HUD Did Not Comply with the Payment Integrity Information Act of 2019

We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2022 compliance with the Payment Integrity Information Act of 2019 (PIIA) and implementation of Office of Management and Budget (OMB) guidance. PIIA was enacted to prevent and reduce improper payments and require each agency’s inspector general to perform an annual review of the agency’s compliance with PIIA. Our objectives were to assess (1) whether HUD had met all requirements of PIIA and OMB Circular A-123, Appendix C, Requirements for Payment Integrity Improvement, and (2) HUD’s efforts to prevent and reduce improper and unknown payments.HUD did not comply with PIIA because it did not report improper and unknown payment estimates for the Office of Public and Indian Housing’s Tenant Based Rental Assistance (PIH-TBRA) program and the Office of Multifamily Housing's Project-Based Rental Assistance (PBRA) program, which spent $41 billion in fiscal year 2022 and represented 61.6 percent of HUD’s total expenditures. This noncompliance is significant because this was the sixth consecutive year in which HUD was unable to produce PIH-TBRA and PBRA improper and unknown payment estimates and that has contributed to HUD’s not complying with improper payment laws for 10 consecutive years.HUD did not report improper and unknown payment estimates for the PIH-TBRA and PBRA programs because it was not successful in planning and developing a platform to collect and secure supporting documentation that contained personally identifiable information (PII). Although HUD has systems that maintain PIH-TBRA and PBRA program PII data, the systems do not collect or maintain the supporting documentation from tenants and third parties that is needed to verify tenant income, including medical and other allowances, assets, number of household members, and other information used in the calculation of the housing assistance payments. Because HUD was unable to collect this information, it could not determine whether its improper and unknown payment estimate was below or above the statutory threshold. Without an estimate, HUD could not implement corrective actions to improve payment accuracy for programs above the statutory threshold.In addition, we found opportunities for HUD to enhance its process for assessing improper payment risk. HUD could better identify high-risk programs by updating its risk assessment methodology to adequately consider fraud and the risks associated with having its programs implemented by non-Federal administrators, consistent with OMB guidance. This condition occurred because HUD’s programs delegate significant authority within the payment cycle to non-Federal administrators and assessing risk outside HUD is challenging. HUD could also improve its application of the risk assessment methodology. HUD’s risk scoring for one of its factors depends on its having completed fraud risk assessments and questionnaires. However, HUD was in the early stages of developing a Fraud Risk Management Program and had not yet completed program-specific risk assessments for 10 of the 11 programs. By addressing weaknesses in its risk assessment process, HUD can more reasonably assess whether its programs are susceptible to significant improper payments.We also found that the Office of Public and Indian Housing did not conduct monitoring reviews to detect, prevent, and recover improper payments in the PIH-TBRA program. HUD suspended these reviews in fiscal year 2021 in response to the COVID-19 pandemic and related waivers. However, those waivers expired on December 31, 2021, and the Office of Field Operations (OFO) did not resume its monitoring because it was working on updating its monitoring procedures. If HUD resumed OFO monitoring, it could better detect and prevent improper housing assistance payments from public housing agencies to landlords under the PIH-TBRA program, which spent $27.1 billion and accounted for 41 percent of HUD’s total expenditures.Overall, while HUD made some progress in fiscal year 2022, additional efforts are needed to bring HUD into compliance with PIIA. From an agencywide perspective, HUD is in compliance with the risk assessment requirements and has assessed all of its programs within the last 3 years; however, we found opportunities to strengthen this process. HUD also made progress this year in its Office of Community Planning and Development’s Hurricanes Harvey, Irma, and Maria program testing, and we found that it was compliant with PIIA. In its PIH-TBRA and PBRA programs, HUD could not provide detailed evidence to support that it was making substantive progress toward compliance. Since developing a secure platform to collect supporting documentation is only the first step in developing an estimate and HUD could not implement this in fiscal year 2022, significant efforts are needed to bring HUD into compliance with PIIA.Several recommendations and two priority open recommendations from prior-year audits remain open and will help to address the current-year findings. Most significantly, in 2021 we recommended that HUD ensure that the program improper payment rate estimates adequately test for and include improper payments of Federal funding that are made by State, local, and other organizations administering these programs and adequately disclose any limitations imposed or encountered when reporting on improper payments.This is the sixth consecutive year in which HUD has not been able to produce PIIA-compliant PIH-TBRA and PBRA improper payment estimates. This year, we recommend that HUD establish an improper payment council within HUD that consists of senior accountable officials from across the Department with a role in the effort that would work to identify risks and challenges to compliance and identify solutions as a collaborative group. We also recommend that HUD (1) develop a timeline, detailed plan, and secure storage information technology solution for completing compliant PIH-TBRA and PBRA program estimates and (2) make changes to its risk assessment to ensure that it adequately addresses the risk of non-Federal program administrators and fraud risk.