We recommend that HUD require the City to support or repay, from nonfederal funds, $5,078 in the square footage overcharge for work not completed, according to the project design and invoice documentation.

We recommend that HUD require the City to provide supporting documentation for the 4 program participants that did not have adequate income documentation. If the supporting documentation cannot be provided, repay, from nonfederal funds, $99,347.

We recommend that HUD require the City to since the property updates have been completed for the 24 program participants that did not receive the green infrastructure training, provide documentation that any subsequent program participants completed the green infrastructure training workshop before the grant agreement is signed and construction begins.

Develop comprehensive guidance and training for grantees on how to prepare the PR 29 report to ensure that the information collected is reliable, accurate, timely, and in compliance with the Uniform Administrative Guidance for Grants and Cooperative Agreements, specifically 2 CFR 200.302(a)(b) and 2 CFR 200.303

Follow up with the four grantees without adequate supporting documentation and assess their compliance with the financial management requirements in 2 CFR 200.302(b)(3), which require the financial management system of each non-Federal entity to provide for records that adequately identify the source and application of funds for federally funded activities.

Update the CPD Monitoring Handbook to incorporate the review of the PR 29 report when performing financial monitoring reviews.

Develop written procedures on how to review PR 29 report submissions and monitor resubmissions, late submissions, and nonsubmissions.

Evaluate and update IDIS to ensure that resubmissions of PR 29 reports are tracked and prior submissions are preserved and correct the system’s misclassification of unsubmitted and uncertified draft PR 29 reports as submitted.

Determine how often grantees’ requests for reimbursement contain cost outside the quarter and in coordination with OCFO, evaluate CPD’s grant accrual methodology and assumptions to ensure that it adequately considers the impact of these late cost reimbursements.

Develop guidance that encourages grantees to draw down funds for reimbursement on a regular schedule, not less than quarterly.

Work with OCFO to ensure that CPD collects and reports to OCFO all of the information needed to properly account for all CPD activities in HUD’s financial statements in accordance with Federal financial reporting requirements and accounting standards.

Update Line 4 - Cash (grant funds) disbursed during the reporting period in the PR 29 report to allow grantees to report all CDBG grant funds disbursed, including funds that have not yet been drawn down from HUD for reimbursement.

Obtain the required approvals under PRA for the PR 29 report.

HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should update its software inventory policies and procedures to account for critical software as defined by EO 14028 (IG FISMA metrics 3 and 21).

HUD OCIO should implement policies and procedures to maintain inventories of critical software and software licenses, critical software platforms, and all software installed on critical software platforms (both critical software and noncritical software) and use the inventory of critical software platforms and all software installed on them to ensure that only supported versions of software are used on those critical software platforms (IG FISMA metrics 3 and 21).

HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)

HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).