The U.S. Department of Housing and Urban Development (HUD), Office of Inspector General (OIG) is auditing the use of Community Development Block Grant Disaster Recovery (CDBG-DR) funds as non-Federal match for the Federal Emergency Management Agency’s (FEMA)Public Assistance Program.  Our objectives are to determine whether four CDBG-DR grantees made improper payments and whether the Office of Community Planning and…

We audited the project activity status for 12 grantees that received funds under the U.S. Department of Housing and Urban Development’s (HUD) Community Development Block Grant (CDBG) National Disaster Resilience (NDR) grant to determine whether the grantees have accomplished or are on track to accomplish the goals of the activities outlined in their action plans. We found that NDR grantees should be able to accomplish their…

The OIG evaluated the U.S. Department of Housing and Urban Development’s (HUD) progress in applying zero trust security principles to protect personally identifiable information (PII).  HUD maintained a significant number of records that contain PII with limited zero trust controls in place to secure these data.  In FY 2022, HUD established a zero trust implementation plan to help the agency address the five zero trust…

The OIG evaluated the U.S. Department of Housing and Urban Development (HUD) Office of Housing’s (Housing) progress in applying zero trust security principles to protect personally identifiable information (PII) within the Federal Housing Administration (FHA) Catalyst system.HUD was in the beginning stages of implementing zero trust requirements for the data and identity pillars. HUD Office of Housing systems, including FHA Catalyst,…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to…

 The Geospatial Data of 2018 (the Act) governs the collection, production, acquisition, maintenance, distribution, use, and preservation of geospatial data of covered agencies, including the U.S. Department of Housing and Urban Development (HUD).  We audited the U.S. Department of Housing and Urban Development’s (HUD) efforts to meet the geospatial data requirements stated in the Act.  The Act requires the Inspector…

In January 2017, HUD awarded the City $141.2 million in Community Development Block Grant National Disaster Resilience grant funding for disaster resilience. HUD designed the grant to give states flexibility in planning program activities and help state and local communities recover from past disasters, while also improving their infrastructure to withstand future extreme events through strategic community investments.  The City…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to…

From 2001 to 2022, the Community Development Block Grant - Disaster Recovery program provided almost $98 billion to states, cities, counties, and territories to help them recover from disasters.  Administering disaster recovery has been a recurring U.S. Department of Housing and Urban Development (HUD) top management challenge since 2018.  Therefore, we audited the disaster recovery program to determine whether the Office of…

We performed an audit examining HUD’s efforts to prevent duplication of benefits when using Community Development Block Grant (CDBG) Disaster Recovery and Mitigation funds.  Our objective was to determine how the U.S. Department of Housing and Urban Development (HUD) assesses the adequacy of grantee procedures to prevent a duplication of benefits, both before and after grant execution. HUD certified grantees’ high-level processes…

We performed an audit related to the U.S. Department of Housing and Urban Development’s (HUD) Disaster Recovery Data Portal.  The Disaster Recovery Data Portal is a technological solution planned by HUD to facilitate the rapid and secure transmission of data from the Federal Emergency Management Agency (FEMA) to HUD’s Community Development Block Grant Disaster Recovery grantees.  We performed the work because HUD needs a…

We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks.  RPA is a software technology used to emulate human actions on a computer.  RPA software programs, referred to as “bots,” can complete repetitive tasks quickly and consistently, freeing up employees to work on…

We audited the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) infrastructure to support mandatory telework. During mandatory telework, more employees simultaneously needed remote access to HUD’s network and agency resources for an extended period, which presented unique risks and security requirements. While HUD is no longer operating under mandatory telework, understanding the challenges it faced…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program.  FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation…

We audited the U.S. Department of Housing and Urban Development’s (HUD) efforts to meet the Geospatial Data Act of 2018 (the Act). Our audit objective was to determine whether HUD met the 13 responsibilities stated in the Act with regard to its collection, production, acquisition, maintenance, distribution, use, and preservation of geospatial data.  The Act also generally requires covered agencies provide access to geospatial…

We audited the U.S. Department of Housing and Urban Development (HUD), Office of Community Planning and Development’s (CPD) oversight and monitoring of its Community Development Block Grant Disaster Recovery (CDBG-DR) slow-spending grantees.  This was a self-initiated audit consistent with our oversight activities and current top priority areas.  Our objective was to assess CPD’s monitoring and oversight tools related to the…

We reviewed the U.S. Department of Housing and Urban Development’s (HUD) ability to effectively complete information technology (IT) acquisitions.  HUD’s IT systems and its modernization plans depend heavily on contractors, yet HUD has historically faced significant challenges with implementing effective acquisition processes. Therefore, HUD’s acquisition capacity represents a key potential risk within HUD’s IT environment. We…

In February 2021, the Office of the Chief Information Officer (OCIO) identified funding risks with the development contract under which HUD contracted for Federal Housing Administration (FHA) Catalyst’s development.  In response, HUD officials took steps to slow FHA Catalyst spending on the contract while awaiting approval for additional contract funds.  Despite efforts to slow project spending, it was not enough to prevent…