Develop and fully implement a departmentwide policy for the monthly transaction review process that requires program office participation and timely completion of the review and certification.

Update OCFO’s travel card monitoring procedures to obtain, review, and monitor the IBA Use report on a regular basis to ensure compliance with purchases required to be made on the government travel card.

HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

Establish an improper payment council within HUD that consists of senior accountable officials from across the Department with a role in the effort that would work to identify risks and challenges to compliance and identify solutions as a collaborative group.

Develop and complete a detailed plan and timeline for completing compliant PIH-TBRA and PBRA program estimates and ensure that the improper payment council prioritizes completion of the plan in time for fiscal year 2023 reporting.

Develop a secure platform for the collection and storage of PIIA data that contain PII and formally assign a staff with adequate training and skillsets to administer the data and application (including maintaining and managing access controls of a chosen application that will be used to store the PIIA data with PII).

Reevaluate the methodology and reassess the weight assigned to each risk factor to ensure that appropriate weight is given to risks associated with non-Federal administrators or consider doing one risk assessment for HUD’s internal payment cycle and another risk assessment for the non-Federal entities that administer HUD’s program funds.

Until program-specific fraud risk assessments are completed, revise the PIIA fraud risk questionnaire process to compensate for the lack of program-specific fraud risk assessments.

Reassess the Homeless Assistance Grants program as part of the fiscal year 2023 risk assessment.

Update its policy and procedures to define its authority for marketing troubled issuer portfolios and the conditions that must exist to extinguish issuers using rapid relocation.

Update its policy and procedures to define what type of information Ginnie Mae may disclose and how it will handle protected information before extinguishment.

Update its Policies and procedures to define how Ginnie Mae will determine the portfolio value and price before Sale.

Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

Assesses what information Ginnie Mae needs from the MSS to ensure that they have the capacity for a large- or multiple-issuer extinguishment.

Prescribes how the contracting officer representative will review information provided by the MSS and provide actionable feedback to ensure MSS readiness.

Develop and implement an agencywide crisis readiness plan addressing likely hazards arising from a crisis. This guidance should include all key elements that meet CIGFO crisis guidance.

Update and synchronize the SOP and the matching procedure. The updates should include notifications that provide issuers with unmatched loans adequate time to take corrective action to comply with the requirements of the MBS Guide to put $903 million to better use by ensuring that the appropriate agency insurance or guarantee is in place.

Ensure that all necessary information regarding terminated VA loans is included in the matching process.

Develop and issue a departmental grant accrual validation policy or update the existing grant accrual policy to include the validation process. The policy should include 1) specific control activities over the grant accrual validation and outline all of the specific roles and responsibilities; 2) a periodic review of the grant accrual validation to evaluate and reassess its continued relevance and control effectiveness, and ensure any changes are designed and implemented appropriately; and 3) a clear communication plan that requires formal and documented communications between appropriate program offices and OCFO to ensure the validation results are used to update the grant accrual methodology and subsequent period’s estimate, as appropriate.