Develop ALU engagement standards and incorporate them into acquisition policies and procedures.

Update guidance to clarify the different roles and responsibilities of the ALU, CO, CS, and COR.

We recommend that the Chief Procurement Officer develop, implement, and communicate requirements for program offices to establish written minimum roles and responsibilities for their respective procurement management functions, including but not limited to CORs, PMs, and SMEs.

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD provided a corrective action plan for this recommendation in May 2025. The planned corrective action requires the agency to acquire a data management system, develop cataloging standards, and coordinate with the program offices stated in the recommendation to ensure data is handled in a secure manner. The procurement process has not yet begun, yet in their initial plans, HUD will require vendor support to develop this tool. The estimated completion date of this recommendation is September 2027.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-03 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

Develop a standard operating procedure for the monthly transaction review that aligns with the HUD policy and includes specific procedures on how to (1) identify and review common transactions that raise the level of risk in the program (for example, personal use purchases, other prohibited purchases, unauthorized purchases or services, split purchases, fraudulent purchases, FAR violation purchases, etc.), (2) methodically select transactions for investigation, and (3) follow up on identified potential improper transactions, including record-keeping requirements.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

We recommend that the Chief Procurement Officer direct the contracting officers to review the current FSM contracts’ QASP and update accordingly to ensure that all minimum contract requirements are included.

We recommend that the Chief Procurement Officer direct the contracting officers to oversee the implementation of the current FSM contracts’ QASP.

We recommend that the Chief Procurement Officer require the contracting officers to implement the policies and procedures in the HUD Acquisition Policy and Procedure Handbook for completion of HUD’s FSM contractor performance assessment reports in CPARS to ensure that Government past performance is documented properly and in a timely manner, at least annually, for use by all Federal agencies and maintained in the contract files.

We recommend that the Chief Procurement Officer require all staff involved in the oversight of FSM contracts to maintain the required documentation in the official contract file identified by HUD policy to support the contracts.

We recommend that the Chief Procurement Officer require the contracting officers to formally designate CORs in a timely manner and maintain the required documentation in the proper location identified in the relevant HUD policies and procedures, which fully supports the CORs’ oversight of the FSM contract.

Ensure there are resources available for further development of geocoding services that fulfill HUD’s responsibilities stated in 43 U.S.C. § 2808(a)(5) and 43 U.S.C. § 2808(a)(12) through the reactivation of the lapsed Geocode Service Center contract.

Conduct a departmentwide comprehensive staff capacity assessment to identify resource and skills gaps of staff involved in IT acquisitions.

Develop a departmentwide human capital plan or evaluate and revise existing plans to guide the recruitment, retention, and skill development of staff involved in IT acquisitions. The plan should include related metrics to measure plan implementation and effectiveness.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

In November 2024, OCPO submitted an IT Acquisition Workflow Report and a document outlining responsibilities as evidence for closure. Although these documents clarified existing roles and documented one sample workflow, they did not propose or implement revised IT-acquisition policies or procedures producing measurable improvements. As of July 2025, OIG received no further information that identifies improvements in the IT acquisition process.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in defined IT acquisition process workflow procedures to increase efficiency and ensure coordination across program offices.

Establish a centralized acquisition tracking system that allows for input and monitoring by all offices involved with the IT acquisition process by: a. Developing a plan with detailed implementation milestones; b. Obtaining appropriate approvals and funding; and c. Implementing a centralized acquisition tracking system, based on the implementation plan and approvals from 4a and 4b.

Develop a plan for clearly defining, communicating, and enforcing IT acquisition process standards, including acquisition process roles and responsibilities.

Take appropriate actions to prioritize the need for resources necessary to ensure that HUD fully implements the remaining four responsibilities as required by sections 759(a)(1), 759(a)(2), 759(a)(4), and 759(a)(5) of the Geospatial Data Act of 2018.