Review FMC’s final December 31, 2016, balances and update the PIH prepayment beginning balance accordingly.

Delegate responsibilities to the appropriate program office and assign risk owners to provide responses for the acceptance, mitigation, and elimination of risks identified in HUD’s ERM risk profile.

Develop, implement, and document internal controls in response to identified risks from HUD’s ERM risk profile in compliance with OMB Circular No. A-123, Management's Responsibility for Enterprise Risk Management and Internal Control.

Complete and issue final FERA policy to the Department and communicate the requirements within the policy to program offices in a timely manner.

Assign and communicate the responsibility of FERA policy implementation and oversight to ensure that program offices are performing FERAs on a routine and timely basis to ensure effectiveness and efficiency of operations at the HUD program level and compliance with HUD internal policy and procedure.

Assign and communicate the responsibility of the MCR program policy, implementation, and oversight to ensure that program offices routinely conduct reviews to support a compliant internal control framework.

Conduct the OOR more frequently than annually to ensure that all obligations are adequately reviewed and deobligations are processed by the end of the fiscal year

Develop departmental policy that outlines the open obligation review process, to include (1) internal controls, (2) timeframes, and (3) roles and responsibilities of OCFO, OCPO, and program offices. These policies must outline sufficient internal controls in place to ensure that the Secretary can certify that all of HUD’s obligations are valid as of the end of the fiscal year.

Update standard operating procedures on the departmentwide unliquidated obligations review to conduct a routine review of justifications provided by the program offices for retained obligations, while ensuring that they are for a bonafide need and to support the annual certification made by the Secretary on open obligations.

As part of the OOR process, conduct monitoring activities of obligations sent to OCPO for deobligation by developing a mechanism to routinely track the status, to include key information, such as but not limited to the owner (program), date transmitted to OCPO, point of contact, last contact date, and current status. OCFO should use this information to ensure that all information has been communicated among all parties involved to enable timely deobligation.

Implement a process to ensure that ongoing ADA violation investigations are properly documented as the investigation progresses to enable timely review of open cases.

Review the 17 travel cardholders with purchases that occurred without a travel authorization and the 6 travel cardholders with purchases that were not supported to determine whether the purchases were allowable, proper, and paid in full by the cardholder, taking appropriate administrative actions as necessary. These unsupported purchases totaled $6,407. However, a total of $5,780 remains after deducting the duplicate amount of $627 addressed in Recommendation 1C.

Perform an analysis of the 3,045 travel card purchases with indications that they were unauthorized or ineligible to identify potential violations and to address any unauthorized purchases identified. OCFO should perform a review of identified transactions to determine whether they were allowable, proper, and paid in full by the cardholder, taking appropriate administrative actions as necessary.

Refer the 15 ineligible travel card transactions totaling $5,393 to the appropriate program office and obtain a response regarding what administrative actions were taken to resolve the violations. If no actions were taken, OCFO should request support to show why no corrective actions were taken.

Strengthen internal monitoring efforts regarding government travel card use to identify potentially improper, illegal, or erroneous transactions. Such efforts should include data mining to detect instances of delinquency, fraud, and misuse.

Ensure the privacy program is staffed with experienced personnel (such as a Chief Privacy Officer) to manage the operational aspects of the program.

Issue a notice at the Secretary level delegating and clarifying the authority and responsibilities of the SAOP and Privacy Office

A. Document the roles and specific responsibilities of all positions assigned privacy responsibilities. B. Communicate these responsibilities on a recurring basis, at least annually, to individuals holding these positions.

Implement thorough human capital processes to ensure execution of the HUD privacy program and all its requirements

Finalize and approve the draft privacy program strategic plan