Recommendations

Open Recommendations by Oversight Area

Housing Assistance

Community Development

Disaster Recovery

Financial Risk and Accountability

Technology and Cybersecurity

Health and Safety

HUD's Operations

Priority Recommendations
Open Recommendations

View data table

Open Recommendations by Oversight Area
Oversight Area	Priority Recommendations	Open Recommendations
Housing Assistance	75	100
Community Development	3	75
Disaster Recovery	3	82
Financial Risk and Accountability	6	130
Technology and Cybersecurity	4	88
Health and Safety	1	53
HUD's Operations	4	100
Total	96	628

Filter search results using the following criteria

HUD Business Functions

55 Results

Clear

The OIG evaluated the U.S. Department of Housing and Urban Development (HUD) Office of Housing’s (Housing) progress in applying zero trust security principles to protect personally identifiable information (PII) within the Federal Housing Administration (FHA) Catalyst system.HUD was in the…

Oversight Area: HUD Business Functions

Housing should include zero trust requirements as part of the Housing Strategic Roadmap for Housing Modernization.

Housing should refine access controls within the FHA Catalyst modules that are dynamic, are tailored to user actions, and require continuous reauthentication to ensure that users have access only to information needed.

Housing should coordinate with HUD’s SOC to a. Ensure that FHA Catalyst user behavior monitoring logs are regularly captured and adequately reviewed for discrepancies in user activities. b. Establish program office responsibility for the log review process.

We contracted with the independent public accounting firm of Sikich CPA LLC to audit the financial statements of HUD as of and for the fiscal years ending September 30, 2024 and 2023, and to provide reports on HUD’s (1) internal control over financial reporting and (2) compliance with laws,…

Oversight Area: HUD Business Functions

We recommend that the Chief Financial Officer enhance existing policies to establish a formal grant accrual risk management framework to help ensure consistent standards across HUD with regard to the development, review, and execution of the grant accrual and validation. This framework should include 1) identifying grant accrual estimation risk, assessing the magnitude of this risk, and managing the risks that arise when using certain quantitative estimation methods, 2) a governance structure that includes estimation ownership, oversight, and framework assessment, 3) the creation of a committee that is responsible for establishing a holistic approach to estimation risk management, including key stakeholders from OCFO and program offices, such as CPD, and 4) a requirement for documentation of committee meeting agendas, minutes, and key decisions and discussion points which impacts the various grant accrual methodologies across the Department.

We recommend that the Deputy Assistant Secretary for Operations of Community Planning and Development enhance CPDs existing Grant Accrual Standard Operating Procedures to strengthen governance within CPD and to effectively work within the framework established by the OCFO in recommendation 1A. The updated procedures should include increased ownership and oversight over the reviews, authorizations, approvals, and changes to the CPD grant accrual estimates and methodology.

We obtained the U.S. Department of Housing and Urban Development’s (HUD) two nondisclosure policies and two nondisclosure forms applicable to HUD employees. We also obtained 13 nondisclosure agreements between HUD and HUD employees. The nondisclosure policies, forms, and agreements did not…

Oversight Area: HUD Business Functions

Revise HUD’s Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD’s Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Review whether potential violations of the Antideficiency Act took place because of implementing or enforcing any nondisclosure policies, forms, or agreements that do not include the anti-gag provision as required by law. If it is determined that a violation occurred, the Chief Financial Officer should take disciplinary actions as appropriate and report the identified violations to the oversight authorities, including the HUD Secretary, the President, the Office of Management and Budget, Congress, and the Comptroller General.

Implement a plan to annually survey all HUD program offices to identify nondisclosure policies, forms, and agreements issued and to determine whether they include the anti-gag provision as required by WPEA and, as necessary, to take corrective action to ensure that they include the anti-gag provision.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

Revise the Ginnie Mae Confidential Information Policy to state that in the future, (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

The U.S. Department of Housing and Urban Development’s (HUD) development of requirements documents is a collaboration across HUD program offices. The Office of the Chief Procurement Officer (OCPO) is responsible for obtaining all goods and services required by HUD efficiently and in the most…

Oversight Area: HUD Business Functions

Develop ALU engagement standards and incorporate them into acquisition policies and procedures.

Update guidance to clarify the different roles and responsibilities of the ALU, CO, CS, and COR.

We recommend that the Chief Procurement Officer develop, implement, and communicate requirements for program offices to establish written minimum roles and responsibilities for their respective procurement management functions, including but not limited to CORs, PMs, and SMEs.

Beginning in 2021, the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General (OIG), conducted several audits to assess HUD’s anti-fraud efforts and to develop inventories of fraud risks in HUD programs. Our previous work found that HUD’s fraud risk management program…

Oversight Area: HUD Business Functions

Use the fraud risks and fraud schemes HUD OIG identified and involve relevant stakeholders to create a program-specific fraud risk inventory to support HUD’s anti-fraud efforts and enhance oversight of the Capital Fund program.

Communicate Capital Fund program fraud risks and schemes to all its stakeholders, including PHAs, to increase program effectiveness.

Determine whether data currently collected from PHAs can be leveraged to identify and mitigate fraud risks and consider whether any additional data needs to be collected or systems enhanced to mitigate fraud risks.

We contracted with the independent public accounting firm of Sikich CPA LLC to audit the financial statements of HUD as of and for the fiscal year ending September 30, 2025, and to provide reports on HUD’s (1) internal control over financial reporting and (2) compliance with laws, regulations,…

Oversight Area: HUD Business Functions

Systematically evaluate whether control deficiencies identified by the AIR program have affected the accuracy or completeness of HUD’s financial statements. This assessment should include:
a) Review relevant financial statement line items, disclosure, and account balances for misstatements attributable to ineffective controls;
b) Document the evaluation results, including the rationale for conclusions regarding the presence or absence of misstatements;
c) Make correcting entries to September 30, 2025 balances, as appropriate;
d) Retain supporting analysis for both internal and external review; and
e) Leverage test of balances results to inform remediation efforts.

Work with program offices through remediation activities to determine the underlying causes of the control deficiencies identified by the AIR program.

Based on the causes identified, coordinate with the program offices through remediation activities to develop corrective action plans with defined milestones, responsible parties, and timelines. Progress should be tracked, documented, and periodically reported to senior management.

Require targeted, role-specific training for program office staff and managers in areas where deficiencies were identified, including approvals, segregation of duties, recordkeeping, and delegated authority. This training should reinforce the importance of compliance with internal control requirements and include HUD escalation and enforcement mechanisms.

Assess and address barriers to timely and adequate responses from program offices during AIR program internal control testing. This assessment should:
a) Identify recurring causes for delayed or incomplete responses from program offices and implement escalation protocols or incentives to ensure timely fulfillment of AIR program requests;
b) Identify and implement efficiencies in the testing process to optimize the time program offices spend on the AIR program, such as streamlining communication, clarifying expectations, finding alternatives to time consuming tasks, and optimizing scheduling;
c) Provide additional guidance, training, or resources to program offices as needed to improve the quality and timeliness of submissions; and
d) Monitor response rates and timeliness, reporting persistent issues to senior leadership for corrective action.

Re-examine and enhance HUD’s process for evaluating the potential financial impact of control deficiencies identified by the AIR program or other sources to ensure that:
a) Assessments of financial impact are initiated promptly upon identification of control deficiencies;
b) The evaluation process is structured to deliver clear, actionable conclusions in sufficient time to inform any necessary adjustments to financial statements prior to the financial report date; and
c) Documentation of the assessment process and results is maintained to support audit requirements and management’s assertions.

Coordinate with the Principal Deputy Assistance Secretary for each Program Office to:
a) Define governance protocols to include reassessing HUD’s escalation protocols and enforcement mechanisms for repeated or willful noncompliance with documented controls, such as additional oversight, retraining, or disciplinary action as appropriate. Based on the assessment, update those protocols and mechanisms, as warranted.
b) Establish and resource a HUD-wide centralized digital repository for artifacts and key supporting documentation to provide consistent documentation retention and accessibility. Based on this initiative, define governance protocols for repository use, including security, version control, timely review/update requirements, and periodic audits to validate compliance.

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and…

Oversight Area: HUD Business Functions

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We contracted with the independent public accounting firm of Sikich CPA LLC to audit the financial statements of FHA as of and for the fiscal year ending September 30, 2025, and to provide reports on FHA’s (1) internal control over financial reporting and (2) compliance with laws, regulations,…

Oversight Area: HUD Business Functions

Implement a process and procedure to ensure a complete and accurate Missing Documents Report is submitted to the General Ledger Division for recording a monthly reclassification entry between HECM loans receivable and accounts receivable.

Develop a process to (1) monitor receipt of original first notes and mortgages and recorded assignments, (2) follow up with mortgagees who fail to submit documents by the required deadline, and (3) initiate repurchase requests for HECM mortgagees who fail to meet assignment requirements.

Implement procedures to (a) ensure all HECM loan terminations are accurately reported, (b) prevent HECM terminated loans from being included in the loans receivable balance, and (c) prevent inspections and tax payments on HECM terminated loans.

Implement comprehensive controls to (a) identify all Single Family partial claims related to terminated first mortgages, (b) update the system record of partial claims that will become due and payable when the refinanced mortgages are terminated, and (c) remove partial claims related to terminated mortgages from SMART.

Consider enhancing the SMART system, by adding fields (a) requiring FHA’s loan servicing contractor to enter the amount on the original mortgage and promissory note and (b) calculating the difference between the partial claim amount in SMART and the amount entered from the documents.

Implement an enhanced review process to ensure the receipt of partial claim documents is accurately marked in SMART so that the Missing Documents Report will be accurate.

Determine which report accurately reflects the status of partial claims without original documentation, certify the completeness and accuracy of the identified report, and provide the report to the General Ledger Division for the reclassification entry.

Transmittal of Independent Public Accountant’s Audit Report on the Federal Housing Administration’s Fiscal Year 2025 Financial Statements

Record journal entries to reclassify the HECM cases with missing original first notes for more than 90 days from loans receivable to accounts receivable.

Ensure the report provided by the NSC to reclassify partial claims from loans receivable to account receivable is appropriate for financial reporting and document the decision.

Implement a procedure to test journal entry posting models and their effect on the financial statements and related note disclosures when there are program changes requiring new journal entries.

Develop a standard operating procedure that details the rationale, calculation, and underlying support needed for the amounts and narrative descriptions in the financial statement note disclosures, including borrowing authority.

Implement quality control checks that reconcile financial statement disclosure amounts to the general ledger and other supporting documentation as part of the financial statements review and approval process.

We conducted this engagement in coordination with the Pandemic Response Accountability Committee (PRAC) to gain an understanding of the U.S. Department of Housing and Urban Development’s (HUD) fraud risk management practices and develop an inventory of fraud risks that HUD had not already…

Oversight Area: HUD Business Functions

Coordinate with CPD program staff to clarify the (1) roles and responsibilities of the CRO, HCCRT, and CPD’s risk management staff with regard to identifying, assessing, and mitigating fraud risks and (2) purpose and role of HUD’s ERM processes and program office risk management processes with regard to identifying, assessing, and mitigating fraud risks.

Complete a program-specific fraud risk assessment and risk profile for the CDBG and ESG programs, with emphasis on CARES Act funding, and replicate this process to create program-specific fraud assessments and risk profiles for other CPD programs.

Consider OIG’s fraud risk inventory to improve CPD’s own fraud risk assessments and develop a program-specific fraud risk map and compendium.

Implement efforts to increase the awareness of fraud at all levels (headquarters, field offices, grantees, subrecipients, etc.), including but not limited to regularly publishing articles on known fraud schemes and identified instances of fraud in periodic newsletters or on CPD’s intranet website, providing recurring fraud risk trainings to HUD employees and grantees and working with OIG to develop materials to support fraud awareness.

Develop and implement a fraud risk checklist or other instrument as part of CPD’s monitoring oversight requirements, to be completed as part of each remote and onsite monitoring review.

Develop and implement a fraud analytics strategy using available data, including but not limited to data and information collected during the grantee risk assessment and monitoring processes, to begin conducting data analyses to identify potential fraud risks for further review.

We contracted with the independent public accounting firm of CliftonLarsonAllen LLP (CLA) to audit the financial statements of HUD as of and for the fiscal years ended September 30, 2021 and 2020,1 and to provide reports on HUD’s 1) internal control over financial reporting; and 2) compliance with…

Oversight Area: HUD Business Functions

As part of the validation process for CPD’s accrued liabilities, improve its validation process to ensure that it is based on verifiable grantees responses and supporting documentation.

We are recommending OCFO reopen the following recommendation reported in audit report 2021-FO-0003-0001-D: 1B. As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.

Implement a policy to ensure the federal regulation responsibilities for outgoing HUD employees are reassigned to appropriate HUD personnel to enable HUD to continue to address those federal regulation requirements.

Establish controls to determine if single audits for HUD grantees are being completed and reported in a timely manner in accordance with 2 CFR §200.512.

Provide a means for which HUD grantees and their auditors can request technical advice and counsel.

Establish controls to determine if follow-up is being conducted to determine if the grant recipients have taken appropriate and timely corrective action. That follow-up must include the following: a. Issuing a management decision letter as prescribed in 2 CFR §200.521; b. Monitoring recipients to ensure they are taking appropriate and timely corrective action; c.Using cooperative audit resolution mechanisms (see 2 CFR §200.25) to improve federal program outcomes through better audit resolution, follow-up, and corrective action; and d. Developing a baseline, metrics, and targets to track, over time, the effectiveness of HUD’s process to follow-up on audit findings and on the effectiveness of single audits in improving recipient accountability and their use by HUD in making award decisions.

Establish controls to ensure that HUD provides Office of Management Budget (OMB) annual updates to the compliance supplement6 and works with OMB to ensure that the supplement focuses the auditor to test compliance requirements most likely to cause improper payments, fraud, waste, abuse or generate audit findings for which HUD will take sanctions.

Establish a control to hold HUD’s Single Audit Accountable Official responsible for improving the effectiveness of the single audit process based on single audit metrics that HUD will establish in response to recommendation 4D above.

Open Recommendations by Oversight Area

Oversight Area

Status

Priority

FHA Catalyst Personally Identifiable Information Risk Management in a Zero Trust Environment (2023-OE-0007a) Interim Evaluation Report

Audit of the U.S Department of Housing and Urban Development’s Fiscal Years 2024 and 2023 Financial Statements

The U.S. Department of Housing and Urban Development Nondisclosure Agreements’ Incorporation of Whistleblower Protections

Requirements Documentation in the U.S. Department of Housing and Urban Development’s Acquisition Process

Potential Fraud Risks and Schemes for HUD’s Capital Fund Program

Audit of the U.S Department of Housing and Urban Development’s Fiscal Years 2025 Financial Statements

HUD FY 2025 Federal Information Security Modernization Act (FISMA) Evaluation Report

Audit of FHA’s Fiscal Year 2025 Financial Statements

Fraud Risk Inventory for the CDBG and ESG CARES Act Funds

Audit of HUD’s Fiscal Years 2021 and 2020 Consolidated Financial Statements

Stay Informed