HUD OCIO should update its enterprisewide business impact prioritization analysis procedures to include system dependencies and the characterization of system components (IG FISMA metric 61).

We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.

Status

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives had been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to PBRA, HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024.

However, our ongoing Payment Integrity Information Act audit has determined that neither program produced a compliant estimate in fiscal year 2024. For multifamily-PBRA, HUD made some progress and reported an estimate that captured part of the payment cycle; however, the estimate did not include testing to ensure that housing assistance payments from contract administrators to owners were calculated correctly and supported by tenant-level documentation. The PIH-TBRA program did not produce an estimate at all, noting that IT system modernization must occur first. However, PIH has not yet provided a plan that indicates how the system upgrades will address this issue or a timeline for implementation. As of January 31, 2025, a detailed plan or timeline has not been provided.

Analysis

As of January 31, 2025, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce a complete estimate of the PBRA programs in future years, and when it will be able to produce an estimate for PIH-TBRA.

For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.

PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $50 billion in FY 24, or 62.4 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the Annual Financial Report.

Implementation of this recommendation will result in HUD better-safeguarding taxpayer dollars and decrease improper payments.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the Deputy Assistant Secretary instruct PRDOH to implement a process to regularly conduct fraud risk assessments and determine a fraud risk profile. The fraud risk profile should include key findings and conclusions from the risk assessment, including the analysis of the types of fraud risks, their perceived likelihood and impact, risk tolerance, and the prioritization of risks.

We recommend that the Deputy Assistant Secretary for Grant Programs evaluate PRDOH’s risk exposure and tolerance as part of HUD’s program-specific fraud risk assessment for disaster grant programs.

We recommend that the Deputy Assistant Secretary for Grant Programs coordinate with HUD’s Chief Risk Officer to (1) provide training and technical assistance to PRDOH with a focus on the design, implementation, and performance of fraud risk assessments, and (2) establish a fraud risk management framework for the organization.

We recommend that the Deputy Assistant Secretary for Grant Programs assess whether grantees have mature fraud risk management programs within the disaster recovery and mitigation programs.

We recommend that the Deputy Assistant Secretary for Grant Programs determine the fraud risk exposure in HUD's disaster recovery and mitigation programs and work with grantees to implement appropriate fraud mitigation activities.

We recommend that the Director, Office of Disaster Recovery, perform monitoring of or otherwise review grantees’ detailed procedures for preventing duplication of benefits for each grant activity within the first year after HUD signs the grant agreement or before grantees process applications for assistance, whichever occurs first.

We recommend that the Director, Office of Disaster Recovery, develop and implement a process to review grantees’ detailed procedures for preventing duplication of benefits and require grantees to correct any deficiencies identified in the review before grantees process applications for assistance.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

We recommend that the Deputy Assistant Secretary work with the Authority to assess the risk of potential improper payment for projects PW273 and PW100 and vouchers 576322, 583423, and 578761.

We recommend that the Deputy Assistant Secretary instruct the Authority to train the CMU staff on the newly developed policies and procedures and obtain technical assistance from HUD as needed.

HUD (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered into on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendations. Additionally, HUD has not completed several of the proposed actions and is still collecting information that responds to the recommendations.

Analysis

To fully address this recommendation, HUD must (a) identify all contracts related to its programs that pre-date July 1, 2013, and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.