We audited the U.S. Department of Housing and Urban Development’s (HUD) management procedures, practices, and controls related to the Recovery Act Management and Reporting System (RAMPS). Our objective was to assess its capability to record and provide data required by the American Recovery and Reinvestment Act of 2009 on which HUD is required to report.
Overall, RAMPS had the capability to record Recovery Act data and produce the reports necessary for HUD to comply with the Recovery Act reporting requirements. However, we identified areas in which vulnerabilities existed. These vulnerabilities could compromise the validity of the information that is required to be disclosed to the public.
We recommend that the Office of the Chief Information Officer ensure that (1) reports required by the Recovery Act are accurate and complete, (2) access controls over RAMPS adequately protect Recovery Act data that are required to be disclosed to the public, and (3) the RAMPS technical problem reporting process is limited to a single point of contact.