Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner. 

Corrective Action

HUD’s Office of Multifamily Housing created procedures to identify failed inspections and notify the appropriate field office that a property in their portfolio had recently failed inspection. The procedures included a timeline for issuing a Notice of Violation/Notice of Default to the owner of the property. Implementation of the recommendation ensures that multifamily property owners are notified of deficiencies in a timely manner to take corrective actions.

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Corrective Action

HUD’s Office of Multifamily Housing updated the language in the template document to be used in future notices of violation and default, clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project. Specifically, HUD notified all Asset Management Division Directors informing them of the updates to the templates and instructed them to use the templates. The implementation of this recommendation has the potential to positively and directly impact the health and safety of families.

Develop and implement a nationwide inspection review protocol, which includes but is not limited to (1) whether field office staff should mark verification of PHA corrections of life-threatening deficiencies in PASS or any future tracking systems, (2) acceptable documentation for offsite verifications, and (3) whether field office staff should discuss or verify corrections of non-life-threatening deficiencies.

Corrective Action Taken

HUD's Office of Field Operations (OFO) created a protocol describing how it would perform quality control reviews of field office oversight of PHAs’ corrections of life-threatening deficiencies. The implementation of this recommendation resulted in HUD creating a protocol that established consistency in the way HUD field office staff monitored public housing agencies’ corrections of life-threatening deficiencies.

Develop and implement training for field offices that addresses reviewing or following up with PHAs about the correction of life-threatening and non-life-threatening deficiencies and how (1) to review physical inspection reports to effectively ensure that PHAs correct physical deficiencies, (2) PHAs should address or correct each type of deficiency observed in the REAC physical inspection report, and (3) to use PASS or any future tracking system.

Corrective Action Taken

HUD developed and provided training to the field offices on their roles and responsibilities for following up with PHAs on the correction of life-threatening and non-life-threatening deficiencies observed during REAC inspections, the NSPIRE system and standards, protocols, and timelines for deficiency correction and verification. Implementation of the recommendation will help HUD to ensure that field office staff are clear on their roles and responsibilities to communicate with PHAs on how deficiencies should be addressed and verify that PHAs’ inspection deficiencies have been corrected.

Implement a system to track field office inspection review activities and create a repository for the support documentation collected to verify the correction of life-threatening deficiencies.

Corrective Action Taken

HUD’s Office of Field Operations (OFO) had created a quality assurance tracker as well as a life-threatening deficiency tracker, which contained data specific to the inspections selected by OFO HQs, for quality assurance reviews. The documentation (photographs, work orders, etc.) of the life-threatening deficiency correction was maintained in HUD’s NSPIRE Salesforce system.

Implementation of the recommendation resulted in HUD creating a system to track HUD field offices’ verifications of PHAs’ corrections of life-threatening deficiencies.

Update its policy and procedures to define its authority for marketing troubled issuer portfolios and the conditions that must exist to extinguish issuers using rapid relocation.

Corrective Action Taken

As of February 2024, HUD addressed this recommendation in a Management Decision by providing the updated extinguishment SOP, the Rapid Relocation Process Flow, and the Rapid Relocation Extinguishment Process Steps, updated to include the conditions that must be present to execute an extinguishment using rapid relocation. We believe that these guidance enhancements will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policy and procedures to define what type of information Ginnie Mae may disclose and how it will handle protected information before extinguishment.

Corrective Action Taken

Ginnie Mae provided the updated SOP to clarify data and information handling through all phases of the termination/extinguishment process. Specifically, the updated procedures state that Ginnie Mae does not disclose Issuer or portfolio information within the Rapid Relo process. Ginnie Mae provided clarity in this enhancement that will reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its Policies and procedures to define how Ginnie Mae will determine the portfolio value and price before Sale.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to specify the valuation model for rapid relocations will use the same valuation models as other extinguishment options, including examples of portfolio valuation. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to require an Impact Analysis Evaluation of each prospective buyer under the Rapid Relocation Extinguishment program. The Impact Analysis Evaluation mirrors similar activities performed on select standard Pool Transfer participants and includes details (such as adjusted net worth, delinquency, loan court and total unpaid principle balance) to confirm prospective buyers are able to absorb the extinguished portfolio before executing the purchase and sale agreement. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties.

Corrective Action Taken

In November 2022, FHA published the Acceptance of Private Flood Insurance for FHA-Insured Mortgages final rule (Docket No. FR-6084-F-02) in the Federal Register and issued Mortgagee Letter 2022-18, Acceptance of Private Flood Insurance for FHA-Insured Mortgages (ML 2022-18). These policy changes not only strengthened Single Family’s Mortgagee requirements regarding flood insurance, but they also introduced the ability for borrowers and Mortgagees to purchase private flood insurance. In January 2023, the sections in ML 2022-18 that pertain to HUD’s forward mortgage programs were superseded by the FHA Single Family Housing Policy Handbook (Handbook 4000.1), adding a requirement that the Mortgagee review all FHA-insured properties annually to determine if the property is located within a Special Flood Hazard Area (SFHA). For properties located within a SFHA, the Mortgagee must ensure flood insurance is in force for the life of the mortgage and that the property has sufficient flood insurance coverage. To ensure compliance with the policy requirements, the Mortgagee must include updated flood insurance information for properties where flood insurance is required in the Servicing and Claims File. In addition, Handbook 4000.1 includes flood insurance servicing policy updates. HUD submitted a revised management decision reflecting this action on June 22, 2023.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations. 

Corrective Action

HUD finalized its Supply Chain Risk Management (SCRM) policy in April 2025, which utilizes a SCRM questionnaire to assess each vendor’s supply chain risk, and identifies and prioritizes risks accordingly.  HUD’s SCRM program team manages a supply chain risk register which records prior and current vendors, and those that have undergone risk assessments to maintain visibility into its upstream suppliers and track changes over time.  HUD also used multiple tools such as supply chain risk criteria and sourcing research and market analysis to evaluate vendors and strengthen protection of the supply chain during acquisition.  By implementing these procedures, as well as, having HUD’s program management team conducting annual and quarterly performance reviews for all vendors, HUD ensures contractors are meeting their contractual obligations.

Update its policies and procedures for tracking expenditures related to slow-spending grantees, including steps for assisting the grantees to expedite spending (including the grantee’s steps or actions to address slow spending), identifying the reasons for the delays with the grant, and documenting the outcome of its efforts.

Corrective Action Taken

CPD updated guidance addressing grantee slow spending through technical assistance, including actions grant managers can take when grantee expenditures do not appear to be “on pace” to meet the expenditure deadlines, and demonstrated it is providing technical assistance to grantees during monitoring. CPD also issued an additional Standard Monitoring Findings and Corrective Actions Guide for its staff to promote a consistent framework for crafting monitoring findings and the corrective actions needed to resolve identified deficiencies and prevent future occurrences. This new resource provides general guidance and examples for presenting Finding components in monitoring reports for fourteen topics including, “Failure to Meet Timeliness of Expenditures Requirements.

Establish and implement a plan for the unused and unfunded vouchers to mitigate or prevent additional vouchers from becoming unused and unfunded […]

Corrective Action Taken

HUD established and implemented a plan for the unused and unfunded vouchers, aiming to mitigate or prevent additional vouchers from becoming unused and unfunded. PIH's plan included the following, among other actions:

• Determining the scope of HUD's statutory and regulatory authority to offset and reallocate vouchers.
• Issuing Office of Public and Indian Housing Notice 2020-29, titled Guidance for Running an Optimized Housing Choice Voucher Program.
• Continuing the work of HUD's landlord taskforce, engaging in listening sessions with major PHA industry groups, and conducting outreach to increase landlord participation in the HCV Program.
• Developing research by HUD's Office of Policy Development and Research on the best methods for adjusting fair market rents and addressing specific challenges in local communities to increase utilization in the HCV Program.

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Corrective Action Taken

OCHCO developed and implemented client profiles for each HUD program office to address knowledge loss and the need for offices to explain or reexplain their mission and functions. The profiles will serve as a central repository to learn about the various programs and missions of HUD and will allow OCHCO staff, other key HUD program office staff, and HUD’s service provider staff to view critical information for each HUD program office.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Develop and issue a departmentwide policy that notes that radon is a radioactive substance and outlines HUD's requirements to test for and mitigate excessive radon levels in accordance with 24 CFR 50.3(i)(1) and 58.5(i)(2)(i).

Corrective Action Taken

None Given.

In April 2024, HUD OIG met with HUD OCIO to discuss progress and requirements for closure of this recommendation. In addition, OIG reviewed this recommendation as part of the annual FY 2024 FISMA evaluation in April 2024 and learned from HUD OCIO that that there would be a procedure update that would implement the ingestion and monitoring of all inbound and outbound traffic. The OIG requested to be provided with these procedures when finalized and evidence of implementation on May 1, 2024.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Ensure that its staff appropriately determines exemptions from the Lead Safe Housing Rule and documents support of the determinations.

Corrective Action Taken

In June 2023, HUD publicly issued Notice 2023-16, Implementation of National Standards for the Physical Inspection of Real Estate (NSPIRE) Administrative Procedures, providing guidance covering the process and operational requirements for HUD’s public housing programs that clarifies for its staff (1) actions that should be taken by the PHA and (2) documentation that must be provided to support that a housing unit is exempt from the Lead Safe Housing Rule. The guidance describes the process that a PHA or property owners and/or agents must take when a NSPIRE inspection identifies deteriorated paint in a property or housing unit. Specifically, the PHA or property owners and/or agents should first verify that the property or housing unit is considered “target housing,” and if so, determine whether it is exempt from the Lead Safe Housing Rule. If an exemption applies, documentation such as, a lease or other residency agreement that affirms that the property is designated exclusively for occupancy by the elderly or persons with disabilities must be provided to HUD. Other residency agreements could include a HUD-approved designated housing plan, property deed or charter, or occupancy restrictions approved by HUD or the PHA’s board of commissioners. The PHA or property owners and/or agency must also affirm whether children under the age of 6 years reside in the property.

Ensure that its staff determines whether a child under 6 years of age resides in an exempted development. If a child is determined to reside in an exempted development take appropriate actions in accordance with its internal policies

Corrective Action Taken

The Office of Field Operations (OFO) updated the Lead-Based Paint Response Tracker’s Standard Protocol and Roles and Responsibilities to identify the roles and responsibilities of HUD’s headquarters and field office level staff in ensuring PHAs’ compliance with the Lead Safe Housing Rule (LSHR). The protocol provides that the OFO field office staff work directly with PHAs to resolve issues of noncompliance with the LSHR and other Lead-based paint (LBP) guidance by responding to or escalating questions/issues to the headquarters team, directing PHAs to available training and resources on HUD.gov or HUD Exchange, and working with PHAs to obtain sufficient documentation to close an LBP case in the LBP tracker promptly. In regards to a child under 6 years of age residing in an exempted development, staff from the field offices must upload supporting documentation determining whether a pregnant lady or child six years old or younger lives in the development, collect missing information, if applicable, coordinate with OFO team to close cases in the LBP response tracker, indicate in the LBP response tracker if the PHA has provided the documents or if the property is exempt and upload supporting documents.

Enforce the requirement for all HUD web applications and services to be approved by the CIO and ensure OCIO reviews and approves all IT contracts and services agreements dealing with creation or support of web applications or services.

Corrective Action Taken

In January 2023, HUD's Office of the Chief Information Officer developed and released a Web Applications Directive to all HUD program offices. This directive described how web applications are defined, approved, inventoried, and maintained, including processes for tracking, and monitoring such applications.