We audited the U.S. Department of Housing and Urban Development’s (HUD) New Core Project as part of the internal control assessments required for the fiscal year 2015 financial statement audit under the Chief Financial Officer’s Act of 1990.  Our objective was to assess the status of the project and to determine whether the New Core Project team complied with Federal regulations and departmental project management processes.  This audit is the first of several to be completed on the New Core Project implementation.

Weaknesses in the New Core Project were not adequately addressed.  HUD did not follow its own agency policies and procedures, the policies established for New Core, or best practices.  HUD will become the first cabinet-level agency to use a Federal shared service provider.  The transfer of its financial management to a shared service provider has been widely publicized.  HUD’s previous attempt to use a commercial shared service provider to start a new financial management system failed after spending more than $35 million.  Our review of the previous project determined that Office of the Chief Financial Officer did not properly plan and manage its implementation of that project.  If HUD is not successful in this implementation, it could reflect negatively on Office of Management and Budget’s mandate to use Federal shared service providers.  The weaknesses identified in this report relate to requirements and schedule and risk management.  These areas are significant to the project plan, and the effectiveness with which HUD manages them is critical to the project’s success.

We recommend that the Chief Financial Officer (1) ensure that requirements for the functional areas that were not part of the shared service provider’s standard configuration are completed and approved before beginning design and development, (2) reevaluate the October 1, 2015, start date for release 3, (3) modify the project schedule and dashboard to identify the critical path, (4) establish a contingency plan, (5) ensure that all risks are fully mitigated before closing, and (6) address the remaining weaknesses identified.