Implement a process to collect and maintain information about recruitment efforts related to indiviuals who identify as Hispanic or Latino from all HUD program offices and their respective field offices.

We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance. Status In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and…

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely…

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project. Status HUD will update the Notice of…

Develop and implement adequate policies, procedures, and controls to ensure that owner certifications and surveys and other relevant documents related to properties that fail inspections or are noted as having EHS deficiencies are maintained and retrievable from an easily accessible location.

Develop and implement adequate controls to ensure that HUD staff with the appropriate level of authority approves extensions to the notices of violation and default cure periods in writing and that documentation is maintained to support such approvals.

Modify the queries used to generate the schedules of properties that accompany the reports to Congress to consider a larger range of dates to ensure that properties that failed consecutive inspections are appropriately identified on all applicable schedules.

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

Implement adequate procedures and controls to ensure that documentation is maintained to support that the reports were submitted to Congress.

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Housing should include zero trust requirements as part of the Housing Strategic Roadmap for Housing Modernization.

Housing should refine access controls within the FHA Catalyst modules that are dynamic, are tailored to user actions, and require continuous reauthentication to ensure that users have access only to information needed.

Housing should coordinate with HUD’s SOC to a. Ensure that FHA Catalyst user behavior monitoring logs are regularly captured and adequately reviewed for discrepancies in user activities. b. Establish program office responsibility for the log review process.  

Issue guidance to PHAs clarifying the timing of unit inspections and lead-based paint visual assessments to address the misinterpretation caused by the terms “annual” and “every 12 months.”

We recommend that the Chief Financial Officer enhance existing policies to establish a formal grant accrual risk management framework to help ensure consistent standards across HUD with regard to the development, review, and execution of the grant accrual and validation. This framework should include 1) identifying grant accrual estimation risk, assessing the magnitude of this risk, and managing the risks that arise when using certain…

We recommend that the Deputy Assistant Secretary for Operations of Community Planning and Development enhance CPDs existing Grant Accrual Standard Operating Procedures to strengthen governance within CPD and to effectively work within the framework established by the OCFO in recommendation 1A. The updated procedures should include increased ownership and oversight over the reviews, authorizations, approvals, and changes to the CPD grant…

Update selection rules for CAIVRS to provide for complete reporting of all ineligible borrowers to put $9.5 million to better use. Status In 2020, HUD suspended reporting delinquencies and defaults to the Credit Alert Verification Reporting System (CAIVRS) because these debts are owed to the lender and are not delinquent Federal debt. A debt is not delinquent until a payment is past due to HUD for a deficiency judgment against…

Update the Conveyance, Assignment, and Assumption Agreement to require purchasers to report final property outcomes and identifying information including those of third-party purchasers when applicable.