The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the Deputy Assistant Secretary for Operations of Community Planning and Development enhance CPDs existing Grant Accrual Standard Operating Procedures to strengthen governance within CPD and to effectively work within the framework established by the OCFO in recommendation 1A. The updated procedures should include increased ownership and oversight over the reviews, authorizations, approvals, and changes to the CPD grant accrual estimates and methodology.

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should implement an automated governance, risk, and compliance tool to manage risk from all sources across the three tiers of the organization in a timely manner. This recommendation updates FY 2021 FISMA recommendation number 5 (IG FISMA metrics 5, 9, and 10).

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Take corrective action for the subrecipient monitoring and agreement issues cited for eight of the ESG-CV grantees reviewed, and provide additional guidance and technical assistance as needed to ensure that they understand requirements.

Develop and implement additional subrecipient monitoring training and guidance for all ESG grantees.

Improve or enhance its antifraud efforts for the ESG program and incorporate fraud risk management practices that are consistent with the best practices identified in the Government Accountability Office’s A Framework for Managing Fraud Risks in Federal Programs and Chief Financial Officers Council and Treasury Bureau of the Fiscal Services’ Antifraud Playbook.

Obtain training or technical assistance as needed on the implementation of fraud risk management practices.

Establish a separate fraud risk management framework or evaluate and build upon its ERM framework by incorporating fraud risk management practices that are consistent with the principles of GAO’s Standards for Internal Control in the Federal Government (Green Book), including developing a fraud risk management framework in alignment with best practices identified in GAO’s A Framework for Managing Fraud Risks in Federal Programs and the Chief Financial Officers Council’s Antifraud Playbook.