Develop and implement adequate policies, procedures, and controls to ensure that owner certifications and surveys and other relevant documents related to properties that fail inspections or are noted as having EHS deficiencies are maintained and retrievable from an easily accessible location.

Develop and implement adequate controls to ensure that HUD staff with the appropriate level of authority approves extensions to the notices of violation and default cure periods in writing and that documentation is maintained to support such approvals.

Modify the queries used to generate the schedules of properties that accompany the reports to Congress to consider a larger range of dates to ensure that properties that failed consecutive inspections are appropriately identified on all applicable schedules.

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

Implement adequate procedures and controls to ensure that documentation is maintained to support that the reports were submitted to Congress.

Develop comprehensive guidance and training for grantees on how to prepare the PR 29 report to ensure that the information collected is reliable, accurate, timely, and in compliance with the Uniform Administrative Guidance for Grants and Cooperative Agreements, specifically 2 CFR 200.302(a)(b) and 2 CFR 200.303

Determine whether the funds that were drawn in error need to be repaid to HUD and whether other remediation actions are appropriate.

Follow up with the four grantees without adequate supporting documentation and assess their compliance with the financial management requirements in 2 CFR 200.302(b)(3), which require the financial management system of each non-Federal entity to provide for records that adequately identify the source and application of funds for federally funded activities.

Update the CPD Monitoring Handbook to incorporate the review of the PR 29 report when performing financial monitoring reviews.

Develop written procedures on how to review PR 29 report submissions and monitor resubmissions, late submissions, and nonsubmissions.

Evaluate and update IDIS to ensure that resubmissions of PR 29 reports are tracked and prior submissions are preserved and correct the system’s misclassification of unsubmitted and uncertified draft PR 29 reports as submitted.

Determine how often grantees’ requests for reimbursement contain cost outside the quarter and in coordination with OCFO, evaluate CPD’s grant accrual methodology and assumptions to ensure that it adequately considers the impact of these late cost reimbursements.

Develop guidance that encourages grantees to draw down funds for reimbursement on a regular schedule, not less than quarterly.

Work with OCFO to ensure that CPD collects and reports to OCFO all of the information needed to properly account for all CPD activities in HUD’s financial statements in accordance with Federal financial reporting requirements and accounting standards.

Update Line 4 - Cash (grant funds) disbursed during the reporting period in the PR 29 report to allow grantees to report all CDBG grant funds disbursed, including funds that have not yet been drawn down from HUD for reimbursement.

Obtain the required approvals under PRA for the PR 29 report.

HUD’s Office of Administration, in coordination with OCIO, should update and communicate its PII minimization plan. The plan should include detailed procedures to regularly review and remove unnecessary PII collections in accordance with OMB Circular A-130 (IG FISMA metric 35).

HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

HUD OCIO should implement a process to consistently update and maintain its inventory of hardware assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized hardware assets from the HUD network (IG FISMA metrics 2, 20, and 21).