HUD OIG OPEN RECOMMENDATIONS
OIG’s Office of Audit and Evaluation makes recommendations to the Department of Housing and Urban Development and a few independent entities to correct deficiencies and encourage improvements in the safety, economy, efficiency, and management of their programs and operations. Our audit report findings and conclusions explain the basis for the specific corrective actions we recommend. This Recommendation Dashboard provides more information than ever before about the current status of OIG recommendations, which we plan to update on a weekly basis.
The State of New York Did Not Ensure That Properties Purchased Under the Acquisition Component of Its Program Were Eligible
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to reimburse from non-Federal funds the $2,595,127 paid to purchase six properties that were not substantially damaged. Further, the State should identify and reimburse from non-Federal funds any additional Disaster Recovery funds used to acquire and dispose of the properties.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to reimburse from non-Federal funds the $783,571 paid to purchase two properties that did not comply with flood hazard requirements and for which the State did not have sufficient documentation to show that the properties were substantially damaged. Further, the State should identify and reimburse from non-Federal funds any additional Disaster Recovery funds used to acquire and dispose of the properties.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to provide documentation to support the hardship letter provided for a property located outside the 500-year floodplain and documentation to show that the property was substantially damaged or reimburse from non-Federal funds the $435,069 in settlement costs paid to purchase the property. Further, the State should identify and reimburse from non-Federal funds any additional Disaster Recovery funds used to acquire and dispose of the property.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to reimburse from non-Federal funds the $183,500 in incentives paid to a homeowner that failed to maintain flood insurance.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to provide documentation to show that the five properties for which the homeowners failed to maintain flood insurance were eligible for assistance and documentation to show that the properties were substantially damaged or reimburse from non-Federal funds the $1,336,883 paid to purchase the properties, including incentives for one property. Further, the State should identify and reimburse from non-Federal funds any additional Disaster Recovery funds used to acquire and dispose of the properties.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to provide documentation to show that the remaining nine properties were substantially damaged or reimburse from non-Federal funds the $4,158,836 paid to purchase the properties. Further, the State should identify and reimburse from non-Federal funds any additional Disaster Recovery funds used to acquire and dispose of the nine properties.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to conduct a review of the universe of properties purchased through the acquisition component of its program to ensure that properties were eligible and reimburse from non-Federal funds the Disaster Recovery funds used in connection with any additional properties found to be ineligible. For example, the State’s review could include verification that (1) its files contained the required substantial damage letters, (2) the letters provided by applicants reflected the most recent substantial damage determination made by local officials, (3) substantial damage determinations were adequately supported, (4) properties met flood hazard requirements, and (5) properties were not FEMA-noncompliant.
We recommend that HUD’s Deputy Assistant Secretary for Grant Programs require the State to provide documentation showing that the acquisition component of its program has ended or improve its controls over the program to ensure that properties purchased are eligible. This recommendation includes but is not limited to updating its policies and procedures and implementing verification processes to ensure that it verifies information provided by applicants and other entities.
Fiscal Year 2018 Review of Information Systems Controls in Support of the Financial Statements Audit
Continue working with the owners of applications that still use the outdated protocols and assist them with upgrading to meet current requirements. When upgrading is not feasible, the Chief Information Officer should document the specific instance in which the outdated protocols can be used and obtain a waiver accepting the risk of using the outdated protocols. The waiver should be approved by the Chief Information Officer or his designee.
Remove SSL 3.0 and TLS 1.0 from HUD’s computing environment.
Update HUD’s IT security policy to reflect current requirements for TLS and SSL protocols and note specific instances in which the current requirements can be waived.
Update HUD’s IT security policy to reflect current requirements for TLS and SSL protocols and note specific instances in which the current requirements can be waived.
Test the operational impact of implementing FIPS-compliant encryption for hashing and signing for compatibility with legacy applications that are critical to HUD operations.
Develop and maintain documentation that supports the segregation of duties for privileged users at the server level, which shows how critical role-based job functions are separated to ensure adequate segregation of duties.
Divide functions performed by privileged users at the server level among different individuals to establish and maintain a sufficient degree of independence between the information system development and production environments to facilitate quality control and more effective oversight.
Periodically review server-level privileged users’ role-based access rights to ensure that the separation of duties is adequately addressed.
Create DIAMS records for the users identified to formally authorize and approve their level of system access.
Standardize account naming conventions for privileged access to HUD servers and update HUD policies as needed.
Periodically review the IT support contractors’ account management practices to ensure that they comply with HUD’s policies.
Ensure that privileged users’ server-level access is reviewed in accordance with HUD policies.
Modify the current disaster recovery contract to ensure that disaster recovery exercises periodically include full functional testing of the critical applications, with transaction and batch processing, verification, and performance measurement on all recovered platforms and applications.
Work with program offices and system owners to obtain their commitment and support for testing the functionality of their critical applications in the disaster recovery environment.
Include periodic full functional testing of the critical applications, with transaction and batch processing, verification, and performance measurement on all recovered platforms and applications, in all future disaster recovery support contracts.
Federal Housing Administration, Washington, DC, Review of Information System Controls Over FHA
Create policies and procedures requiring the creation of administrator IDs for CHUMS users with system security administrator and CHUMS implementation coordinator roles.
Implement separate administrator IDs for CHUMS users with system security administrator and CHUMS implementation coordinator roles.
Update the CHUMS audit log review procedures to implement a more frequent review of the Post Endorsement Change Report in accordance with HUD IT Security Policy.
Develop and implement policies and procedures requiring the weekly review and analysis of the FHAC INTER_LOG_TBL audit records.
Develop and implement policies and procedures requiring the frequent review, analysis, and maintenance of the mainframe audit reports and logs in accordance with HUD IT Security Policy.
Ensure that a rules of behavior document is provided to and signed by all CHUMS users in accordance with HUD IT Security Policy and Federal IT requirements.
Establish a policy to ensure that the rules of behavior document is reviewed and updated in accordance with HUD IT Security Policy.
Ensure the ISAs between CHUMS and other applications are completed and signed according to NIST Special Publication 800-47 and the HUD ISA template.
Ensure that changes to interface information are recorded accurately and consistently across all CHUMS security documents.
Louisville Metro, Louisville, KY, Did Not Always Administer the TBRA Activity in Its HOME and CoC Programs in Accordance With Program Requirements
Reimburse its HOME program $10,389 ($8,797 + $1,592) from non-Federal funds for the overpayment of housing assistance due to inappropriate recertifications and calculations of housing assistance.
Reimburse the four HOME program participants $468 from program funds for the underpayment of housing assistance due to inappropriate calculations of housing assistance.
Reimburse its CoC program $112,827 ($109,259 + $3,568) from non-Federal funds for the overpayment of housing assistance due to inappropriate recertifications and calculations of housing assistance.
Reimburse the three CoC program participants $260 from program funds for the underpayment of housing assistance due to inappropriate calculations of housing assistance.
Support or reimburse its CoC program $7,309 from non-Federal funds for the unsupported housing assistance payments.
Enforce its policy or implement an alternate method for the CoC program to ensure that annual recertifications are completed in a timely manner and that housing assistance is not issued before the recertification is completed to ensure that $385,660 in program funds is appropriately used for future payments.
Train its program staff on calculating housing assistance payments for the HOME and CoC programs to ensure that payments are appropriately calculated.
Review of Selected Controls of the GrantSolutions and OneStream Applications
Work with OCIO to update the ISA and MOA between HUD and Treasury by providing OCIO with a list and description of ARC applications that have connections to HUD.
Work with OCIO to update the ISA and MOA between HUD and Treasury by requiring ARC to inform OCFO in writing whenever a new module or tool has been added or a security risk has been identified and forwarding the information to OCIO.
Update the ISA and MOA between HUD and Treasury by signing it.
Work with OCFO to update the ISA and MOA between HUD and Treasury by correcting the misidentified HUD IT security policy reference in the document.
Work with OCFO to update the ISA and MOA between HUD and Treasury by adding a requirement that ARC notify HUD before connecting its IT system with another system.
Work with OCFO to update the ISA and MOA between HUD and Treasury by making changes to the document when notified by OCFO.
The City of San Bernardino, CA, Did Not Fully Administer Its HOME Investment Partnerships Program in Accordance With HUD Requirements
Repay its program $22,402 for duplicative charges to HOME activity 2292 from non-Federal funds.
Update and implement changes to the City’s HOME and grants management policies and procedures to prevent similar errors and ensure that HOME draws are accurate and in accordance with HUD requirements.
The Detroit Housing Commission, Detroit, MI, Did Not Always Administer Its Moderate Rehabilitation Program in Accordance With HUD’s and Its Own Requirements
Pursue collection from the applicable projects or reimburse its program $7,099 ($240 + $20 + $6,839) from non-Federal funds for the overpayment of housing assistance due to incorrect calculations, inappropriate contract rents, and failure to correct housing quality standards deficiencies.
Reimburse the appropriate projects $24,457 ($552 + $958 + $849 + $22,098) from program funds for the underpayment of housing assistance due to incorrect calculations, underpaid housing assistance, and inappropriate contract rents and recovery of program funds.
Reimburse the appropriate households $246 from non-Federal funds for the overpayment of tenant rent due to inappropriate calculations.
Reimburse its program $23,350 ($2,089 + $3,951 + $208 + $17,102) from non-Federal funds for the underpayment of tenant rent due to incorrect calculations, overpaid housing assistance and utility reimbursements, and its failure to perform housing quality standards inspections.
Support or reimburse the appropriate projects $648 from non-Federal funds for the unsupported payments of housing assistance cited in this finding.
Support or reimburse the appropriate households $6,137 from non-Federal funds for the unsupported payments of tenant rent cited in this finding.
Support or reimburse its program $78,704 ($1,956 + $76,748) from non-Federal funds for the unsupported payments of tenant rent and the missing certification and eligibility documentation.
Pursue collection from the applicable households or reimburse its program $16,793 from non-Federal funds for the overpayment of housing assistance due to unreported income.
Update its administrative plan to ensure that its policies are in accordance with HUD’s requirements and implement adequate quality control procedures to ensure that it correctly calculates housing assistance payments to ensure that $9,892 in program funds is appropriately used for future payments.
Implement adequate quality control procedures to ensure that it (1) obtains and maintains required eligibility documentation in accordance with HUD’s requirements, (2) appropriately calculates and pays housing assistance and utility allowance reimbursements, and (3) completes household certifications in a timely manner.
Ensure that the abatement procedures implemented by the Commission are sufficient to ensure that housing quality standards are enforced.
Information System Control Over Integrated Pool Management System
Ensure that all system and application security staff and those responsible for granting access to, maintaining, and providing overall support of Ginnie Mae systems are fully trained regarding the systems’ capabilities and functionalities.
Ensure that its contractor implements HUD’s requirements regarding changing passwords, requiring that the passwords for accounts, such as application developer and system administrator accounts, be changed at least every 90 days, and implements password controls over service accounts.
Direct its IPMS contractor to modify its access control standards to address the risks related to nonexpiring passwords associated with the service accounts and implement needed improvements.
Instruct its contractor to obtain Ginnie Mae’s approval before granting system access for all contractor system users and notify Ginnie Mae when access for its employees is modified or terminated.
Revise the quarterly access reviews and recertification process so that they clearly identify the system under review and accurately reflect the access level of each user.
Enforce the contract requirements related to background checks and the use of a PIV card by those individuals accessing Ginnie Mae systems and data.
Ensure that the contractor performs retroactive background checks on employees currently accessing Ginnie Mae systems.
Establish adequate controls or verification mechanisms to ensure the contractor’s overall compliance with the contract.
Instruct its contractor to update its mainframe onboarding procedures for Ginnie Mae operations with the modified procedures.
Establish and document a process to review user roles for incompatible duties at creation and when roles are modified to ensure that all individual functions and roles are properly segregated.
Create an adequate user roles and permission matrix that clearly shows each role-based type account and the related permissions or access granted to that role and account.
Periodically review the roles and permissions matrix to ensure that the matrix is up to date and properly reflects any changes to the organization’s missions and business functions, roles, and access.
The Tacoma, WA, Housing Authority Generally Satisfied RAD Requirements but Did Not Follow Its Moving to Work Policy by Conducting Annual Tenant Reexaminations for Its RAD Converted Units
Require the Authority to provide support for the $1,071 in unsupported assistance payments made in 2017 and reimburse its RAD-converted project-based voucher program using non-Federal funds for any amount that remains unsupported.
Require the Authority to reimburse its RAD-converted project-based voucher program $1,904 using non-Federal funds for the ineligible assistance payments made in 2017.
Require the Authority to complete overdue annual reexaminations and reconcile corrections by reimbursing tenants and its RAD-converted project-based voucher program using non-Federal funds.
Conduct a review to determine whether the Authority is complying with the reexamination schedule in its Moving to Work policy and incorporate timely reexaminations in the risk management assessment.
The Housing Authority of the City of North Chicago, North Chicago, IL, Did Not Always Comply With HUD’s Requirements and Its Own Policies Regarding the Administration of Its Housing Choice Voucher Program
Certify, along with the owners, that the applicable housing quality standards violations have been corrected for the 78 units cited in this finding.
Reimburse its program $153,222 from non-Federal funds for the housing assistance paid for the 50 units that materially failed to meet HUD’s housing quality standards and its own requirements.
Reimburse its program $15,796 from non-Federal funds for administrative fees earned for the 50 units that materially failed to meet HUD’s housing quality standards and its own requirements.
Ensure that its staff is properly trained and familiar with HUD’s and its own requirements regarding housing quality standards inspections.
Implement adequate procedures and controls to ensure that all units meet HUD’s housing quality standards and its own requirements to prevent $1,236,000 in program funds from being spent on units that do not comply with HUD’s requirements over the next year. The procedures should include but not be limited to ensuring that inspectors are properly trained and familiar with HUD’s and the Authority’s requirements and that they consistently conduct accurate and complete inspections and reinspections.
Support or reimburse its program $93,651 from non-Federal funds for the missing required eligibility documentation.
Reimburse its program $76 from non-Federal funds for the overpayment of housing assistance due to inappropriate calculations of housing assistance.
Reimburse the appropriate households $2,193 from program funds for the underpayment of housing assistance due to inappropriate calculations.
Reimburse its program $9,870 ($7,663 + $2,207) from non-Federal funds for the administrative fees it inappropriately earned for the missing required eligibility documentation and inappropriate calculations of housing assistance.
Implement adequate procedures and controls to ensure that the required documentation to support household eligibility is obtained and maintained and housing assistance payments are appropriately calculated.
Review the utility allowance schedules to ensure that all applicable utilities are provided to the households and that the utility allowances are based on the lower of the voucher size or unit size in accordance with HUD’s requirements.