Until program-specific fraud risk assessments are completed, revise the PIIA fraud risk questionnaire process to compensate for the lack of program-specific fraud risk assessments.

Reassess the Homeless Assistance Grants program as part of the fiscal year 2023 risk assessment.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

On January 17, 2025, the Office of Lead Hazard Control and Healthy Homes (OLHCHH) informed HUD OIG that the Office of the Federal Register published a notice, Modifying HUD’s Elevated Blood Lead Level Threshold for Children Under Age 6 Who Are Living in Certain HUD-Assisted Target Housing Covered by the Lead Safe Housing Rule. The notice announced that HUD is lowering its EBLL threshold from 5 to 3.5 µg/dL for a child under the age of 6, consistent with the CDC’s current blood lead reference value of 3.5 µg/dL, effective January 17, 2025. Next, OLHCHH will assist the Office of Community Planning and Development, the Office of Multifamily Housing Programs, and the Office of Public and Indian Housing to draft, circulate, and publish EBLL notices. The estimated completion date is June 30, 2025.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered blood lead reference value of 3.5 ug/dL.

Implementation of this recommendation will help ensure children living in public housing with elevated blood lead levels receive effective environmental interventions.

Develop and issue a departmental grant accrual validation policy or update the existing grant accrual policy to include the validation process. The policy should include 1) specific control activities over the grant accrual validation and outline all of the specific roles and responsibilities; 2) a periodic review of the grant accrual validation to evaluate and reassess its continued relevance and control effectiveness, and ensure any changes are designed and implemented appropriately; and 3) a clear communication plan that requires formal and documented communications between appropriate program offices and OCFO to ensure the validation results are used to update the grant accrual methodology and subsequent period’s estimate, as appropriate.

Develop and document internal procedures to ensure the OCFO’s responsibilities specified within the new or updated grant accrual validation policy are addressed.

Develop and implement procedures to ensure that planning for the CPD grant accrual validation is done early in the accounting cycle to allow for: • Sufficient resources to be available to perform the validation of the prior year grant accrual. • Validation efforts to start earlier to allow for follow-up on non-responsive grantees or grantees that provided incomplete information. • Materiality risk to be considered when planning and evaluating the CPD grant accrual validation.

Revise CPD Validation Review Instructions to specify documentation requirements similar to those provided to the grantee and specify verification of dates for when the costs were incurred.

As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.

Establish a formal policy addressing HUD’s federal awarding agency responsibilities under 2 CFR § 200.513(c). The policy should identify those involved in the process and their roles in addressing this single audit oversight function. The policy should also address how it will be carried out and documented.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

HUD has made steady progress in building its Fraud Risk Management program. In FY 2024, HUD received Congressional approval to establish the Office of the Chief Risk Officer (OCRO). With its Fraud Risk Management Policy in place since 2022, OCRO worked with the HUD Risk Management Council to develop the Department’s approach and establish a cross-functional approach for Fraud Risk Management program accountability. The CRO also completed a fraud risk exposure assessment method that enables the Department to provide a risk-based approach to prioritize program fraud risk assessments and a department-level Fraud Risk Management Playbook to align HUD’s cross-functional activities and accountability to the GAO Fraud Risk Framework and CFO Council practices. The CRO is also working on tools and templates that are being customized for HUD program offices to help them complete their fraud risk assessments. Priority program offices are targeted to complete fraud risk assessments in 2025.

Analysis

While HUD has made progress in the area of fraud risk management, there is still work to be done for HUD to complete an entity-wide fraud risk assessment. HUD's exposure analysis will help it to determine where to focus its efforts. The Department still needs to conduct program-specific fraud risk assessments. Based on the demonstration by Multifamily Housing (MFH), we believe that MFH has made great progress in its fraud risk assessment, and we are encouraged that it has identified areas of weakness that it plans to target. However, Public and Indian Housing (PIH) and Community Planning and Development (CPD) have not been able to demonstrate progress in this area. We believe that the tools and templates the OCRO is developing, along with the continued support, will help PIH and CPD to complete these assessments.

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy, and that each HUD program office has established office-specific risk programs.

Develop and implement a procedure to collect and analyze reported suspected instances of fraud, along with other relevant data points, that can be leveraged to develop more robust antifraud risk mitigation tools.

Communicate to HUD program staff the differences between HUD’s enterprise risk management, PIIA, and financial risk management risk assessment processes to ensure an understanding of their roles and responsibilities within HUD’s fraud risk management program.

Develop and implement activities to raise awareness of fraud, such as participating in organized antifraud conferences or a newsletter that includes instances of recent fraud in Federal programs.

Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.

Collaborate with the Chief Risk Officer to conduct a workforce assessment to determine the level of dedicated full-time staff resources needed by the Chief Risk Officer to effectively (1) administer HUD’s enterprise and fraud risk management programs and (2) support program risk officers by increasing employee and stakeholder awareness of potential fraud schemes that could impact each program respectively.

If the workforce assessment determines that additional staff are needed, work with the Chief Risk Officer to staff the necessary positions.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

To address this recommendation, OLHCHH agreed to:

• Issue a notice to assisted target housing owners and public housing agencies on the de minimis exception citing the correct application of the de minimis threshold; describing appropriate documentation methods for the application of the de minimis threshold; and recommendations of best practices for documenting applications.
• Collect additional data regarding the use of the de minimis threshold, including information on how private and public housing owners: (a) determine how much paint in target housing will be disturbed during a maintenance or rehabilitation project; (b) use the paint disturbance area information; (c) monitor the amount of paint disturbed in projects that are designed to disturb de minimis amounts of paint in target housing.
• Design and conduct webinars, including at least one for each program office’s major categories of stakeholders on requirements and best practices pertaining to the de minimis exception under the Lead Safe Housing Rule and its implementation; record the webinars on the HUD website (e.g., on HUD Exchange) for future viewing by stakeholders; and conduct outreach promoting the webinars

The Office of Lead Hazard Control and Healthy Homes had drafted guidance on the de minimis exception to the Lead Safe Housing Rule for PIH, Multifamily Housing, and CPD and submitted it through the clearance process on September 26, 2024, with an October 9, 2024, due date. Through October 17, six concurring comments were received as was one non-concurring comment. The OLHCHH continues to revise the draft guidance in consideration of the comments. In May 2023, HUD published a final rule establishing a new approach to defining and assessing housing quality: The National Standards for the Physical Inspection of Real Estate. Public Housing regulations were amended, and Public Housing program participants were required to comply with this final rule and use the NSPIRE standards starting July 1, 2023. The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. As of November 2024, PIH reported that inspections have had a slow start due to procurement delays. Additionally, the NSPIRE system did not get the requested functionality to collect lead inspections. The final action target date is March 31, 2025.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has implemented the three actions OLHCHH agreed to complete.

Implementation of this recommendation and associated corrective actions will ensure assisted property owners are sufficiently informed regarding the requirements to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule and that assisted property owners are conducting this work safely, thereby ensuring households are residing in safe and healthy HUD-assisted housing.

In collaboration with all involved program offices, develop and implement a sampling methodology that allows for a sample size that reasonably allows for the testing of the complete payment cycle within the PIIA reporting timeframe.

Consult with OMB on the appropriate reporting for the untested portions of the payment cycle (such as reporting as unknown) and report accordingly.

Implement a procedure, which ensures that future improper and unknown payment testing that does not test the full payment cycle is reported in accordance with OMB’s guidance.