The OIG evaluated the U.S. Department of Housing and Urban Development (HUD) Office of Housing’s (Housing) progress in applying zero trust security principles to protect personally identifiable information (PII) within the Federal Housing Administration (FHA) Catalyst system.HUD was in the beginning stages of implementing zero trust requirements for the data and identity pillars. HUD Office of Housing systems, including FHA Catalyst, are…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to assess the…

As of January 2024, 85 percent of HUD employees had approved telework agreements, and 9 percent had approved remote work agreements.  HUD estimated that 31 percent of remote employees were remote as a reasonable accommodation.  Most of HUD’s remote workers served in a limited number of occupations.  We evaluated the Office of the Chief Human Capital Officer’s (OCHCO) controls over the quality of data related to remote work…

 The Geospatial Data of 2018 (the Act) governs the collection, production, acquisition, maintenance, distribution, use, and preservation of geospatial data of covered agencies, including the U.S. Department of Housing and Urban Development (HUD).  We audited the U.S. Department of Housing and Urban Development’s (HUD) efforts to meet the geospatial data requirements stated in the Act.  The Act requires the Inspector General of a…

We reviewed the Puerto Rico Department of Housing’s (PRDOH) Electrical Power System Enhancements and Improvements programs to provide (1) background and funding information, (2) an update on the status of the programs and their progress, and (3) other relevant program information for interested stakeholders including Congress and the public. The U.S. Department of Housing and Urban Development (HUD) provided its grantee, PRDOH, $1.93…

HUD did not comply with PIIA because it did not report improper and unknown payment estimates for the Office of Public and Indian Housing’s Tenant-Based Rental Assistance (PIH-TBRA) program and the Office of Multifamily Housing Programs’ Project-Based Rental Assistance (PBRA) program, HUD’s largest rental assistance programs.  This noncompliance is significant because this is the seventh consecutive year in which HUD has been unable to…

We audited the Puerto Rico Housing Finance Authority’s (PRHFA) Homebuyer Assistance Program (HBA), which provides eligible applicants with closing costs and downpayment assistance for the purchase of a primary residence.  The U.S. Department of Housing and Urban Development (HUD) provided its grantee, the Puerto Rico Department of Housing (PRDOH), $495 million in Community Development Block Grant Disaster Recovery funds for HBA Our…

In January 2017, HUD awarded the City $141.2 million in Community Development Block Grant National Disaster Resilience grant funding for disaster resilience. HUD designed the grant to give states flexibility in planning program activities and help state and local communities recover from past disasters, while also improving their infrastructure to withstand future extreme events through strategic community investments.  The City initially…

The U.S. Department of Housing and Urban Development’s (HUD) Office of the Chief Human Capital Officer (OCHCO) and the Office of Departmental Equal Employment Opportunity (ODEEO) both have responsibilities related to increasing the percentage of employees who identify as Hispanic or Latino.  HUD provides an Annual Equal Employment Opportunity Program Status Report, also known as the Annual Management Directive 715 Report (MD-715), to the U…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to assess the…

Retention is a shared responsibility between the U.S. Department of Housing and Urban Development’s (HUD) Office of the Chief Human Capital Officer (OCHCO) and HUD’s other program offices.  OCHCO sets the departmentwide retention strategy, while the program offices have responsibility for managing retention within their offices.  Our evaluation determined that HUD’s departmentwide retention strategy in fiscal years (FY) 2019-2022…

We have completed our fiscal year (FY) 2023 Federal Information Security Modernization Act of 2014 (FISMA) penetration test and vulnerability assessment.  The objective of this evaluation was to test and verify the technical implementation of a limited set of security controls on judgmentally selected U.S. Department of Housing and Urban Development (HUD) information systems and applications.HUD demonstrated successes in securely…

From 2001 to 2022, the Community Development Block Grant - Disaster Recovery program provided almost $98 billion to states, cities, counties, and territories to help them recover from disasters.  Administering disaster recovery has been a recurring U.S. Department of Housing and Urban Development (HUD) top management challenge since 2018.  Therefore, we audited the disaster recovery program to determine whether the Office of Community…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on HUD’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters, including whether financial management systems complied substantially with the…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of Ginnie Mae as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on Ginnie Mae’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with CLA required that the audit be performed…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of FHA as of and for the fiscal years ended September 30, 2023 and 2022, and to provide reports on FHA’s (1) internal control over financial reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other matters.  Our contract with CLA required that the audit be performed in accordance…

We audited the Puerto Rico Department of Housing’s (PRDOH) fraud risk management practices to assess the maturity of its antifraud efforts.  HUD heavily relies on its grantees to detect and prevent fraud, waste, and abuse and PRDOH is HUD’s second largest Community Development Block Grant Disaster Recovery and Mitigation (CDBG-DR and CDBG-MIT) grantee with over $20 billion in block grant funding.  Our objective was to assess PRDOH’s…

We performed an audit examining HUD’s efforts to prevent duplication of benefits when using Community Development Block Grant (CDBG) Disaster Recovery and Mitigation funds.  Our objective was to determine how the U.S. Department of Housing and Urban Development (HUD) assesses the adequacy of grantee procedures to prevent a duplication of benefits, both before and after grant execution. HUD certified grantees’ high-level processes for…

We performed an audit related to the U.S. Department of Housing and Urban Development’s (HUD) Disaster Recovery Data Portal.  The Disaster Recovery Data Portal is a technological solution planned by HUD to facilitate the rapid and secure transmission of data from the Federal Emergency Management Agency (FEMA) to HUD’s Community Development Block Grant Disaster Recovery grantees.  We performed the work because HUD needs a solution to…

We selected the State of California’s 2018 disaster owner-occupied rehabilitation and reconstruction program to audit after an internal risk assessment of disaster grantees showed the grant was newer and had not yet disbursed the majority of its funding.  The State received more than $1 billion for the 2018 disasters.  Our audit objective was to determine what the State is considering and to what extent resilience-based mitigation…