HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

We recommend that the Director of Disaster Recovery collect and record the number of days that it or other entities take to complete each milestone in the grant process.

We recommend that the Director of Disaster Recovery establish timing benchmarks for the milestones at each significant step in the allocation and award process based on actual data accumulated for the various grants.

We recommend that the Director of Disaster Recovery take steps to ensure that the milestone point of allocation is formally defined and documented, to allow for accurate tracking of compliance with requirements.

We recommend that the Deputy Assistant Secretary instruct PRDOH to implement a process to regularly conduct fraud risk assessments and determine a fraud risk profile. The fraud risk profile should include key findings and conclusions from the risk assessment, including the analysis of the types of fraud risks, their perceived likelihood and impact, risk tolerance, and the prioritization of risks.

We recommend that the Deputy Assistant Secretary instruct PRDOH to improve fraud awareness initiatives, such as participating in organized antifraud conferences, reviewing the OIG’s Special Fraud Alerts, Bulletins, and Other Guidance, and attending fraud risk training tailored to the program’s fraud risk profile (including subrecipients).

We recommend that the Deputy Assistant Secretary for Grant Programs evaluate PRDOH’s risk exposure and tolerance as part of HUD’s program-specific fraud risk assessment for disaster grant programs.

We recommend that the Deputy Assistant Secretary for Grant Programs coordinate with HUD’s Chief Risk Officer to (1) provide training and technical assistance to PRDOH with a focus on the design, implementation, and performance of fraud risk assessments, and (2) establish a fraud risk management framework for the organization.

We recommend that the Deputy Assistant Secretary for Grant Programs assess whether grantees have mature fraud risk management programs within the disaster recovery and mitigation programs.

We recommend that the Deputy Assistant Secretary for Grant Programs determine the fraud risk exposure in HUD's disaster recovery and mitigation programs and work with grantees to implement appropriate fraud mitigation activities.

We recommend that the Director, Office of Disaster Recovery, perform monitoring of or otherwise review grantees’ detailed procedures for preventing duplication of benefits for each grant activity within the first year after HUD signs the grant agreement or before grantees process applications for assistance, whichever occurs first.

We recommend that the Director, Office of Disaster Recovery, develop and implement a process to review grantees’ detailed procedures for preventing duplication of benefits and require grantees to correct any deficiencies identified in the review before grantees process applications for assistance.

We recommend that the Director, Office of Disaster Recovery, for future grants, develop and implement procedures to ensure that all applicable requirements for preventing any duplication of benefits are included in the adequacy criteria, grantee certifications, and HUD review checklists supporting the certification.

We recommend that the Director of the Office of Disaster Recovery require the State to implement policies and procedures that require maintaining documentation to ensure it can support compliance for the installation of 36-inch roof valley flashing.

We recommend that the Director of the Office of Disaster Recovery require the State to determine if the proper roof valley flashing was installed on the completed and in progress homes, and if not, require the State to install the correct roof valley flashing using non-Federal funds.

We recommend that the Director of the Office of Disaster Recovery require the State to enhance the system used to estimate costs, to include the Wildland-Urban Interface Code required roof valley flashing, or document in the system and its output the different materials and costs used.

We recommend that the Director of the Office of Disaster Recovery require the State to develop and implement a policy to identify ownership and primary residency earlier in the review process and potential red flags in documentation.

We recommend that the Director of the Office of Disaster Recovery require the State to document and support its decision regarding duplication of benefits and income verification for additional owners of the property under an application.

We recommend that the Deputy Assistant Secretary instruct the Virgin Islands Housing Finance Authority to develop and implement procedures, including financial controls, to enhance its tracking of payments made with CDBG-DR funds and payments made with FEMA funds to ensure that payments are not made for the same invoices, match requirements are not exceeded before closeout, and a thorough review is conducted for award increases and cost reasonableness.