Open Recommendations

We recommend that the Director for HUD's Office of Disaster Recovery implement quality control procedures to ensure that HUD staff completes the action plan and QPR checklists.

For any of the 3,024 loans found to be subject to the temporary policy or otherwise ineligible for insurance, require the lenders to execute indemnification agreements covering a period of at least 5 years or reimburse HUD for any claims to put up to $26,840,071 to better use by protecting HUD against potential losses. For any indemnification agreements executed, HUD should properly store the agreements and record the agreement data.

We recommend that the Chief Procurement Officer update HUD's field service manager contract monitoring plan and FSM qualitative monitoring databases used to monitor contractor performance to align with the QASP and contractual requirements as noted in recommendation 1G below.

Develop and implement an agencywide crisis readiness plan addressing likely hazards arising from a crisis. This guidance should include all key elements that meet CIGFO crisis guidance.

We recommend that the Deputy Assistant Secretary for Public Housing and Voucher Programs enhance SEMAP or develop a new performance measurement process that would identify PHAs with underperforming HCV Programs, which should include an assessment of PHAs' ability to maximize assistance to house families.

We recommend that the Deputy Assistant Secretary for Field Operations provide training and guidance to field office program staff on SEMAP scoring, rating, and verification procedures, including confirmatory reviews, quality control reviews, and adjustments, as appropriate, for the revised SEMAP process.

We recommend that the Director of CPD's Office of Disaster Recovery adopt LMI benchmarking to ensure that grantees budget adequate funds to LMI at significant milestones in the grant lifecycle.

We recommend that the Director of CPD's Office of Disaster Recovery make changes to the action plan process so that the action plan calculates an overall LMI percentage.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD's fraud risk management program out of the ad hoc phase.

Status

Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.

In conjunction with corrective actions being taken on previous audits, revise ONAP's internal policy and procedures to include detailed written policies and procedures for the marketing, preservation, and sale of defaulted loan notes and REO properties on tribal trust and other restricted lands.

Requires the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine the cost to eliminate or control the lead-based paint and lead based paint hazards in public housing and the timeframe to complete such work based on the existing funding levels and strategies that could accelerate the timeframe.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to assess the lead-based paint hazard reduction activities performed at the 19 developments associated with 18 public housing agencies reviewed that did not implement interim controls and ongoing maintenance and reevaluation activities or adequately document that previously identified lead-based paint had been abated or treated with interim controls and subjected to ongoing maintenance and reevaluati

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

To address this recommendation, OLHCHH agreed to:

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to
a. quantify and aggregate security risks,
b. normalize cybersecurity risk information across organizational units, and
c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).