Determine the appropriate timeframe for when initial management and occupancy reviews (MORs) should be completed for all properties that convert under the Rental Assistance Demonstration and issue updated guidance that includes a system to track the timeliness of initial MORs.

Complete the initial management and occupancy reviews (MORs) for the Rental Assistance Demonstration properties that have not had an initial MOR.

Develop and implement a plan to determine how to implement the risk-based approach to review the Rental Assistance Demonstration properties that have not had subsequent management and occupancy reviews (MORs) in more than 3 years and to require periodic MORs going forward.

Determine an appropriate timeframe in which non-FHA-insured Project-Based Rental Assistance (PBRA) properties converted under the Rental Assistance Demonstration should be initially inspected, work with HUD’s Real Estate Assessment Center (REAC) to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner. 

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations.

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Corrective Action Taken

The  Federal Housing Administration (FHA) Resource Center fields complaint calls and directs them to the appropriate party. When a FHA Resource Center complaint is referred to the Multifamily Regional Office, it is entered into the Asset Management Processing System (AMPS), the workload tracking system for HUD’s Multifamily Programs, within one day of receipt and tracked to completion with a goal of resolution within 21 days of receipt.  If a complaint is categorized as health and safety, it is prioritized for expeditious response by the assigned Account Executive.  Multifamily Field and Regional management track responses, to ensure resolution.  This includes having the Account Executives, at times, call the resident to confirm the issue has been resolved.  Based upon process as described HUD OIG concurred with the closure of this priority recommendation.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

The Office of Multifamily Housing has not yet updated its policies and procedures for the intake, monitoring, and tracking of health and safety complaints.  HUD was in the process of developing an automated monitoring system in the FHA resource center to allow tracking of individual calls and the call’s subject, such as health and safety.  HUD missed the final action target date of December 31, 2022, and a new completion goal was set for February 2025.  In July 2025, HUD sought closure for this recommendation due to unavailability of funds.  HUD stated that its issuance of policies and procedures for a comprehensive process was contingent on the development of a tracking system for the complaint process, for which it has repeatedly requested funding from Congress to no avail. As of January 2026, OIG is in the process of collaborating with HUD on finding a potential corrective action to resolve outstanding concerns.

Analysis

To fully address this recommendation, HUD must provide evidence that it has developed and implemented policies and procedures for the Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives when using the FHA’s automated monitoring system.

Implementation of this recommendation will result in HUD having a more efficient process for taking in, monitoring, and tracking health and safety complaints and aid HUD in more efficiently addressing those complaints.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

HUD previously reported that it was implementing a software management tool with an expected implementation date of quarter 2 of FY 2025; however, between quarter 2 and 3 of FY 2025, HUD personnel has stated that the tool would not meet the agency’s needs.  Accordingly, HUD is looking at a new tool to implement this program and collaborating with the DHS continuous diagnostics and monitoring team to analyze options. As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address this recommendation, the Office of Multifamily Housing must provide evidence of an action plan or policy that includes procedures to ensure households living in multifamily units have a sufficient supply of safe drinking water.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing have a sufficient supply of safe drinking water.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems.  In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide.  HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool.  This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.  As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address the recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Nonprivileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems.  In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide. HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool.  This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.  As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address this recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution.  Privileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

As of January 2026, the Office of Multifamily has developed standard operating procedures for its field office staff and plans to issue additional guidance to HUD staff and multifamily property owners on addressing lead in the water for multifamily properties.  Although the final action target date has passed, the guidance is undergoing HUD's internal review clearance process.  HUD did not provide an estimated date for issuance of the guidance to close the recommendation.

Analysis

To fully address this recommendation, the Office of Multifamily Housing must provide evidence of an action plan or policy that includes procedures to ensure households living in multifamily units have a sufficient supply of safe drinking water.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing have a sufficient supply of safe drinking water.

In April 2024, HUD OIG met with HUD OCIO to discuss progress and requirements for closure of this recommendation. In addition, OIG reviewed this recommendation as part of the annual FY 2024 FISMA evaluation in April 2024 and learned from HUD OCIO that that there would be a procedure update that would implement the ingestion and monitoring of all inbound and outbound traffic. The OIG requested to be provided with these procedures when finalized and evidence of implementation on May 1, 2024.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Implement a change to regulations at 24 CFR Part 203 to require curtailment of preforeclosure interest and other costs that are caused by lender servicing delays, resulting in $413,513,975 in funds to be put to better use. This should include updating or seeking statutory authority to update HUD’s regulations as necessary and coordinating with HUD’s Office of Finance and Budget, well before any changes go through departmental clearance, to ensure that planned curtailment requirements can be consistently enforced through the claims process.

Develop a method for using the Do Not Pay portal during the underwriting process to identify delinquent child support and delinquent Federal debt to prevent future FHA loans to ineligible borrowers to put $1.9 billion to better use.

Enforce the requirement for all HUD web applications and services to be approved by the CIO and ensure OCIO reviews and approves all IT contracts and services agreements dealing with creation or support of web applications or services.