We reviewed general and application controls for selected information systems to assess management controls over the U.S. Department of Housing and Urban Development's (HUD) computing environments as part of the Office of Inspector General's (OIG) audit of HUD's financial statements for fiscal year 2007 under the Chief Financial Officer's Act of 1990. Our review was based on the Government Accountability Office (GAO) "Federal Information Systems Controls Audit Manual" and information technology guidelines established by the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST).

We found weaknesses and deficiencies in controls that stem from HUD's noncompliance with (i) requirements for internal controls established by OMB, (ii) guidance issued by NIST for securing information systems, and (iii) HUD's own policies and procedures. We recommend that HUD take steps to ensure compliance with OMB requirements, NIST guidelines, and HUD's own internal policies and procedures.

The OIG has determined that the contents of this audit report would not be appropriate for public disclosure and has therefore limited its distribution to selected officials. Please contact the ISAD Director or Assistant Director to request a copy of this report.