The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations. 

Corrective Action

HUD finalized its Supply Chain Risk Management (SCRM) policy in April 2025, which utilizes a SCRM questionnaire to assess each vendor’s supply chain risk, and identifies and prioritizes risks accordingly.  HUD’s SCRM program team manages a supply chain risk register which records prior and current vendors, and those that have undergone risk assessments to maintain visibility into its upstream suppliers and track changes over time.  HUD also used multiple tools such as supply chain risk criteria and sourcing research and market analysis to evaluate vendors and strengthen protection of the supply chain during acquisition.  By implementing these procedures, as well as, having HUD’s program management team conducting annual and quarterly performance reviews for all vendors, HUD ensures contractors are meeting their contractual obligations.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Ensure that future policies and guidance developed to return HUD’s offices to normal operations include the specific criteria, metrics, and defined geographic area to be used by all offices as applicable.

Develop and implement sufficient policies and controls to ensure that (1) applicable criteria in any future guidance are met and all safety measures are sufficiently completed before returning HUD’s offices to normal operations and (2) sufficient documentation is maintained to support that the applicable criteria were met.

We recommend that HUD’s Deputy Assistant Secretary for Public Housing and Voucher Programs update its compliance monitoring guidance to include a requirement for personnel to review PHAs reasonable accommodations policies and procedures.

We recommend that HUD’s Deputy Assistant Secretary for Public Housing and Voucher Programs update and consolidate requests for reasonable accommodation policies and procedures to ensure that there is centralized guidance available for the field offices and PHAs.

We recommend that HUD’s Deputy Assistant Secretary for Public Housing and Voucher Programs require that PHAs track requests for reasonable accommodation, including the date of the request, the type of request, and the disposition and date of any action taken that should be made available to HUD at its request.

We recommend that HUD’s Deputy Assistant Secretary for Public Housing and Voucher Programs review the joint agreement between HUD PIH and FHEO, including the Section 504 checklist, and modify, update, or recommit to it to ensure that the role of PIH and the responsibility for conducting civil rights front-end reviews is clearly defined.

We recommend that HUD’s Deputy Assistant Secretary for Public Housing and Voucher Programs ensure that personnel receive training on how to conduct the civil rights front-end reviews, including a review of PHAs reasonable accommodation policies and procedures.

Develop and implement policies and procedures to ensure that subgrantee agreements are executed in a timely manner, effective monitoring is performed, and subgrantees maintain an emphasis on using their CoC funds, thereby preventing similar occurrences of $3.5 million (see appendix D) in CoC funding going unused.

Develop and implement strategies to address capacity and organizational problems or obtain technical assistance to address these issues.

Develop and implement procedures and controls to clearly define and update point-of-contact staff for subgrantees.

Work with HUD and subgrantees to reevaluate its CoC program’s performance goals and set targets that help to ensure that funds for future CoC grants are fully and effectively used to advance the goal of ending homelessness.