Simplify the process for accessing its FAQs on Single Family’s website, including adding a clickable link on its website home page that will take borrowers directly to the FAQs.

Review the two loans in our sample that did not receive appropriate servicing and take administrative actions if appropriate.

Require the transaction specialist contractor to change its application review process to prevent incomplete applications from being considered during vacant loan sales and that recommendations to approve applications are supported by written analysis.

Implement improved verification checks to prevent participation of restricted entities.

Implement an improved process to review and update program controls before each sale to achieve its mission objectives.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner.

Status

HUD has implemented a process of sending notifications to the field offices' centralized inboxes when a failed inspection has been released with instructions to issue a Notice of Default or Notice of Violation within 15 days. The field office logs this task into the Asset Management Processing System (AMPS) and assigns it to an Account Executive. Field office management tracks the progress of the task in AMPS. HUD is building a reporting tool to see if the task has been properly entered into iREMS and addresses the field office instances where it has not. The construction of this tool has been delayed due to limited staff resources. As of January 2025, the reporting tool was undergoing review and testing prior to implementation. The final action target date was November 29, 2024.

Analysis

Implementing procedures and controls for the timely issuing of notices would ensure that property owners are held accountable for correcting life-threatening deficiencies in a timely manner thus reducing the risk of families living in units that are unsafe for longer periods.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Status

HUD will update the Notice of Default and Notice of Violation in conjunction with updates related to NSPIRE. These updates have been delayed by limited staff resources and pending policy clarifications and system changes for NSPIRE.

The final action target was November 29, 2024.

Analysis

The inclusion of language in the notices would ensure that property owners are aware of their responsibilities to inspect all units, common areas, grounds, building systems, and sites and perform repairs of identified deficiencies to protect families from living in units that are not decent, safe, and sanitary.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Develop and implement adequate policies, procedures, and controls to ensure that owner certifications and surveys and other relevant documents related to properties that fail inspections or are noted as having EHS deficiencies are maintained and retrievable from an easily accessible location.

Develop and implement adequate controls to ensure that HUD staff with the appropriate level of authority approves extensions to the notices of violation and default cure periods in writing and that documentation is maintained to support such approvals.

Modify the queries used to generate the schedules of properties that accompany the reports to Congress to consider a larger range of dates to ensure that properties that failed consecutive inspections are appropriately identified on all applicable schedules.

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

Implement adequate procedures and controls to ensure that documentation is maintained to support that the reports were submitted to Congress.

HUD OCIO should implement a process to consistently update and maintain its inventory of hardware assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized hardware assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should report at least 80 percent of its government-furnished equipment through the DHS CDM program (IG FISMA metric 2).

HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should update its software inventory policies and procedures to account for critical software as defined by EO 14028 (IG FISMA metrics 3 and 21).

HUD OCIO should implement policies and procedures to maintain inventories of critical software and software licenses, critical software platforms, and all software installed on critical software platforms (both critical software and noncritical software) and use the inventory of critical software platforms and all software installed on them to ensure that only supported versions of software are used on those critical software platforms (IG FISMA metrics 3 and 21).

HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)

HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).

HUD OCIO should ensure that external systems, such as cloud systems and cloud service providers, have and maintain configuration management plans that are consistent with HUD’s defined configuration management requirements (IG FISMA metric 19).