Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Update HUD regulations, policies, and procedures following the regulatory process required by the amended Lead Safe Housing Rule, in consideration of CDC's lowered BLRV of 3.5 ug/dL.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Require the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations.

Update its policies and procedures for tracking expenditures related to slow-spending grantees, including steps for assisting the grantees to expedite spending (including the grantee’s steps or actions to address slow spending), identifying the reasons for the delays with the grant, and documenting the outcome of its efforts.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Establish and implement a plan for the unused and unfunded vouchers to mitigate or prevent additional vouchers from becoming unused and unfunded […]

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Corrective Action Taken

The  Federal Housing Administration (FHA) Resource Center fields complaint calls and directs them to the appropriate party. When a FHA Resource Center complaint is referred to the Multifamily Regional Office, it is entered into the Asset Management Processing System (AMPS), the workload tracking system for HUD’s Multifamily Programs, within one day of receipt and tracked to completion with a goal of resolution within 21 days of receipt.  If a complaint is categorized as health and safety, it is prioritized for expeditious response by the assigned Account Executive.  Multifamily Field and Regional management track responses, to ensure resolution.  This includes having the Account Executives, at times, call the resident to confirm the issue has been resolved.  Based upon process as described HUD OIG concurred with the closure of this priority recommendation.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

The Office of Multifamily Housing has not yet updated its policies and procedures for the intake, monitoring, and tracking of health and safety complaints.  HUD was in the process of developing an automated monitoring system in the FHA resource center to allow tracking of individual calls and the call’s subject, such as health and safety.  HUD missed the final action target date of December 31, 2022, and a new completion goal was set for February 2025.  In July 2025, HUD sought closure for this recommendation due to unavailability of funds.  HUD stated that its issuance of policies and procedures for a comprehensive process was contingent on the development of a tracking system for the complaint process, for which it has repeatedly requested funding from Congress to no avail. As of January 2026, OIG is in the process of collaborating with HUD on finding a potential corrective action to resolve outstanding concerns.

Analysis

To fully address this recommendation, HUD must provide evidence that it has developed and implemented policies and procedures for the Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives when using the FHA’s automated monitoring system.

Implementation of this recommendation will result in HUD having a more efficient process for taking in, monitoring, and tracking health and safety complaints and aid HUD in more efficiently addressing those complaints.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Develop and issue a departmentwide policy that notes that radon is a radioactive substance and outlines HUD's requirements to test for and mitigate excessive radon levels in accordance with 24 CFR 50.3(i)(1) and 58.5(i)(2)(i).

Corrective Action Taken

None Given.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

HUD previously reported that it was implementing a software management tool with an expected implementation date of quarter 2 of FY 2025; however, between quarter 2 and 3 of FY 2025, HUD personnel has stated that the tool would not meet the agency’s needs.  Accordingly, HUD is looking at a new tool to implement this program and collaborating with the DHS continuous diagnostics and monitoring team to analyze options. As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address this recommendation, the Office of Multifamily Housing must provide evidence of an action plan or policy that includes procedures to ensure households living in multifamily units have a sufficient supply of safe drinking water.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing have a sufficient supply of safe drinking water.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems.  In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide.  HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool.  This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.  As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address the recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Nonprivileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems.  In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide. HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool.  This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.  As of January 2026, HUD has not provided an estimated completion date.

Analysis

To fully address this recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution.  Privileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

As of January 2026, the Office of Multifamily has developed standard operating procedures for its field office staff and plans to issue additional guidance to HUD staff and multifamily property owners on addressing lead in the water for multifamily properties.  Although the final action target date has passed, the guidance is undergoing HUD's internal review clearance process.  HUD did not provide an estimated date for issuance of the guidance to close the recommendation.

Analysis

To fully address this recommendation, the Office of Multifamily Housing must provide evidence of an action plan or policy that includes procedures to ensure households living in multifamily units have a sufficient supply of safe drinking water.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing have a sufficient supply of safe drinking water.