Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties.

Corrective Action Taken

In November 2022, FHA published the Acceptance of Private Flood Insurance for FHA-Insured Mortgages final rule (Docket No. FR-6084-F-02) in the Federal Register and issued Mortgagee Letter 2022-18, Acceptance of Private Flood Insurance for FHA-Insured Mortgages (ML 2022-18). These policy changes not only strengthened Single Family’s Mortgagee requirements regarding flood insurance, but they also introduced the ability for borrowers and Mortgagees to purchase private flood insurance. In January 2023, the sections in ML 2022-18 that pertain to HUD’s forward mortgage programs were superseded by the FHA Single Family Housing Policy Handbook (Handbook 4000.1), adding a requirement that the Mortgagee review all FHA-insured properties annually to determine if the property is located within a Special Flood Hazard Area (SFHA). For properties located within a SFHA, the Mortgagee must ensure flood insurance is in force for the life of the mortgage and that the property has sufficient flood insurance coverage. To ensure compliance with the policy requirements, the Mortgagee must include updated flood insurance information for properties where flood insurance is required in the Servicing and Claims File. In addition, Handbook 4000.1 includes flood insurance servicing policy updates. HUD submitted a revised management decision reflecting this action on June 22, 2023.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

The Office of the Chief Information Officer (OCIO) estimated it would complete corrective action for this recommendation by August 2023. In May 2024, HUD OIG reviewed the Office of the Chief Information Officer’s (OCIO) progress in closing this recommendation as part of the FY 2024 FISMA evaluation. At that time, OCIO provided its draft SCRM Policy, SCRM Procedures, SCRMES Charter, and a SCRM Technical Roadmap. Additionally, HUD provided agency-specific clauses. As of November 2024, the guidance had not yet been finalized.

Analysis

To fully address this recommendation, HUD must establish that it has defined and communicated policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements.

Implementation of this recommendation will result in HUD continuing to mature in supply chain risk management, establishing and defining the policies and procedures of SCRM requirements as it relates to systems and system components.

Update its policies and procedures for tracking expenditures related to slow-spending grantees, including steps for assisting the grantees to expedite spending (including the grantee’s steps or actions to address slow spending), identifying the reasons for the delays with the grant, and documenting the outcome of its efforts.

Corrective Action Taken

CPD updated guidance addressing grantee slow spending through technical assistance, including actions grant managers can take when grantee expenditures do not appear to be “on pace” to meet the expenditure deadlines, and demonstrated it is providing technical assistance to grantees during monitoring. CPD also issued an additional Standard Monitoring Findings and Corrective Actions Guide for its staff to promote a consistent framework for crafting monitoring findings and the corrective actions needed to resolve identified deficiencies and prevent future occurrences. This new resource provides general guidance and examples for presenting Finding components in monitoring reports for fourteen topics including, “Failure to Meet Timeliness of Expenditures Requirements.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

The Office of the Chief Procurement Officer (OCPO) had agreed to an estimated completion date of March 2024. In November 2024, OCPO submitted additional evidence for closure; however, the evidence did not identify how the revisions to the process will address efficiency issues. The OIG requested further information that identifies improvements in the IT acquisition process.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in a defined IT acquisition process workflow standard operation procedure to ensure coordination across program offices.

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Corrective Action Taken

HUD established and implemented a plan for the unused and unfunded vouchers, aiming to mitigate or prevent additional vouchers from becoming unused and unfunded. PIH's plan included the following, among other actions:

• Determining the scope of HUD's statutory and regulatory authority to offset and reallocate vouchers.
• Issuing Office of Public and Indian Housing Notice 2020-29, titled Guidance for Running an Optimized Housing Choice Voucher Program.
• Continuing the work of HUD's landlord taskforce, engaging in listening sessions with major PHA industry groups, and conducting outreach to increase landlord participation in the HCV Program.
• Developing research by HUD's Office of Policy Development and Research on the best methods for adjusting fair market rents and addressing specific challenges in local communities to increase utilization in the HCV Program.

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Corrective Action Taken

OCHCO developed and implemented client profiles for each HUD program office to address knowledge loss and the need for offices to explain or reexplain their mission and functions. The profiles will serve as a central repository to learn about the various programs and missions of HUD and will allow OCHCO staff, other key HUD program office staff, and HUD’s service provider staff to view critical information for each HUD program office.

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Status

In October 2023, the Office of Multifamily Housing reported that it had sought funding for system enhancements to coordinate tenant complaints. HUD is transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The FHA Resource Center has a system that will allow tracking and monitoring of customer calls. As of November 2024, the Office of Multifamily Housing requested closure of this recommendation because it did not receive requested funding for system enhancements, and its alternative action of using the FHA Resource Center to track and monitor customer calls did not work. HUD OIG will work with the Office of Multifamily on understanding the existing challenges and discuss alternative actions to address the recommendation.

Analysis

To fully address this recommendation, HUD needs to develop a comprehensive process to ensure that complaints received by HUD are resolved in a timely manner.

Implementation of this recommendation will result in timelier resolution of complaints submitted by those living in multifamily member housing units.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

In October 2023, HUD stated that it will develop policies and procedures for Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives. The Office of Multifamily Housing has not yet updated its policies and procedures. With no comprehensive, automated, real-time system in place, there was no direction to give the field staff, Multifamily Clearinghouse, or the Performance Based Contract Administrators other than what they were already doing. HUD was in the process of developing an automated monitoring system in the FHA resource center to allow tracking of individual calls and the call’s subject, such as health and safety. HUD missed the final action target date of December 31, 2022, and a new completion goal was set for February 2025. As of November 2024, the Office of Multifamily Housing requested closure of this recommendation because it did not receive requested funding for system enhancements, and its alternative action of using the FHA Resource Center to track and monitor customer calls did not work. HUD OIG will work with the Office of Multifamily on understanding the existing challenges and discuss alternative actions to address the recommendation.

Analysis

To fully address this recommendation, HUD must provide evidence that it has developed and implemented policies and procedures for the Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives when using the FHA’s automated monitoring system.

Implementation of this recommendation will result in HUD having a more efficient process for taking in, monitoring, and tracking of health and safety complaints and aid HUD in more efficiently addressing those complaints.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

HUD OCIO provided evidence of an IT Modernization Strategy with an established framework that aligns with the IT modernization roadmap. The strategy includes all of the requirements of the recommendation and is accessible to HUD employere's through OCIO’s internal website.

For the MF-RAP, PIH-TRA, and CPD-HIM programs, ensure that the program's improper payments rate estimates adequately test for and include improper payments of Federal funding that are made by State, local, and other organizations administering these programs and adequately disclose any limitations imposed or encountered when reporting on improper payments, to a degree that fairly informs users of the respective reported information.

Status

This recommendation remained closed per HUD; however, we continue to identify this as a priority open recommendation because HUD continues to be challenged to fully implement this recommendation. Due to this, HUD OIG issued a management alert to the HUD Deputy Secretary entitled "Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments", on January 23, 2024. In response to the alert, HUD is working on a plan to address the challenges encountered by the OCFO and bring the Department into compliance. Part of this plan should include information about how the Department plans to address this recommendation. As of November 2024, we have not received a plan from the Department on how they are addressing this matter.

Analysis

To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the Annual Financial Report.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

In April 2024, the Office of the Chief Information Officer reported that it was in the process of implementing a software management tool that would allow it to control which software is authorized to access the network. This is the first step to create rules for allowing only authorized software to be used through HUD's endpoint security software. Final implementation of this new tool is expected by Quarter 2 of FY 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has an automated whitelist and implement as per the NIST Special Publication 800-167 or accept the risk and document mitigating measures via a Risk Based Decision memorandum.

Implementation of this recommendation will result in HUD having the capability to ensure only authorized software is used on HUD’s network based on its software asset listing.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide.

Analysis

To fully address the recommendation, HUD must implement multifactor authentication enterprisewide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide.

Analysis

To fully address this recommendation, HUD must implement the eICAM plan it developed with the funding it received.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Develop and implement an action plan that includes sufficient policies, procedures, and controls that address households living in multifamily housing units having a sufficient supply of safe drinking water […]

Status

In April 2022, HUD created draft standard operating procedures to address lead in the water of its multifamily housing units. On May 11, 2023, HUD published its NSPIRE regulations that addressed lead in the water. Further, on June 30, 2023, HUD published its Implementation of National Standards for the Physical Inspection of Real Estate Administrative Procedures, which requires property owners and agents to provide information about water supply provider and water safety alerts, if applicable, prior to the commencement of a REAC inspection. As a result, the Office of Multifamily Housing is revising its procedures and consulting with the Office of Lead Hazard Control and Healthy Homes (OLHCHH). As of November 2024, OIG was waiting for additional information from the Office of Multifamily Housing demonstrating whether it has addressed the recommendation.

Analysis

To fully address this recommendation, the Office of Multifamily Housing must provide evidence of an action plan that includes its procedures that address households living in multifamily housing units to ensure that they have a sufficient supply of safe drinking water.

Implementation of this recommendation will enable HUD to have sufficient oversight and control activities in place to ensure households living in multifamily housing units have a sufficient supply of safe drinking water.

HUD Office of the Chief Information Officer (OCIO) should finish developing the procedures for the HUD Security Operations Center (SOC) to monitor all inbound and outbound traffic and all HUD network devices.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Ensure that its staff appropriately determines exemptions from the Lead Safe Housing Rule and documents support of the determinations.

Corrective Action Taken

In June 2023, HUD publicly issued Notice 2023-16, Implementation of National Standards for the Physical Inspection of Real Estate (NSPIRE) Administrative Procedures, providing guidance covering the process and operational requirements for HUD’s public housing programs that clarifies for its staff (1) actions that should be taken by the PHA and (2) documentation that must be provided to support that a housing unit is exempt from the Lead Safe Housing Rule. The guidance describes the process that a PHA or property owners and/or agents must take when a NSPIRE inspection identifies deteriorated paint in a property or housing unit. Specifically, the PHA or property owners and/or agents should first verify that the property or housing unit is considered “target housing,” and if so, determine whether it is exempt from the Lead Safe Housing Rule. If an exemption applies, documentation such as, a lease or other residency agreement that affirms that the property is designated exclusively for occupancy by the elderly or persons with disabilities must be provided to HUD. Other residency agreements could include a HUD-approved designated housing plan, property deed or charter, or occupancy restrictions approved by HUD or the PHA’s board of commissioners. The PHA or property owners and/or agency must also affirm whether children under the age of 6 years reside in the property.

Ensure that its staff determines whether a child under 6 years of age resides in an exempted development. If a child is determined to reside in an exempted development take appropriate actions in accordance with its internal policies

Corrective Action Taken

The Office of Field Operations (OFO) updated the Lead-Based Paint Response Tracker’s Standard Protocol and Roles and Responsibilities to identify the roles and responsibilities of HUD’s headquarters and field office level staff in ensuring PHAs’ compliance with the Lead Safe Housing Rule (LSHR). The protocol provides that the OFO field office staff work directly with PHAs to resolve issues of noncompliance with the LSHR and other Lead-based paint (LBP) guidance by responding to or escalating questions/issues to the headquarters team, directing PHAs to available training and resources on HUD.gov or HUD Exchange, and working with PHAs to obtain sufficient documentation to close an LBP case in the LBP tracker promptly. In regards to a child under 6 years of age residing in an exempted development, staff from the field offices must upload supporting documentation determining whether a pregnant lady or child six years old or younger lives in the development, collect missing information, if applicable, coordinate with OFO team to close cases in the LBP response tracker, indicate in the LBP response tracker if the PHA has provided the documents or if the property is exempt and upload supporting documents.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

The Office of Single Family Housing will need additional tax information from the Internal Revenue Service to complete the planned action. In July 2024, Single Family Housing proposed closing the recommendation with no action because the primary action discussed would require Congressional authorization, and another option discussed would place an undue burden on borrowers and lenders and was not practical. OIG disagreed with the request. Since delinquent tax debtors are ineligible for FHA loans under existing FHA and OMB guidelines, OIG will continue to work with Single Family Housing on a solution.

Analysis

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

Implement a change to regulations at 24 CFR Part 203 to require curtailment of preforeclosure interest and other costs that are caused by lender servicing delays, resulting in $413,513,975 in funds to be put to better use. This should include updating or seeking statutory authority to update HUD’s regulations as necessary and coordinating with HUD’s Office of Finance and Budget, well before any changes go through departmental clearance, to ensure that planned curtailment requirements can be consistently enforced through the claims process.

Status

FHA reported that the audit recommendation cannot be closed without the publication of the FHA Maximum Claim Rule. The proposed changes have been on HUD’s regulatory agenda since Spring 2020 but, as of November 2024, the Office of Single Family Housing does not have an estimated publication date.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published and adopted the rule.

Implementation of this rule should result in HUD putting $413 million to better use.

Develop a method for using the Do Not Pay portal during the underwriting process to identify delinquent child support and delinquent Federal debt to prevent future FHA loans to ineligible borrowers to put $1.9 billion to better use.

Status

The Office of Housing has approved prioritization of funding for Integration between Do Not Pay portal and CHUMS. Funding was allocated to the CHUMS IT contractor on January 26, 2024, to integrate Treasury’s Do Not Pay system with CHUMS, and the IT development project was kicked off the week of February 5, 2024. As of November 2024, the Office of Single Family Housing reported that Treasury is working on drafting the Computer Matching Agreement. Single Family plans to submit an update on the system interface project or request another extension in March 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has implemented applicant screening against the Do Not Pay portal to identify delinquent child support and delinquent Federal debt to prevent future FHA loans going to ineligible borrowers.

Implementation of this rule should result in HUD putting $1.9 billion to better use.