The OIG evaluated the U.S. Department of Housing and Urban Development’s (HUD) progress in applying zero trust security principles to protect personally identifiable information (PII).  HUD maintained a significant number of records that contain PII with limited zero trust controls in place to secure these data.  In FY 2022, HUD established a zero trust implementation plan to help the agency address the five zero trust…

We contracted with the independent public accounting firm of Sikich CPA LLC to audit the financial statements of HUD as of and for the fiscal years ending September 30, 2024 and 2023, and to provide reports on HUD’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters, including whether financial management systems complied substantially with the…

We contracted with the independent public accounting firm Sikich CPA LLC to audit the financial statements of Ginnie Mae as of and for the years ending September 30, 2024 and 2023, and to provide reports on Ginnie Mae’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with Sikich required that the audit be performed in…

We contracted with the independent public accounting firm of Sikich CPA LLC to audit the financial statements of FHA as of and for the fiscal years ending September 30, 2024 and 2023, and to provide reports on FHA’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with Sikich required that the audit be performed in accordance…

The OIG evaluated the U.S. Department of Housing and Urban Development (HUD) Office of Housing’s (Housing) progress in applying zero trust security principles to protect personally identifiable information (PII) within the Federal Housing Administration (FHA) Catalyst system.HUD was in the beginning stages of implementing zero trust requirements for the data and identity pillars. HUD Office of Housing systems, including FHA Catalyst,…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to…

 The Geospatial Data of 2018 (the Act) governs the collection, production, acquisition, maintenance, distribution, use, and preservation of geospatial data of covered agencies, including the U.S. Department of Housing and Urban Development (HUD).  We audited the U.S. Department of Housing and Urban Development’s (HUD) efforts to meet the geospatial data requirements stated in the Act.  The Act requires the Inspector…

HUD did not comply with PIIA because it did not report improper and unknown payment estimates for the Office of Public and Indian Housing’s Tenant-Based Rental Assistance (PIH-TBRA) program and the Office of Multifamily Housing Programs’ Project-Based Rental Assistance (PBRA) program, HUD’s largest rental assistance programs.  This noncompliance is significant because this is the seventh consecutive year in which HUD has been…

As required by the Charge Card Abuse Prevention Act of 2012, Public Law 112-194, we performed risk assessments of the U.S. Department of Housing and Urban Development’s (HUD) purchase and travel card programs.  In our risk assessments, we analyzed and identified the risks of illegal, improper, or erroneous purchases.  Using information provided by HUD, we assessed risk for eight different risk factors and ranked each risk…

We audited the U.S. Department of Housing and Urban Development (HUD), Office of Community Planning and Development’s (CPD) process for collecting financial information from grantees participating in the Community Development Block Grant (CDBG) Entitlement program. Prior year HUD financial statement audits found weaknesses in CPD’s processes to estimate accrued grant liabilities and instances where it appeared CDBG grantees were…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on HUD’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters, including whether financial management systems complied substantially…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of Ginnie Mae as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on Ginnie Mae’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with CLA required that the audit be…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of FHA as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on FHA’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with CLA required that the audit be performed in…

We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2022 compliance with the Payment Integrity Information Act of 2019 (PIIA) and implementation of Office of Management and Budget (OMB) guidance. PIIA was enacted to prevent and reduce improper payments and require each agency’s inspector general to perform an annual review of the agency’s compliance with PIIA. Our objectives were to assess (1) whether…

We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks.  RPA is a software technology used to emulate human actions on a computer.  RPA software programs, referred to as “bots,” can complete repetitive tasks quickly and consistently, freeing up employees to work on…

We audited the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) infrastructure to support mandatory telework. During mandatory telework, more employees simultaneously needed remote access to HUD’s network and agency resources for an extended period, which presented unique risks and security requirements. While HUD is no longer operating under mandatory telework, understanding the challenges it faced…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on HUD’s 1) internal control over financial reporting; and 2) compliance with laws, regulations, contracts, and grant agreements and other matters, including whether financial management systems complied substantially…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of FHA as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on FHA’s 1) internal control over financial reporting; and 2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with CLA required that the audit be performed in…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of Ginnie Mae as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on Ginnie Mae’s 1) internal control over financial reporting; and 2) compliance with laws, regulations, contracts, and grant agreements and other matters. Our contract with CLA required that the audit be…