We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks.  RPA is a software technology used to emulate human actions on a computer.  RPA software programs, referred to as “bots,” can complete repetitive tasks quickly and consistently, freeing up employees to work on other, higher…

We audited the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) infrastructure to support mandatory telework. During mandatory telework, more employees simultaneously needed remote access to HUD’s network and agency resources for an extended period, which presented unique risks and security requirements. While HUD is no longer operating under mandatory telework, understanding the challenges it faced is key to…

The Federal Information Security Modernization Act of 2014 (FISMA) requires all Federal agencies to conduct independent penetration tests and vulnerability assessments on a sampling of information systems annually.  In conjunction with our fiscal year 2022 FISMA evaluation (2022-OE-0001), we conducted a targeted penetration test and vulnerability assessment of sample systems that resulted in a Topic Brief.  The objective of this…

The Inspector General Act of 1978 requires the Inspector General to prepare semiannual reports summarizing the activities of the Office of Inspector General for the preceding six-month period. The semiannual reports are intended to keep the Secretary and Congress fully informed of significant findings, progress the Agency has made, and recommendations for improvement. Open Recommendations Office of Audit Office of Evaluation…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on HUD’s 1) internal control over financial reporting; and 2) compliance with laws, regulations, contracts, and grant agreements and other matters, including whether financial management systems complied substantially with the…

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of Ginnie Mae as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on Ginnie Mae’s 1) internal control over financial reporting; and 2) compliance with laws, regulations, contracts, and grant agreements and other matters. Our contract with CLA required that the audit be performed in…

We audited the U.S. Department of Housing and Urban Development’s (HUD) Title VIII complaint intake data and jurisdictional determinations recorded in the HUD Enforcement Management System (HEMS).  We initiated this audit to assist HUD with identifying opportunities to improve its data collection and jurisdiction determination process.  Our audit objective was to assess HUD’s Title VIII fair housing complaint intake process for…

As part of a Council of the Inspectors General on Integrity and Efficiency (CIGIE) Disaster Assistance Working Group cross-cutting initiative, we summarized the conclusions, findings, and recommendations of 28 reports related to the Federal Government’s natural disaster preparedness and response issued by 7 Offices of Inspector General (OIGs).  The seven participating OIGs included U.S. Departments of Defense, Health and Human Services…

In coordination with the Pandemic Response Accountability Committee, we conducted an audit to identify potential fraud schemes that could affect HUD’s pandemic funds.  We reviewed the funds appropriated by the Coronavirus Aid, Relief, and Economic Security (CARES) Act and the American Rescue Plan (ARP) Act for the Tenant-Based Rental Assistance (TBRA), Project-Based Rental Assistance (PBRA), HOME Investment Partnerships, and Public Housing…

“According to the Centers for Disease Control and Prevention (CDC), lead-based paint and lead-contaminated dust are some of the most widespread and hazardous sources of lead exposure for young children in the United States.  When lead-based paint peels and cracks, it results in lead-contaminated paint chips and dust.  Children can be poisoned if they chew on surfaces coated with lead-based paint, eat flaking paint chips, or eat or…

We completed a corrective action verification (CAV) of recommendations from prior Office of Inspector General (OIG) audit reports on the U.S. Department of Housing and Urban Development’s (HUD) government purchase cards and government travel cards, both issued January 31, 2020. During our CAV, we followed up on all 10 recommendations from OIG audit report 2020-KC-0001 and all 13 recommendations from OIG audit report 2020-KC-0002. Our CAV…

We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2021 compliance with the Payment Integrity Information Act of 2019 (PIIA) and implementation of Office of Management and Budget (OMB) guidance.  PIIA was enacted to prevent and reduce improper payments and require each agency’s inspector general to perform an annual review of the agency’s compliance with PIIA.  Our objectives were to assess (1) whether…

Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties. Corrective Action Taken In November 2022, FHA published the Acceptance of Private Flood Insurance for FHA-Insured Mortgages final rule (Docket No. FR-6084-F-02) in the Federal Register and issued Mortgagee Letter 2022-18,…

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program.  FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to assess…

The Federal Information Security Modernization Act of 2014 (FISMA) requires all federal agencies to conduct independent security technical verification testing on a sampling of information systems annually.  In conjunction with our fiscal year 2021 FISMA evaluation (2021-OE-0001), we conducted a targeted security testing assessment of sample systems that resulted in a Topic Brief.  The objective of this application vulnerability…

We reviewed the U.S. Department of Housing and Urban Development’s (HUD) ability to effectively complete information technology (IT) acquisitions.  HUD’s IT systems and its modernization plans depend heavily on contractors, yet HUD has historically faced significant challenges with implementing effective acquisition processes. Therefore, HUD’s acquisition capacity represents a key potential risk within HUD’s IT environment. We found that a…

On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security (CARES) Act made available $5 billion in supplemental CDBG funding for grants to prevent, prepare for, and respond to the coronavirus pandemic (CDBG-CV grants).  Because of similarities, we reviewed 132 CDBG-DR program audits and evaluations issued from May 2002 to March 2020 to summarize the common CDBG-DR program weaknesses and risks for CPD to consider to help its CDBG…

While some of HUD’s efforts to improve its hiring and human capital functions and reduce its average time-to-hire have been successful, HUD’s hiring process overall was not efficient.  HUD’s Office of the Chief Human Capital Officer (OCHCO), which is responsible for developing and implementing policies and procedures associated with human capital management, set a goal to reduce the average time-to-hire but did not meet this goal. …

We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2020 compliance with the Payment Integrity Information Act of 2019 (PIIA) and other Office of Management and Budget guidance.  PIIA was enacted to prevent and reduce improper payments and requires each agency’s inspector general to perform an annual review of the agency’s compliance with PIIA.  Our audit objective was to determine whether HUD complied…

HUD does not have a departmentwide policy for dealing with radon contamination.  Instead, HUD relies on each program office to develop radon policies that align with HUD’s environmental regulations.  The three program offices reviewed do not have consistent radon policies.  Only Multifamily’s radon policy includes radon testing and mitigation requirements.  PIH’s policy strongly encourages but does not require public housing…