Determine the appropriate timeframe for when initial MORs should be completed for all properties that convert under RAD and issue updated guidance that includes a system to track the timeliness of initial MORs.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Failure to determine the timing of the initial MORs could delay HUD's performance of the MORs, which may result in property owners' untimely corrective actions, and thus potentially impact the health and safety of families.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Complete the initial MORs for RAD properties that have not had an initial MOR.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Completing initial MORs would assist HUD in holding property owners accountable for maintaining the conditions of their properties and sufficient reserve for replacement accounts balances, which could impact property owners' ability to make needed capital repairs.

The recommended corrective action has the potential to directly impact the health and safety of families.

Develop and implement a plan to determine how to implement the risk-based approach to review the RAD properties that have not had subsequent MORs in more than 3 years and to require periodic MORs going forward.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Developing a plan to implement the risk-based approach would establish the criteria for identifying properties that are at a higher risk of noncompliance.

The recommended corrective action would help HUD to monitor property owners' compliance with its requirements and thus, potentially protect families from living in unsafe units.

Determine an appropriate timeframe in which non-FHA-insured PBRA properties converted under RAD should be initially inspected, work with REAC to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Determining the appropriate timeframe for initial inspections would result in the timely identification and correction of life-threatening and non-life-threatening deficiencies.

The recommended corrective action has the potential to directly impact the health and safety of families.

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner.

Status

HUD has implemented a process of sending notifications to the field offices' centralized inboxes when a failed inspection has been released with instructions to issue a Notice of Default or Notice of Violation within 15 days. The field office logs this task into the Asset Management Processing System (AMPS) and assigns it to an Account Executive. Field office management tracks the progress of the task in AMPS. HUD is building a reporting tool to see if the task has been properly entered into iREMS and addresses the field office instances where it has not. The construction of this tool has been delayed due to limited staff resources. As of January 2025, the reporting tool was undergoing review and testing prior to implementation. The final action target date was November 29, 2024.

Analysis

Implementing procedures and controls for the timely issuing of notices would ensure that property owners are held accountable for correcting life-threatening deficiencies in a timely manner thus reducing the risk of families living in units that are unsafe for longer periods.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Status

HUD will update the Notice of Default and Notice of Violation in conjunction with updates related to NSPIRE. These updates have been delayed by limited staff resources and pending policy clarifications and system changes for NSPIRE.

The final action target was November 29, 2024.

Analysis

The inclusion of language in the notices would ensure that property owners are aware of their responsibilities to inspect all units, common areas, grounds, building systems, and sites and perform repairs of identified deficiencies to protect families from living in units that are not decent, safe, and sanitary.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.

Status

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives had been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to PBRA, HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024.

However, our ongoing Payment Integrity Information Act audit has determined that neither program produced a compliant estimate in fiscal year 2024. For multifamily-PBRA, HUD made some progress and reported an estimate that captured part of the payment cycle; however, the estimate did not include testing to ensure that housing assistance payments from contract administrators to owners were calculated correctly and supported by tenant-level documentation. The PIH-TBRA program did not produce an estimate at all, noting that IT system modernization must occur first. However, PIH has not yet provided a plan that indicates how the system upgrades will address this issue or a timeline for implementation. As of January 31, 2025, a detailed plan or timeline has not been provided.

Analysis

As of January 31, 2025, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce a complete estimate of the PBRA programs in future years, and when it will be able to produce an estimate for PIH-TBRA.

For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.

PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $50 billion in FY 24, or 62.4 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the Annual Financial Report.

Implementation of this recommendation will result in HUD better-safeguarding taxpayer dollars and decrease improper payments.

HUD (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered into on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendations. Additionally, HUD has not completed several of the proposed actions and is still collecting information that responds to the recommendations.

Analysis

To fully address this recommendation, HUD must (a) identify all contracts related to its programs that pre-date July 1, 2013, and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Seek voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendations. Additionally, HUD has not completed several of the proposed actions and is still collecting information that responds to the recommendations.

Analysis

To fully address this recommendation, HUD must provide evidence that it has sought voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Use its best efforts to include a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendations. Additionally, HUD has not completed several of the proposed actions and is still collecting information that responds to the recommendations.

Analysis

To fully address this recommendation, HUD must provide evidence that it has taken steps to ensure that it includes a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Develop and implement a nationwide protocol for field offices, describing how PHA self-inspections should be reviewed, based on REAC's determination of the number and frequency of PHA self-inspections.

Status

HUD closed this recommendation in August 2024, an action which HUD OIG disagrees with. HUD provided guidance for field office staff to send to PHAs with NSPIRE inspections that scored below 60 points. However, HUD did not provide a protocol detailing how it would receive and review PHAs’ self-inspections for compliance with HUD requirements. Therefore, HUD has not fully addressed the gap in controls identified in the audit that hinders HUD’s oversight over PHA self-inspections.

Analysis

To fully resolve this recommendation, HUD needs to provide a policy or procedure that provides guidance to the field offices on how public housing self-inspections should be reviewed for compliance with its requirements.

Implementation of this recommendation will result in public housing units that are decent, safe, and sanitary because it mandates oversight to ensure PHAs are addressing identified deficiencies.

Implement adequate policies, procedures, and controls to ensure that public housing properties will be inspected within required timeframes.

Status

NSPIRE regulations clarified and modified the timing for which inspections should occur. The date for inspection of each public housing property must then be programmed into HUD's system to ensure that inspections occur within the required timeframes. The Real Estate Assessment Center (REAC) continues to work with its management and system support contractors on the list of public housing properties to inspect and the date the inspections should be completed under the new NSPIRE regulations. REAC is in the process of adjusting the list based on information relating to small, rural public housing. As of November 2024, the NSPIRE regulations on inspection timing are completed. However, REAC is not able to make the required modifications in the NSPIRE system to enforce the regulatory guidelines. REAC previously indicated that new IT funding is needed to make the system modifications but had not provided information about whether additional funding has been allocated. The final action target date was revised from May 31, 2024, to September 30, 2025.

Analysis

To fully address this recommendation, HUD must provide evidence demonstrating that it has implemented control activities that ensure public housing properties are inspected within the required timeframes.

Implementation of this recommendation will result in HUD accurately tracking the dates on which public housing properties should be inspected and that they are timely completed. Due to the uncertainty of when software changes to NSPIRE can take place to enforce the timing of inspections, REAC cannot enforce the requirements of inspection timing.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

As of November 13, 2024, the PIH Office of Field Operations (OFO) had completed its outreach data collection and identified 9 public housing authorities that had not completed the required EBLL reporting actions and that OFO informed the field office directors overseeing the appropriate PHAs that they had until November 6, 2024, to upload the proper information to the trackers. As of January 29, 2025, OFO field office directors and their staff were still updating and inputting EBLL cases and relevant documentation into the EBLL tracker due to delays in responses from PHAs. The estimated completion date is February 28, 2025.

Analysis

To fully address this recommendation, OFO must provide evidence that it coordinated with other HUD offices and identified the causes of the variances in the number of EBLL cases among states on the EBLL tracker. OFO must also demonstrate that it fully remedied the causes of the variances. Alternatively, OFO must provide an explanation sufficient to support a claim that it could not identify the causes of the variances or develop and implement solutions for problems it identified in its research.

Implementation of this recommendation will result in improved HUD data of EBLL cases of children living in public housing across the country. Accurate reporting of EBLL cases to HUD is essential so that HUD can ensure PHAs take effective environmental interventions that help prevent additional lead exposure.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

On January 17, 2025, the Office of Lead Hazard Control and Healthy Homes (OLHCHH) informed HUD OIG that the Office of the Federal Register published a notice, Modifying HUD’s Elevated Blood Lead Level Threshold for Children Under Age 6 Who Are Living in Certain HUD-Assisted Target Housing Covered by the Lead Safe Housing Rule. The notice announced that HUD is lowering its EBLL threshold from 5 to 3.5 µg/dL for a child under the age of 6, consistent with the CDC’s current blood lead reference value of 3.5 µg/dL, effective January 17, 2025. Next, OLHCHH will assist the Office of Community Planning and Development, the Office of Multifamily Housing Programs, and the Office of Public and Indian Housing to draft, circulate, and publish EBLL notices. The estimated completion date is June 30, 2025.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered blood lead reference value of 3.5 ug/dL.

Implementation of this recommendation will help ensure children living in public housing with elevated blood lead levels receive effective environmental interventions.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

HUD has made steady progress in building its Fraud Risk Management program. In FY 2024, HUD received Congressional approval to establish the Office of the Chief Risk Officer (OCRO). With its Fraud Risk Management Policy in place since 2022, OCRO worked with the HUD Risk Management Council to develop the Department’s approach and establish a cross-functional approach for Fraud Risk Management program accountability. The CRO also completed a fraud risk exposure assessment method that enables the Department to provide a risk-based approach to prioritize program fraud risk assessments and a department-level Fraud Risk Management Playbook to align HUD’s cross-functional activities and accountability to the GAO Fraud Risk Framework and CFO Council practices. The CRO is also working on tools and templates that are being customized for HUD program offices to help them complete their fraud risk assessments. Priority program offices are targeted to complete fraud risk assessments in 2025.

Analysis

While HUD has made progress in the area of fraud risk management, there is still work to be done for HUD to complete an entity-wide fraud risk assessment. HUD's exposure analysis will help it to determine where to focus its efforts. The Department still needs to conduct program-specific fraud risk assessments. Based on the demonstration by Multifamily Housing (MFH), we believe that MFH has made great progress in its fraud risk assessment, and we are encouraged that it has identified areas of weakness that it plans to target. However, Public and Indian Housing (PIH) and Community Planning and Development (CPD) have not been able to demonstrate progress in this area. We believe that the tools and templates the OCRO is developing, along with the continued support, will help PIH and CPD to complete these assessments.

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy, and that each HUD program office has established office-specific risk programs.

Requires the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

In May 2023, HUD published a final rule establishing a new approach to defining and assessing housing quality: The National Standards for the Physical Inspection of Real Estate. Public Housing regulations were amended, and Public Housing program participants were required to comply with this final rule and use the NSPIRE standards starting July 1, 2023. The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. As of November 2024, PIH reported that inspections have had a slow start due to procurement delays. Additionally, the NSPIRE system did not get the requested functionality to collect lead inspections. The final action target date is March 31, 2025.

Analysis

To address this recommendation, HUD will need to provide evidence that it collected and evaluated data under NSPIRE and estimated the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.

Implementation of this recommendation will assist HUD in working with PHAs to address the public housing units that contain lead-based paint and lead-based paint hazards and help HUD’s oversight of units in need of hazard reduction.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

To address this recommendation, OLHCHH agreed to:

• Issue a notice to assisted target housing owners and public housing agencies on the de minimis exception citing the correct application of the de minimis threshold; describing appropriate documentation methods for the application of the de minimis threshold; and recommendations of best practices for documenting applications.
• Collect additional data regarding the use of the de minimis threshold, including information on how private and public housing owners: (a) determine how much paint in target housing will be disturbed during a maintenance or rehabilitation project; (b) use the paint disturbance area information; (c) monitor the amount of paint disturbed in projects that are designed to disturb de minimis amounts of paint in target housing.
• Design and conduct webinars, including at least one for each program office’s major categories of stakeholders on requirements and best practices pertaining to the de minimis exception under the Lead Safe Housing Rule and its implementation; record the webinars on the HUD website (e.g., on HUD Exchange) for future viewing by stakeholders; and conduct outreach promoting the webinars

The Office of Lead Hazard Control and Healthy Homes had drafted guidance on the de minimis exception to the Lead Safe Housing Rule for PIH, Multifamily Housing, and CPD and submitted it through the clearance process on September 26, 2024, with an October 9, 2024, due date. Through October 17, six concurring comments were received as was one non-concurring comment. The OLHCHH continues to revise the draft guidance in consideration of the comments. In May 2023, HUD published a final rule establishing a new approach to defining and assessing housing quality: The National Standards for the Physical Inspection of Real Estate. Public Housing regulations were amended, and Public Housing program participants were required to comply with this final rule and use the NSPIRE standards starting July 1, 2023. The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. As of November 2024, PIH reported that inspections have had a slow start due to procurement delays. Additionally, the NSPIRE system did not get the requested functionality to collect lead inspections. The final action target date is March 31, 2025.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has implemented the three actions OLHCHH agreed to complete.

Implementation of this recommendation and associated corrective actions will ensure assisted property owners are sufficiently informed regarding the requirements to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule and that assisted property owners are conducting this work safely, thereby ensuring households are residing in safe and healthy HUD-assisted housing.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

The Office of the Chief Information Officer (OCIO) estimated it would complete corrective action for this recommendation by August 2023. In May 2024, HUD OIG reviewed the OCIO progress in closing this recommendation as part of the FY 2024 FISMA evaluation. At that time, OCIO provided its draft SCRM Policy, draft SCRM Procedures, final SCRMES Charter, and a SCRM Technical Roadmap. Additionally, HUD provided agency-specific clauses. As of January 2025, HUD has not issued finalized SCRM policies and procedures.

Analysis

To fully address this recommendation, HUD must establish that it has defined and communicated policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements.

Implementation of this recommendation will result in HUD continuing to mature in supply chain risk management, establishing and defining the policies and procedures of SCRM requirements as they relate to systems and system components.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

The Office of the Chief Procurement Officer (OCPO) had agreed to an estimated completion date of March 2024. In November 2024, OCPO submitted additional evidence for closure; however, the evidence did not identify how the revisions to the process will address efficiency issues. The OIG requested further information that identifies improvements in the IT acquisition process.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in defined IT acquisition process workflow procedures to increase efficiency and ensure coordination across program offices.