We audited the U.S. Department of Housing and Urban Development’s (HUD) fraud risk management program at the enterprise and program-office levels and assessed its overall maturity. Our objective was to determine HUD’s progress in implementing a fraud risk management framework at the enterprise and program-office levels that encompasses control activities to prevent, detect, and respond to fraud.
The Antifraud Playbook established by the Chief Financial Officers Council and the U.S. Department of the Treasury assess maturity of an agency’s fraud risk management program in four phases: (1) culture, (2) identifying and assessing fraud, (3) preventing and detecting fraud, and (4) turning insight into action. We found that in all four phases HUD’s fraud risk management program was in the early stages of development, or at an “ad hoc” maturity level. HUD’s program is still in its infancy because HUD had not previously dedicated sufficient resources to lead and implement fraud risk management activities.
Although HUD has recently taken steps to mature its program, HUD needs to commit resources to enhancing antifraud controls and promoting a culture of fraud risk management. Without improvements to its program, HUD may miss opportunities to identify and eliminate fraud vulnerabilities, leaving its funds and reputation at risk.
We recommend that the Chief Risk Officer (1) perform a complete agency-wide fraud risk assessment and develop a plan to improve the maturity of HUD’s fraud risk management program; (2) communicate to program staff the differences between HUD’s processes for enterprise risk management, Payment Integrity Information Act of 2019, and financial risk management risk assessment and how those processes relate to HUD’s fraud risk management program; (3) develop policies, procedures, and strategies for collecting and analyzing data to identify fraud within HUD’s programs, promote fraud awareness, and develop antifraud risk mitigation tools. We also recommend that the Chief Financial Officer determine and seek to fulfill an appropriate level of dedicated staff resources to administer HUD’s enterprise and fraud risk management programs effectively and increase fraud risk awareness and strengthen antifraud controls in HUD’s program offices.
Recommendations
Chief Financial Officer
-
Status2023-FO-0001-001-AOpenClosedPriorityPriority
We believe these open recommendations, if implemented, will have the greatest impact on helping HUD achieve its mission to create strong, sustainable, inclusive communities and quality affordable homes for all.
Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.
Status
HUD has made steady progress in building its Fraud Risk Management program. In FY2024, HUD received Congressional approval to establish the Office of the Chief Risk Officer (OCRO). With its Fraud Risk Management Policy in place since 2022, OCRO worked with the HUD Risk Management Council to develop the Department’s approach and establish a cross-functional approach for Fraud Risk Management program accountability. The CRO also completed a fraud risk exposure assessment method that enables the Department to provide a risk-based approach to prioritize program fraud risk assessments and a department-level Fraud Risk Management Playbook to align HUD’s cross-functional activities and accountability to the GAO Fraud Risk Framework and CFO Council practices. The CRO is also working on tools and templates that are being customized for HUD program offices to help them complete their fraud risk assessments. Priority program offices are targeted to complete fraud risk assessments in 2025.
Analysis
While HUD has made progress in the area of fraud risk management, there is still work to be done for HUD to complete an entity wide fraud risk assessment. HUD's exposure analysis will help it to determine where to focus its efforts. The Department still needs to conduct program specific fraud risk assessments. Based on the demonstration by MFH, we believe that MFH has made great progress in its fraud risk assessment, and we are encouraged that it has identified areas of weakness that it plans to target. However, PIH and CPD have not been able to demonstrate progress in this area. We believe that the tools and templates the OCRO is developing, along with the continued support, will help PIH and CPD to complete these assessments.
To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy and that each HUD program office has established office-specific risk programs.
-
Status2023-FO-0001-001-BOpenClosedClosed on September 30, 2024
Develop and implement a procedure to collect and analyze reported suspected instances of fraud, along with other relevant data points, that can be leveraged to develop more robust antifraud risk mitigation tools.
-
Status2023-FO-0001-001-COpenClosedClosed on September 30, 2024
Communicate to HUD program staff the differences between HUD’s enterprise risk management, PIIA, and financial risk management risk assessment processes to ensure an understanding of their roles and responsibilities within HUD’s fraud risk management program.
-
Status2023-FO-0001-001-DOpenClosedClosed on September 30, 2024
Develop and implement activities to raise awareness of fraud, such as participating in organized antifraud conferences or a newsletter that includes instances of recent fraud in Federal programs.
-
Status2023-FO-0001-001-EOpenClosed
Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.
-
Status2023-FO-0001-001-FOpenClosedClosed on September 30, 2024
Collaborate with the Chief Risk Officer to conduct a workforce assessment to determine the level of dedicated full-time staff resources needed by the Chief Risk Officer to effectively (1) administer HUD’s enterprise and fraud risk management programs and (2) support program risk officers by increasing employee and stakeholder awareness of potential fraud schemes that could impact each program respectively.
-
Status2023-FO-0001-001-GOpenClosedClosed on September 30, 2024
If the workforce assessment determines that additional staff are needed, work with the Chief Risk Officer to staff the necessary positions.