Work with the prime award recipients that had subaward reporting deficiencies to ensure that their subaward information is reported or reported accurately.

Update and expand the guidance on FFATA subaward reporting requirements provided to prime award recipients by (1) updating program website(s) with comprehensive information about FFATA, (2) implementing training, (3) issuing formal communication, and (4) implementing a feedback mechanism to ensure that all prime award recipients have the opportunity to share challenges with HUD and ask questions.

Integrate FFATA reporting requirements into program monitoring procedures for all programs and conduct regular reviews to assess compliance.

Ensure that programs with subaward activity include specific clauses related to FFATA compliance in their grant agreements, and notices of funding opportunities.

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.

Status

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives had been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to PBRA, HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024.

However, our ongoing Payment Integrity Information Act audit has determined that neither program produced a compliant estimate in fiscal year 2024. For multifamily-PBRA, HUD made some progress and reported an estimate that captured part of the payment cycle; however, the estimate did not include testing to ensure that housing assistance payments from contract administrators to owners were calculated correctly and supported by tenant-level documentation. The PIH-TBRA program did not produce an estimate at all, noting that IT system modernization must occur first. However, PIH has not yet provided a plan that indicates how the system upgrades will address this issue or a timeline for implementation. As of January 31, 2025, a detailed plan or timeline has not been provided.

Analysis

As of January 31, 2025, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce a complete estimate of the PBRA programs in future years, and when it will be able to produce an estimate for PIH-TBRA.

For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.

PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $50 billion in FY 24, or 62.4 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the Annual Financial Report.

Implementation of this recommendation will result in HUD better-safeguarding taxpayer dollars and decrease improper payments.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

Ensure there are resources available for further development of geocoding services that fulfill HUD’s responsibilities stated in 43 U.S.C. § 2808(a)(5) and 43 U.S.C. § 2808(a)(12) through the reactivation of the lapsed Geocode Service Center contract.

Take appropriate actions to prioritize the need for resources necessary to ensure that HUD fully implements the remaining four responsibilities as required by sections 759(a)(1), 759(a)(2), 759(a)(4), and 759(a)(5) of the Geospatial Data Act of 2018.

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $54,909 in 13 administrative obligations marked for deobligation as of September 30, 2018

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $279,282 in 11 administrative obligations marked for deobligation as of September 30, 2017.