements covering a period of at least 5 years or reimburse HUD for any claims to put up to $26,840,071 to better use by protecting HUD against potential losses. For any indemnification agreements executed, HUD should properly store the agreements and record the agreement data.

Update data in HUD’s system for the three cases in which the lender incorrectly reported the loans as in COVID-19 forbearance at the time of endorsement to ensure that accurate data are maintained.

Consider implementing a policy to review any of the 292 loans not reviewed as part of this audit that result in a request for claim to ensure that the loans qualified for endorsement under the temporary endorsement policy so that HUD can avoid unnecessary payments for loans that should not have been endorsed.

Record indemnification agreement data in its system for the 34 loans for which the lender properly executed an indemnification agreement before endorsement and HUD had not recorded the agreement in its system to put up to $3,493,636 to better use by avoiding potential losses.

Review and correct indemnification agreement data in HUD’s computer systems as needed for all agreements currently classified as having 2-year terms and all agreements related to 2-year agreements contained on its SharePoint site to ensure that its systems contain accurate data for monitoring and enforcement of agreements. This recommendation includes but is not limited to reviewing the agreement number, agreement term, billing lender, expiration date, refinance indicator, and source indicator.