We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that untimely FFRs are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery implement quality control procedures to ensure that HUD staff completes the action plan and QPR checklists.

We recommend that the Chief Procurement Officer update HUD’s field service manager contract monitoring plan and FSM qualitative monitoring databases used to monitor contractor performance to align with the QASP and contractual requirements as noted in recommendation 1G below.

We recommend that the Deputy Assistant Secretary for Public Housing and Voucher Programs enhance SEMAP or develop a new performance measurement process that would identify PHAs with underperforming HCV Programs, which should include an assessment of PHAs’ ability to maximize assistance to house families.

We recommend that the Deputy Assistant Secretary for Field Operations provide training and guidance to field office program staff on SEMAP scoring, rating, and verification procedures, including confirmatory reviews, quality control reviews, and adjustments, as appropriate, for the revised SEMAP process.

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.

In conjunction with corrective actions being taken on previous audits, revise ONAP’s internal policy and procedures to include detailed written policies and procedures for the marketing, preservation, and sale of defaulted loan notes and REO properties on tribal trust and other restricted lands.

Require the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine the cost to eliminate or control the lead-based paint and lead based paint hazards in public housing and the timeframe to complete such work based on the existing funding levels and strategies that could accelerate the timeframe.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to assess the lead-based paint hazard reduction activities performed at the 19 developments associated with 18 public housing agencies reviewed that did not implement interim controls and ongoing maintenance and reevaluation activities or adequately document that previously identified lead-based paint had been abated or treated with interim controls and subjected to ongoing maintenance and reevaluation activities. If those reduction activities did not fully abate the lead-based paint, HUD should ensure that the public housing agencies implement interim controls and ongoing maintenance and reevaluation programs and maintain required documentation.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to a. quantify and aggregate security risks, b. normalize cybersecurity risk information across organizational units, and c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Use the fraud risk inventory to enhance program-specific fraud risk assessments for the TBRA and Operating Fund programs.