Recommendations

Open Recommendations by Oversight Area

Housing Assistance

Community Development

Disaster Recovery

Financial Risk and Accountability

Technology and Cybersecurity

Health and Safety

HUD's Operations

Priority Recommendations
Open Recommendations

View data table

Open Recommendations by Oversight Area
Oversight Area	Priority Recommendations	Open Recommendations
Housing Assistance	75	100
Community Development	3	75
Disaster Recovery	3	82
Financial Risk and Accountability	6	130
Technology and Cybersecurity	4	88
Health and Safety	1	53
HUD's Operations	4	100
Total	96	628

Filter search results using the following criteria

220 Results

Clear

We reviewed the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) modernization roadmap. A significant number of HUD’s mission-essential applications have not been modernized, which presents multiple sources of risk. These applications are hosted on legacy…

Oversight Area: HUD Business Functions

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Obtain the proper approval and communicate the IT modernization strategy to all appropriate stakeholders, including HUD program offices.

We are required to audit the consolidated financial statements of the U.S. Department of Housing and Urban Development (HUD) annually in accordance with the Chief Financial Officers Act of 1990 as amended. Our objectives were to express an opinion on the fair presentation of HUD’s consolidated…

Oversight Area: HUD Business Functions

Ensure that all of the sampled amounts used for extrapolation in OCFO grant accrual validation estimates are properly supported with documentation that substantiates the amounts certified in the surveys.

Implement a refined accrual validation methodology, to include more comprehensive review procedures to substantiate the amounts certified by the grantee.

Review CPD’s grant accrual estimation methodology to ensure that all assumptions and variables used are properly supported and verifiable with the validation procedure.

After PIH prepayment validations are completed, apply all corrections to CAM 1 codes and Voucher Management System (VMS) expenses to all of the data supporting the fiscal year 2019 beginning balance, and recalculate the fiscal year 2019 PIH prepayment estimate. Based on the recalculation, determine whether restatement is needed to the correct errors in the fiscal year 2019 estimate calculation to ensure consistency between comparative statements.

Revise its review of the PIH prepayment estimate calculations performed by contractors to ensure that the contractors are following the established methodology and any changes to the methodology are applied to the data supporting the beginning balance, if appropriate.

Review all duties currently assigned to action officials to determine which duties can be centralized within OCFO or its Federal shared service provider. For any duties that cannot be centralized, (1) provide an explanation as to why they cannot be centralized and (2) assign these duties to appropriate positions within the program offices. Further, update the Debt Collection Handbook to include any changes made as a result of the review.

Implement monitoring and control activities to ensure that all debt collection action officials perform their duties in accordance with the Debt Collection Handbook

In coordination with each program office, identify the possible debts that could arise from normal business and monitoring activities and create a listing of these scenarios. Based on this listing, implement control activities to ensure that all debts that result from these activities are considered in financial reporting, U.S. Department of the Treasury reporting, and debt collection activities.

Develop and implement a procedure that requires OCFO to identify and research all debts that are more than 120 days old to ensure (1) validity, (2) that proper debt collection efforts occur, and (3) that the status reported in the TROR is correct according to Treasury’s TROR requirements.

Review the 76 sustained audit receivables not under repayment agreement totaling $59.6 million to determine validity and ensure that debt collection procedures are followed if applicable, to include (1) issuing demand letters, (2) creating repayment agreements if appropriate, and (3) referring delinquent debt or initiating writeoffs as appropriate. For all receivables determined to be valid, ensure that they are accurately reported to Treasury in the quarterly TROR. For all receivables determined to be invalid, remove the receivables from HUD’s accounts receivable balance.

Develop and implement standard operating procedures for calculating and reporting HUD’s quarterly allowance for loss based on periodic evaluation of each type of HUD’s accounts receivables in accordance with GAAP. The procedures should also include steps to ensure proper note disclosure for significant classes of accounts receivables.

Reassess HUD’s SFFAS 50 implementation by correcting HUD’s IUS PP&E opening balance instead of the yearend balances and recognize capitalized IUS development, maintenance, and enhancement costs incurred during fiscal year 2019. If not reassessed, provide auditable documentation supporting the application of the methodology used supporting HUD’s assertion that the IUS zero balance valuation complies with SFFAS 50 and FASAB Technical Release 18 implementation guidance.

Reevaluate capitalization and useful life thresholds included in HUD’s PP&E policy to ensure that they are comparable based on HUD’s funding level and size of operations and in accordance with capitalization thresholds and useful life requirements for leasehold improvements according to SFFAS 6 PP&E.

Recognize unrecorded assets and liabilities related to leasehold improvements and make proper disclosures regarding HUD’s leasehold improvement liability in the financial statements and notes.

Collaborate with OCFO to review methodologies used to produce grant accrual estimates, to include testing and verification of the resulting accrual estimates.

Implement a procedure to periodically, not less than annually, review HUD’s funds from dedicated collections to ensure that those funds fulfill the criteria established by FASAB. Additionally, update HUD’s financial reporting standard operating procedures with this new periodic review.

Collaborate with Treasury to correct the reporting type code for the funds associated with RAD to ensure that the reporting type code within HUD’s GTAS file reflects the correct reporting type.

Update all financial statement note checklists to include a review for completeness with the accounting standards and OMB Circular A-136.

Implement information security controls over the Section 108 loan guarantee database that prevent and detect unauthorized changes to program data (or implement an updated Section 108 loan guarantee database with information security controls that prevent and detect unauthorized changes to program data).

Develop a formal enterprise risk management policy for program offices’ risk owners, including guidance for completing the annual risk profile refresh, requirements for completing risk mitigation strategies, and reporting risk mitigation progress to the Risk Management Council

Execute system code requests, including new program-level class and code, CAM 1 codes, in accordance with internal OCFO system standard operating procedures. Specifically, the CFO system code coordinator should verify that OCFO budget officers and program budget officers provide adequate documentation showing that the new CAM1 code is covered by an approved funds control matrix or sufficient justification for not requiring a funds control matrix.

Develop and implement policy and procedures for the incremental obligation process used for project-based Section 8 funds, including documentation for determining the incremental amounts and controls to review the amounts for accuracy.

Assign independent, contract officers to review and certify the initiating contract buyer’s compliance with policies for initiating and authorizing interagency agreements and later modifications for all amounts in accordance with Acquisition Instruction 13-07, HUD Contracting Officers.

Ensure that contracting officers and OCPO field offices review and follow the records management policies and procedures, including completing and signing Forms 7600A and 7600B, to ensure consistency among contract officers approving interagency agreements in the procurement system of record.

This report presents the results of our audit of Ginnie Mae’s fiscal year 2019 financial statements, including our report on Ginnie Mae’s internal control and test of compliance with selected provisions of laws, regulations, and contracts applicable to Ginnie Mae. In fiscal year 2019, we were…

Oversight Area: HUD Business Functions

Test whether a cumulative housing price appreciation (HPA) variable should be added to the probability of prepayment, probability of default, foreclosure timeline, buyout time models, and cure rate assumptions. Ginnie Mae should provide an analysis if it believes that adding an HPA variable would not be appropriate to support its position.

Develop and implement policies and procedures to require a sufficiently granular decomposition analysis that can adequately explain the impact of all the model changes made.

Develop and implement policies and procedures or enhance or clarify, as appropriate, existing policies and procedures that will require additional analyses whenever thresholds are breached or other analyses indicate potential modeling issues.

Document the economic rationale behind unintuitive model coefficients to support that the unintuitive relationships are appropriate.

Document all model assumptions that are undocumented, providing the basis for any assumptions or decisions made when developing each model assumption.

Develop and implement policies and procedures to ensure compliance with model risk management guidance regarding adequate and well-documented model assumptions.

Develop and implement controls that ensure the updating of model documentation when model changes are made.

Improve model documentation by addressing the model documentation deficiencies cited in this report and narrowing or consolidating them into fewer pieces of documentation, as appropriate.

Formalize and define coding best practices within Ginnie Mae’s model governance framework.

Apply coding best practices during model development processes and add a control for reviewing model code for compliance with best practices.

Ensure that documentation is maintained to support reimbursable cost receivables recorded on Ginnie Mae’s financial statements or write off the reimbursable costs receivables that are not valid or cannot be supported.

Establish audit trails to ensure that supporting documentation can be easily traced and verified to the recorded transactions in the general ledger.

Establish and implement remedial action plans to document the implementation testing of the effectiveness of its internal control over financial reporting in accordance with OMB Circular A-123, appendix A.

Update its internal controls descriptions to reflect controls in place and implement monitoring activities to ensure that it carries out the controls and documents their performance and results.

Resolve the issues identified with the mastersubservicers to improve the data quality and timing of the raw data received for SLDB monthly processing and minimize manual adjustments.

Modify the standing operating procedures for the SLDB data quality checks that address mastersubservicer data deficiencies, data quality rules, and severity levels, to include periodic assessments of the appropriateness of the severity levels.

Review VAPE data validation procedures to improve preventive controls to determine the reasonableness of the inbound VAPE data before SLDB processing.

Implement the planned SLDB code fixes and enhancements to reduce future manual adjustments.

We audited the Puerto Rico Department of Housing (PRDOH) in accordance with the U.S. Department of Housing and Urban Development, Office of Inspector General’s (HUD OIG) goal to review disaster funding and based on a congressional request for HUD OIG to conduct capacity reviews for Hurricanes…

Oversight Area: Disaster Relief

Develop adequate procedures outlining steps for tracking monthly grant expenditures, reprogramming funds for stalled activities, managing program income, and allocating costs as required by Federal Register Notice 83 FR 5844 and the grant agreement with HUD.

Ensure that the financial management system for the 2017 CDBG-DR grant is capable of providing information by activity type and grant number.

Develop and implement a financial management system for its 2008 CDBG-DR grant and ensure that it tracks program funds to a level that supports compliance with HUD requirements. At a minimum, the accounting system must reflect disbursements by grant, activity, and activity type and properly account for assets, liabilities, and program income.

Review and update its 2017 CDBG-DR policies and procedures to prevent duplication of benefits and ensure that these are comprehensive and all applicable activities are included, including but not limited to the Small Business Financing Program and the Construction and Commercial Revolving Loan program.

Negotiate with the SBA, within 30 days of the issuance of this audit report, to extend its data-sharing agreements for the term of the expenditure requirements set forth in public laws or the Federal Register in relation to the 2017 and 2008 disasters.

Negotiate with Puerto Rico’s Insurance Commissioner and with other CDBG-DR grantees, within 30 days of the issuance of this audit report, to establish data-sharing agreements for the 2017 CDBG-DR grant disaster, any open disaster recovery grants, and future disasters.

Complete, within 30 days of the issuance of this audit report, the review for preventing duplication of benefits associated with its 2008 CDBG-DR grant and pursue appropriate remedies for any instances of noncompliance found.

Review and update its procurement policy for the 2017 CDBG-DR grant to address weaknesses identified, including but not limited to required contract clauses, processes for soliciting and accepting noncompetitive proposals, and performing cost or price analyses before receiving bids or quotations, among other issues.

Ensure that the 2017 CDBG-DR procurement policy addresses the establishment of a contract register that, at a minimum, contains the procurement information specified in section 3.8 of HUD’s Buying Right Guide regarding the PRDOH’s acquisitions of goods and services, as well as of its subrecipients and partners.

Establish procurement policies and procedures for the 2008 CDBG-DR grant to ensure compliance with 2 CFR 200.318-326, including but not limited to procedures to ensure full and open competition, supporting independent cost estimates, properly documenting the procurement history, and including required clauses in contracts, among other issues.

Continue to fill its vacancies with qualified and trained staff, thus ensuring that staffing levels remain adequate to administer the 2017 and 2008 CDBG-DR grant funds.

Structure the internal audit division within a framework that can ensure its organizational independence and allow the internal audit activity to fulfill its responsibilities.

Provide additional training and technical assistance to the PRDOH on the development of policies and procedures to ensure that procedures comply with applicable Federal and grant requirements.

Submit supporting documentation showing that contracts and purchase orders complied with Federal and its own procurement requirements and that these were reasonable and necessary costs or reimburse the CDBG-DR program $55,010 from non-Federal funds.

Submit supporting documentation showing that contracts and purchase orders complied with Federal and its own procurement requirements and that these were reasonable and necessary costs or cancel the $361,501 in unpaid obligations related to CDBG-DR funds.

Revise and finalize the procurement procedures to ensure compliance with applicable Federal requirements, including but not limited to procedures to ensure full and open competition, supporting independent cost estimates, properly documenting the procurement history, and including required clauses in contracts, among other issues.

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of FHA as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on FHA’s 1) internal control over financial reporting; and 2) compliance with…

Oversight Area: HUD Business Functions

Establish change management and periodic reviews of control activities to ensure regulatory changes, such as Fiscal Service updates to the USSGL, are identified, analyzed, and assessed for potential needed changes to FHA’s established processes.

Establish and ensure appropriate and effective communication protocols between OFAR, FHA, and HUD’s Office of Budget to ensure (1) funding type is clearly indicated within the SF 132 and clear communications are made in differentiating between definite and indefinite borrowing authority, (2) legislative changes in FHA’s borrowing authority are vetted with OMB to ensure appropriate treatment, and (3) – draft SF-133s are reviewed and vetted with HUD and FHA’s budget officers prior to OFAR’s finalization with Treasury and OMB.

Establish internal control procedures around the borrowings process to include verifying sufficient borrowing authority exists within the SF 132, prior to executing the borrowing request. Such verification should also be included as part of the borrowing review and approval controls.

Receive a final opinion from HUD’s Office of the Chief Financial Officer’s Appropriation Law Division on whether FHA was in violation of the Antideficiency Act.

Implement procedures to enhance the review of all journal entries recorded in the general ledger by requiring a two-level review that includes the review of source documents for the journal entry (for example, the OMB approved SF 132).

Strengthen controls over the preparation of the SF 132 to the SF 133 reconciliation by preparing such reconciliations (1) first, with the unadjusted trial balance and later, with the adjusted trial balance and (2) at the fund level, with detailed documentation of differences, and with sufficient detailed explanations that describe the general ledger impact of the differences.

Perform a thorough review of the SF 132 to SF 133 reconciliations and work with Financial Analysis and Controls Division and other divisions and groups to resolve material reconciling items timely.

Coordinate with the Deputy Assistant Secretary for Single Family Housing and HUD’s Office of the Chief Procurement Office (OCPO) in developing effective communication channels between FHA’s NSC and OFAR, and in developing effective monitoring controls to ensure the timely identification and remediation of issues, such as unprocessed documentation and inaccurate records, which may impact the balances reported within FHA’s financial statements.

Develop effective detective controls to ensure HECM loan receivables are accurate and complete, exist, and FHA appropriately holds or controls the rights to any collateral property in connection with the receivable.

Develop and implement procedures to review the reasonableness of the amounts included in the Missing Documents Report before recording the reclassification entry. Include steps to be followed if the amounts in the report do not appear reasonable.

Coordinate with the NSC to take all the actions necessary required by HUD Handbook 4000.1 to ensure that FHA’s interests are protected with respect to the partial claims for which FHA has not received the original promissory note and recorded mortgage.

Coordinate with the NSC to conduct a detailed review of the HECM assigned notes portfolio to identify and record all default events that have occurred to date and initiate collection proceedings in accordance with the applicable HUD Handbooks.

Coordinate with the NSC and the OCPO to determine whether the information technology system could be enhanced to track the annual payment of state property taxes for the HECM portfolio.

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2022 and 2021, and to provide reports on HUD’s 1) internal control over financial reporting; and 2) compliance with…

Oversight Area: HUD Business Functions

Develop and issue a departmental grant accrual validation policy or update the existing grant accrual policy to include the validation process. The policy should include 1) specific control activities over the grant accrual validation and outline all of the specific roles and responsibilities; 2) a periodic review of the grant accrual validation to evaluate and reassess its continued relevance and control effectiveness, and ensure any changes are designed and implemented appropriately; and 3) a clear communication plan that requires formal and documented communications between appropriate program offices and OCFO to ensure the validation results are used to update the grant accrual methodology and subsequent period’s estimate, as appropriate.

Develop and document internal procedures to ensure the OCFO’s responsibilities specified within the new or updated grant accrual validation policy are addressed.

Develop and implement procedures to ensure that planning for the CPD grant accrual validation is done early in the accounting cycle to allow for: • Sufficient resources to be available to perform the validation of the prior year grant accrual. • Validation efforts to start earlier to allow for follow-up on non-responsive grantees or grantees that provided incomplete information. • Materiality risk to be considered when planning and evaluating the CPD grant accrual validation.

Revise CPD Validation Review Instructions to specify documentation requirements similar to those provided to the grantee and specify verification of dates for when the costs were incurred.

Develop and document internal procedures to ensure that they will address the Program Office’s responsibilities within the departmental grant accrual validation policy.

Re-evaluate and adequately document justification for the establishment of the percentages and other key assumptions used to determine the accrual amount for each program in CPD’s accrued grant liabilities estimate.

As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.

Establish a formal policy addressing HUD’s federal awarding agency responsibilities under 2 CFR § 200.513(c). The policy should identify those involved in the process and their roles in addressing this single audit oversight function. The policy should also address how it will be carried out and documented.

We audited the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) infrastructure to support mandatory telework. During mandatory telework, more employees simultaneously needed remote access to HUD’s network and agency resources for an extended period, which…

Oversight Area: HUD Business Functions

Research, evaluate, and implement technical or alternative solutions to deploy essential computer software updates using appropriate secure methods to ensure that computer security updates occur in a timely manner to minimize risk to HUD’s systems and operations

Research, evaluate, and implement technical solutions to provide additional improvements to VPN and related remote working capabilities of HUD system users.

Perform routine VPN stress tests as part of its contingency planning and testing processes to regularly identify and remediate network performance issues and ensure that network capabilities are sufficient for teleworking.

Research, evaluate, and implement technical solutions to resolve the user account management issues and the underlying issue in the technical environment.

Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks. RPA is a software technology used to emulate human actions on a computer. RPA…

Oversight Area: HUD Business Functions

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

We audited the U.S. Department of Housing and Urban Development’s (HUD), oversight of Community Development Block Grant Disaster Recovery (CDBG-DR) grantees’ use of program income. We initiated this audit in accordance with our goal of ensuring and promoting accountability and effectiveness in…

Oversight Area: Disaster Relief

We recommend that the Director for HUD’s Office of Disaster Recovery require grantees to support or repay to its program $2,551,375, from nonfederal funds, for the 9 vouchers that did not have adequate supporting documentation for expenditures.

We recommend that the Director for HUD’s Office of Disaster Recovery work with its grantee to resolve or correct program income balances for the three grants that had program income balances outstanding.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that program income balance discrepancies are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that untimely FFRs are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery establish a mechanism to train grantees and HUD staff on existing guidance regarding supporting documentation for expenditures, FFRs, and program income balances on a recurring basis. Additionally, provide guidance and establish recurring training for HUD staff to monitor grantees for program income and submission of the FFRs..

We recommend that the Director for HUD’s Office of Disaster Recovery implement quality control procedures to ensure that HUD staff completes the action plan and QPR checklists.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that grantees’ policies and procedures related to program income are adequate.

We recommend that the Director for HUD’s Office of Disaster Recovery provide training to grantees regarding the reporting, tracking, and expenditure of program income.

We audited the U.S. Department of Housing and Urban Development’s (HUD) Real Estate Assessment Center’s inspection process. The audit objectives were to determine whether the Center (1) ensured that public housing properties were inspected within required timeframes before the coronavirus disease…

Oversight Area: HUD Business Functions

Prioritize the inspection of public housing properties that were (1) not included in the NSPIRE demonstration but were identified as high priority under the Center’s Big Inspection Plan and (2) approved to participate under the NSPIRE demonstration that the Center was unable to inspect by March 31, 2023.

Implement adequate policies, procedures, and controls to ensure that public housing properties will be inspected within required timeframes.

Status

As of July 2025, according to HUD, all development and enhancement of the NSPIRE software system are presently on hold pending Administrative guidance on HUD funded software system improvements. Additionally, the required software changes recommended under this finding depend on the final Public Housing Assessment System (PHAS) rule, but most regulatory work has been paused for review per Executive Order from the Administration. Pending the required resources and funding approval, HUD cannot move forward at this time. According to HUD, it has planned for and proposed the needed improvements to meet this recommendation and will provide updates when available. The current final action target date is September 30, 2025.

Analysis

To fully address this recommendation, HUD must provide evidence demonstrating that it has implemented control activities that ensure public housing properties are inspected within the required timeframes.

Implementation of this recommendation will result in HUD accurately tracking the dates on which public housing properties should be inspected and that they are timely completed.

Due to the uncertainty of when software changes to NSPIRE can take place to enforce the timing of inspections, REAC cannot enforce the requirements of inspection timing.

Open Recommendations by Oversight Area

Oversight Area

Status

Priority

HUD IT Modernization Roadmap Evaluation Report

Additional Details To Supplement Our Fiscal Year 2019 U.S. Department of Housing and Urban Development Financial Statements Audit

Audit of the Government National Mortgage Association’s Financial Statements for Fiscal Year 2019

The Puerto Rico Department of Housing, San Juan, PR, Should Strengthen Its Capacity To Administer Its Disaster Grants

Audit of FHA’s Fiscal Years 2022 and 2021 Financial Statements

Audit of HUD’s Fiscal Years 2022 and 2021 Financial Statements

Assessment of HUD’s IT Infrastructure To Support Extensive Telework

HUD’s Robotic Process Automation Program Was Not Efficient or Effective

HUD’s Oversight of CDBG-DR Grantees’ Use of Program Income

Improvements Are Needed To Ensure That Public Housing Properties Are Inspected in a Timely Manner

Stay Informed