Revise HUD’s Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD’s Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Implement a plan to annually survey all HUD program offices to identify nondisclosure policies, forms, and agreements issued and to determine whether they include the anti-gag provision as required by WPEA and, as necessary, to take corrective action to ensure that they include the anti-gag provision.

Revise the Ginnie Mae Confidential Information Policy to state that in the future, (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Update the Conveyance, Assignment, and Assumption Agreement to require purchasers to report final property outcomes and identifying information including those of third-party purchasers when applicable.

Enhance data collection and processing controls to ensure consistency in reporting data.

Enhance existing demonstration guidance within the Conveyance, Assignment, and Assumption Agreement to provide further detail regarding documentation retention requirements.

We recommend that the Chief Financial Officer enhance existing policies to establish a formal grant accrual risk management framework to help ensure consistent standards across HUD with regard to the development, review, and execution of the grant accrual and validation. This framework should include 1) identifying grant accrual estimation risk, assessing the magnitude of this risk, and managing the risks that arise when using certain quantitative estimation methods, 2) a governance structure that includes estimation ownership, oversight, and framework assessment, 3) the creation of a committee that is responsible for establishing a holistic approach to estimation risk management, including key stakeholders from OCFO and program offices, such as CPD, and 4) a requirement for documentation of committee meeting agendas, minutes, and key decisions and discussion points which impacts the various grant accrual methodologies across the Department.

Housing should include zero trust requirements as part of the Housing Strategic Roadmap for Housing Modernization.

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Issue guidance to PHAs clarifying the timing of unit inspections and lead-based paint visual assessments to address the misinterpretation caused by the terms “annual” and “every 12 months.”

Implement a process to identify teleworkers most at risk of receiving incorrect locality payments, verify that their official duty stations are correct and they are reporting to their official duty stations as required, and if necessary, correct their locality payments.

Provide evidence to support that the owners corrected the 46 deficiencies for the 20 units with outstanding deficiencies. If the owners fail to provide evidence that they made the required corrections, HUD should require the Authority to implement its HAP enforcement procedures and provide supporting documentation to HUD evidencing that it did so.

Improve its quality control process for monitoring its inspectors to enhance the effectiveness of its unit inspections and ensure that all units meet HUD’s and its own requirements to prevent more than $34 million in Program funds from being spent on units that do not meet HQS over the next year. This process should include but not be limited to procedures (1) requiring its staff to use the quality control inspection results to evaluate and monitor the performance of the Authority’s inspectors, along with maintaining adequate supporting documentation on feedback provided to the inspectors for recurring inspection deficiencies and (2) for evaluating the training provided to its inspectors to determine what improvements are needed to ensure that unit deficiencies are detected.

Pursue collection from the applicable owners or reimburse its HCV Program from non-Federal funds $106,477 ($180,309 - $73,832) in inappropriate HAP

Provide evidence to HUD that it has improved its controls and procedures for its stop payment process to ensure that (1) payments to owners comply with its HCV Program administrative plan and HUD requirements and (2) it maintains documentation to support stop payments and resumption of those payments for each unit as applicable.

Provide documentation to support that HAP was appropriately paid to the owners for the 66 units that had more than one stop payment. If additional HAP was inappropriately paid, the Authority should pursue collection from the applicable owners or reimburse its HCV Program from non-Federal funds.