oversight

Review of HUD's Internal Controls over Processing of Personnel Actions

Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-04-15.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                                Issue Date
                                                                 April 15, 2009
                                                                Audit Case Number
                                                                   2009-FO-0004




TO:         Darlene F. Williams, General Deputy Assistant Secretary, Office of
              Administration, A

FROM:       Thomas McEnanly, Director, Financial Audits Division, GAF

SUBJECT: Review of HUD’s Internal Controls over Processing of Personnel Actions

                                   HIGHLIGHTS
 What We Audited and Why

             We audited the U.S. Department of Housing and Urban Development’s (HUD)
             Office of Administration’s internal controls over the processing of personnel
             actions in response to an anonymous complaint received by our office. The
             complaint was accompanied by a binder containing specific examples in support
             of the complaint allegations. Our initial survey review indicated that the
             allegations were valid and warranted further review.

             Our objectives were to determine why (1) human resource actions were not
             processed in a timely manner, (2) employee requests to waive the automatic
             collection of payroll overpayments were not processed before collection actions
             began, (3) adequate documentation to support job vacancy announcements was
             not maintained, and (4) employees were able to initiate their own personnel action
             requests.


 What We Found

             The design and implementation of HUD’s internal controls over collection
             waivers, new hire paperwork, processing of awards, promotions, within-grade
             increases, pending personnel action requests, and job vacancy announcements
             were inadequate. The issues identified in our review indicated a lack of internal
             controls to ensure (1) the timely processing of collection waiver requests and new
             hire paperwork, (2) that employees were afforded the opportunity to request a
         collection waiver before salary offsets were taken, and (3) that Office of
         Personnel Management job announcement policies and procedures and record-
         keeping standards were followed. Finally, in certain circumstances, the HR
         Connect system lacked the controls to prevent employees from being involved in
         the processing of their own personnel action requests, which made HUD
         vulnerable to the processing of potentially fraudulent actions.


What We Recommend


         We recommend that the Director of HUD’s Office of Human Resources
         implement a tracking system for (1) monitoring new hire accession paperwork
         and (2) processing awards, promotions, within-grade increases, transmittal of
         application status notification letters, and collection waiver requests.
         Additionally, policies and procedures regarding the processing of collection
         waiver requests should include timeliness standards for the research and review
         phases to ensure that decisions are made in a timely manner and that collection
         actions are not premature. In addition, we recommend that policies and
         procedures be established to include supervisory review of pending new hire
         paperwork actions, job announcement case files, and checklists upon closeout.
         Staff should be retrained regarding new hire paperwork policies and procedures.

         We also recommend that the Director of the Office of Human Resources ensure
         that staff performs the necessary reviews to certify that each job vacancy case file
         properly supports the recruitment process and employees do not participate in the
         processing of their own personnel action requests.

         Lastly, we recommend that all employees be informed that it is not allowable to
         participate in the processing of their own personnel action requests.

         For each recommendation without a management decision, please respond and
         provide status reports in accordance with HUD Handbook 2000.06, REV-3.
         Please furnish us copies of any correspondence or directives issued because of the
         audit.




                                           2
HUD’s Response


          We provided our audit results to HUD’s Office of Administration during the audit. We
          also provided our draft report to HUD’s General Deputy Assistant Secretary for the
          Office of Administration, its Deputy Assistant Secretary for Human Resource
          Management and the Office of Administration staff during the audit. Additionally, we
          held an exit conference with the Deputy Assistant Secretary for Human Resource
          Management on February 13, 2009.

          We asked HUD’s General Deputy Assistant Secretary for the Office of Administration to
          provide comments on our draft audit report by February 27, 2009, and written comments
          were provided and dated February 27, 2009. The Office of Administration generally
          agreed with our findings and recommendations, though comments on the report solely
          focused on our report recommendations. The complete text of the written comments,
          along with our evaluation of that response can be found in appendix B, except for 25
          pages of documentation that was not necessary for understanding the Office of
          Administrations’ comments.




                                            3
                            TABLE OF CONTENTS

Background and Objectives                                                           5

Results of Audit                                                                    6
   Finding 1: HUD Did Not Complete Critical Human Resources Activities in a
              Timely Manner                                                         15
   Finding 2: HUD’s Human Resource Management System Did Not Have Adequate
              Controls to Prevent Users from Participating in Their Own Personnel
              Actions

Scope and Methodology                                                               17

Internal Controls                                                                   20

Appendixes
   A. Human Resource Management Organization Chart                                  22
   B. Auditee Comments and OIG’s Evaluation                                         23




                                            4
                           BACKGROUND AND OBJECTIVES


The U.S. Department of Housing and Urban Development’s (HUD) Office of Administration
provides a full range of administrative services to headquarters and field office customers in
support of HUD’s mission. As head of the Office of Administration, the Assistant Secretary for
Administration is responsible for developing and promulgating policies, standards, procedures,
administrative systems, and materials related to the human resource and administrative
management of HUD. In addition, the office oversees the implementation of these policies and
directives at headquarters and in the field.

The Deputy Assistant Secretary for Human Resource Management is responsible for providing
technical services and meeting specialty skill needs to support HUD’s mission and department-
wide initiatives and for providing policies, guidance, and innovative strategic planning in the
area of human capital management. This function is supported by three offices, which have
overall responsibility for providing technical services in their organizational specialty areas.
These offices provide the Office of Administration with the following core cross-functional
services: statutory and regulatory support, performance standards development, quality control,
specialty skill leadership, and project support for departmental national initiatives.

The two human resource management offices1 most relevant to our review are

           (1) The Office of Human Resources, which includes the following functional divisions
               and work units: Human Resource Systems and Payroll Support; Executive Personnel
               Management Division; Human Resources Policy, Research, and Development
               Division; and the Employee Service Center.

           (2) Human Resource Management Information Enterprise Resource Management
               Planning Systems Staff.

HUD uses the HUD Integrated Human Resources and Training System (HIHRTS) to process
personnel actions. HIHRTS is a Web-based human resource management system with tools for
employees, managers, and human resources (HR) professionals. In September 2004, HUD
entered into an interagency agreement with the U.S. Department of the Treasury (Treasury) to
use its enterprise human resources solution, HR Connect. HR Connect is the human resources
management system on which HIHRTS was built. It is a government-wide system that is used
by Treasury and other agencies. HUD’s “Go Live” date was April 13, 2005.

The objectives of our audit were to determine why (1) personnel action requests, new hire
paperwork, and waiver requests were not processed in a timely manner; (2) employees were not
afforded the opportunity to request a waiver before the collections process began; (3) adequate
documentation was not maintained to support the job vacancy announcements; and (4)
employees were able to initiate their own personnel action requests.


1
    The human resource management organization chart is included in appendix A of this report.


                                                          5
                                      RESULTS OF AUDIT

Finding 1: HUD Did Not Complete Critical Human Resources
Activities in a Timely Manner

HUD’s Office of Human Resources did not ensure that the processing of new hire paperwork,
awards, promotions, within-grade increases, pending personnel action requests, collection waiver
requests, and job vacancy documentation was completed in a timely manner. Additionally,
overpayments were collected before employee notification, and job vacancy files were not
adequately maintained. These conditions occurred due to HUD’s lack of management oversight
of these critical actions. The delay in processing new hire actions adversely impacted employee
pay and benefits processing and coverage. Also, the untimely processing of collection waiver
requests and premature debt collections could result in the employee’s encountering undue
financial hardship. As a result, HUD did not have adequate assurance that the selection process
and other major human resource activities were performed in accordance with applicable laws,
regulations, principles, and standards.


    New Hire Actions Were Not
    Processed in a Timely Manner


                   Staffing and classification HR specialists did not process new hire actions in a
                   timely manner. During the period January 1, 2006, to September 30, 2007, 261
                   emergency salary payments were made to 222 HUD employees. Based on our
                   review of the Emergency Salary Payment Listing, the majority of emergency
                   payments were made because the HR specialist did not process the required
                   paperwork in time for it to be included in the payroll processing cycle for the
                   effective date. Specifically, 227 of the 261 emergency salary payments were
                   made to 190 of the 222 employees due to new hire paperwork not being processed
                   in a timely manner. Of the 190 employees, the paperwork of 36 employees had
                   not been processed for more than one pay period. For 31 of these 36 employees,
                   this error occurred for two or three consecutive pay periods.

                   HUD’s policy2 is that the HR specialist should enter new hire actions into the
                   system during the first week of the processing cycle. The HR specialist is also
                   required to determine whether the action has been entered into the National
                   Finance Center database. If the accession is not in the database, the HR specialist
                   must determine whether the action fell onto a suspense list. Additionally, HUD
                   policy3 indicates that new hire actions must be entered into HIHRTS upon
                   acceptance of the offer by the selectee. The results of our review indicated that
                   the responsible HR specialists did not always follow this procedure.

2
    HUD Office of Human Resources Standard Operating Procedure (SOP 06-01), Accessions and No Pay Procedures.
3
    Standard Operating Procedure, Recruitment Request.


                                                       6
                    Management did not ensure that new hire actions were processed in a timely
                    manner. This deficiency put new employees at risk of not being paid by the
                    prescribed pay date. Our review identified 21 of 36 employees who were paid
                    between one and five days after the official pay date. Additionally, employees’
                    benefits processing could have been impacted.

                    Although HUD’s Office of Human Resources acknowledged this flawed practice,
                    no efforts had been made to rectify the situation. However, HR officials
                    expressed the belief that moving the Employee Service Center from Chicago,
                    Illinois, to Washington, DC, headquarters would facilitate coordination and
                    communication.

      Awards, Promotions, Within-Grade
      Increases, and Pending Personnel
      Actions Were Not Performed in a
      Timely Manner


                    HUD had not established administrative controls to ensure the timely processing
                    of awards, promotions, within-grade increases, and pending personnel action
                    requests. These administrative controls are necessary to ensure the preparation of
                    accurate program office operating records, accounts, and financial and statistical
                    reports. Administrative controls are an element of the internal control standards4
                    issued by the U.S. Government Accountability Office. Those internal control
                    standards state that good human capital policies and practices, e.g., hiring,
                    promoting, compensating, and supervising employees, are a critical control
                    environment factor. The lack of a policy and procedure framework was an
                    indication that HUD had not clearly defined fundamental administrative controls.

                    As part of our review of the allegations made in the complaint, we selected a
                    sample of HUD employees from the HIHRTS database.5 The sample included 25
                    employees who received promotions, 25 employees who received a within-grade
                    increase, and another 25 employees who received individual cash awards during
                    the period January 1, 2006, to September 30, 2007. In addition to our review of
                    processed personnel actions, we performed an analysis of all pending personnel
                    action requests as of February 29, 2008, to determine how long they had remained
                    pending. We determined that 14 days was a reasonable time for the Office of
                    Human Resources to process personnel action requests after receipt.

                    Awards. Nine of the twenty-five employees had individual cash award
                    transactions that took longer than 14 days to process by HR staff. For all nine
                    questioned transactions, we attributed the delay in processing to the agency’s

4
    Internal Control Standards in the Federal Government, AIMD-00-21.3.1, November 1, 1999.
5
    See the Scope and Methodology section for details of transaction population and sample selection parameters.


                                                           7
implementation of the Office of Personnel Management’s (OPM) required
changes to the award “nature of action” codes.

Promotions. We identified 13 of 25 employees who had promotion transactions
that took longer than 14 days from the date of receipt to be processed by the
Office of Human Resources. Eight of the transactions took more than 30 days to
be processed. The Office of Human Resources contended that it did not process
promotions based upon the date of receipt but, rather, upon the effective date.
Specifically, to ensure timely processing, actions were required to be processed
by the last day of the processing cycle in which the effective date fell.

Therefore, we performed a second review of the 13 questioned promotion
transactions based upon the above criteria. Although promotion transactions took
longer than 14 days to be processed, we found that all but 3 of the 13 questioned
transactions were processed by the last day of the processing cycle in which the
effective date fell. Regarding the three transactions that were not processed
within the prescribed timeframe, the Office of Human Resources approved two
actions 4 and 16 days after the last day of the processing cycle. For the third
transaction, the program office did not submit the action to the Office of Human
Resources until after the transaction effective date. However, the action was not
processed until 66 days after receipt.

While HUD determined that it was sufficient to process promotion actions based
on the effective date, it is our opinion that it would be advantageous to process
promotion actions as received by the office. Although there are no HUD-specific
personnel action processing timeframe criteria, by processing actions as received,
HUD could prevent the office from having transactions idling in its work list.

Within-grade increases. Twenty of the twenty-five employees had their within-
grade increases processed more than 14 days after the effective date. For these 20
employees, we attributed the delay to corrections being made related to the
within-grade increase. Within-grade increases are not generally processed by HR
specialists via HIHRTS. These corrections were necessary because HIHRTS and
the National Finance Center did not automatically update the last equivalent
increase date when there was a promotion or pay-related action. As a result, HR
specialists had to manually update the date. Although the Office of Human
Resources had been aware of this problem since 2005, the problem persisted.

Pending personnel action requests. As of February 29, 2008, there were 53
pending requests according to the HIHRTS pending and processed report. Our
review found that 27 of the 53 pending requests were awaiting HR action or final
approval. Seventeen of the requests had been awaiting final HR approval from 10
to 483 days. The remaining 10 had been sent to the Office of Human Resources
for authorization/approval but had not received action. These 10 transactions had
been awaiting HR action from 126 to 325 days. Two of the fifty-three requests
were later processed on or around the review’s cutoff date and were no longer
pending. Of these two requests, one took 204 days to process, and the other took


                                 8
                 20 days. The remaining 24 pending requests were still awaiting program
                 management authorization and, therefore, had not been sent to the Office of
                 Human Resources for approval. All of these 24 transactions had been idle for
                 more than 100 days.

                 We inquired as to the status of the 27 pending requests that were awaiting HR
                 action or final approval and found that although some of these actions had been
                 deleted or processed, the amount of time that the actions were pending after
                 submission for authorization and approval was extensive. Specifically, these 27
                 transactions had been pending between 10 and 493 days as of February 29, 2008.
                 Follow-up showed that 11 of these actions were still pending as of July 18, 2008.


    Overpayment Collection Waiver
    Requests Were Not Processed in a
    Timely Manner and Collections
    Were Taken Prematurely


                 Overpayment collection waiver requests were not processed in a timely manner,
                 and collections were initiated before the employee was notified or before a
                 decision was reached on the waiver request. There were 51 such requests made
                 by HUD employees between January 1, 2006, and September 30, 2007. We
                 reviewed a random selection of 10 waiver requests and found that final decisions
                 were not made in a timely manner. For example,

                          For five requests, a final decision was not reached for more than a year.
                          Specifically, it took from 466 to 1,036 days for final decisions to be
                          reached.

                          For four requests, it took between 36 and 200 days for a decision to be
                          reached.

                          For the remaining collection waiver request, we were unable to determine
                          how long it took for a decision to be reached because the original waiver
                          request was not in the file and could not be located by HR staff.

                 Additionally, for three of the waiver request files reviewed, collections were taken
                 before the employee was notified of the overpayment or before a decision was
                 made regarding a waiver request contrary to federal statutes and HUD policy.

                 Title 5 U.S.C. (United States Code) 55846 provides an employee the opportunity
                 to have an overpayment claim waived in whole or in part by an authorized
                 official. Further, 24 CFR (Code Federal Regulations) 17.1287 sets forth
6
  5 U.S.C. 5584 is entitled “Claims for overpayment of pay and allowances and of travel, transportation, and
relocation expenses and allowances.”
7
  24 CFR 17.128 is entitled “Notice requirements before offset.”


                                                         9
                    requirements that must be followed before an offset can be made against an
                    employee to satisfy a claim of overpayment. Specifically, deductions may not be
                    made unless HUD first provides the employee with a minimum of 30 calendar
                    days’ written notice.

                    Further, the Office of Human Resources’ Employee Service Center Standard
                    Operating Procedures provides procedures for processing waiver requests for
                    salary overpayments. This guidance states that the personnel/pay specialist must
                    notify the affected employee in writing of the overpayment. If a waiver is
                    requested by an employee, the personnel/pay specialist is responsible for
                    requesting that the National Finance Center delay the collections pending a
                    waiver decision. Employee Service Center personnel are also required to monitor
                    the case to determine whether a suspension of collection extension is warranted to
                    ensure that collections are not taken before a decision has been reached.

                    We found that the waiver processing delays were attributed to multiple review
                    levels. Specifically, the Employee Service Center pay specialist was required to
                    research and review the waiver request and create the report of investigation.8
                    Then the report of investigation was to be sent to the Policy, Research, and
                    Development Division for another round of review and research before being
                    submitted to the person responsible for making a decision. Although an element
                    of the pay specialist’s performance standards includes timeframes for completing
                    the waiver review, neither review processes had established timeframes defined in
                    formal Office of Human Resources standard operating procedures. Ultimately,
                    collections were taken from employees before notification or before decisions
                    were rendered because the pay specialists did not request either suspensions of
                    collections or suspension extensions as required. As a result, employees could
                    encounter undue financial hardship due to premature collections or untimely
                    processing of waiver requests. Specifically, if the waiver request process is not
                    properly followed, up to 15 percent of the employee’s pay could be deducted to
                    satisfy the assumed overpayment.




8
    A report of investigation, outlining the circumstances of the overpayment, is required for each waiver.




                                                           10
Job Vacancy Case Files Were Not
Adequately Maintained and Required
Documents Were Not Completed in a
Timely Manner


          Between January 1, 2006, and September 30, 2007, HUD posted 1,350 vacancy
          announcements. We selected a nonstatistical random sample of 15 job vacancy
          announcement files to review and found that the files were not adequately
          maintained and required documents were not completed in a timely manner to
          ensure compliance with OPM record-keeping standards. For 11 of the 15 case
          files reviewed, required documents were missing, incomplete, and/or not
          submitted in a timely manner. Specifically, case files reviewed were missing
          applications, certificates of eligibles, and/or application status notifications. In
          some instances, the certificates of eligibles were missing required information
          such as the required signatures, reasons for nonselection, and/or a return date.

          Additionally, regarding the 11 case files, certificates of eligibles and application
          status notification letters were not submitted in a timely manner. Contrary to the
          15-day timeframe included in OPM’s 45-day hiring model, for three of the files
          reviewed, certificates of eligibles were not submitted to selecting officials until 17
          to 32 days after the announcement closing date. Additionally, in five of the case
          files, applicants received application status notifications well beyond the
          prescribed 45-day timeframe in which a selection should be made. Specifically, it
          took between 43 and 173 days after the 45-day timeframe for applicants to receive
          status notifications of their eligibility, referral/nonreferral, and
          selection/nonselection status.

          Regarding the remaining four files, the Office of Human Resources could not
          locate them when we initially reviewed the files in March 2008. The files were
          subsequently located in July 2008. Our review found that two of the files were
          missing many basic required documents. Specifically, these two files did not
          include any candidate applications, many application status notification letters
          were missing, eligibility forms were incomplete, and the certificates of eligibles
          were not signed by the selecting official(s) and did not indicate whether a
          selection had been made. The other two files contained incomplete and/or
          missing required documentation, similar to that noted during our initial review of
          the case files. The following table provides the details of missing, incomplete,
          and untimely documentation for all 15 case files.




                                            11
                                                                      Initial review* Follow-up of Total
                                                                      (11 of 15 files) 4 missing
                                                                                          files*
Missing and incomplete documentation:
Missing candidate applications                                                4            2          6
Certificate of eligible applicants
         Certificate missing from file                                        1                       1
         Incomplete certificate (missing HR specialist and/or                 3            2          5
         selecting officer signature, reason for nonselection,
         and/or return date)
Missing notification letters (receipt, notice of                              7            3         10
eligibility/noneligibility, notice of referral/nonreferral, or
notice of selection/nonselection)
Untimeliness:
Untimely submission of certificate of eligible applicants to       3             1          4
selecting official
Untimely notification to candidates of application status          5             1          6
*Since case files could have more than one occurrence of missing, incomplete, and/or untimely
documentation, the columns do not total 15.

                   Both OPM and HUD provide guidance regarding the timeframes in which certain
                   steps should be completed during the hiring process. The OPM hiring model
                   states that the certificate listing of eligible applicants should be forwarded to the
                   selecting official within 15 days after the job announcement has officially closed.
                   To ensure compliance with OPM’s model, HUD policy9 states that the following
                   must be completed by the HR specialist within 15 days after the job vacancy
                   closing:

                       Receive the applications,
                       Enter applicant information into Merit Staffing Control System,
                       Initiate acknowledgement letters,
                       Screen applications for minimum qualifications and send ineligible letters to
                       applicants who do not meet minimum qualifications,
                       Rank eligible applicants or conduct panels, and
                       Forward the certificate of eligible applicants or selection roster to the selecting
                       official.

                   Additionally, both OPM and HUD provide guidance regarding documents that
                   should be maintained in the job vacancy files. The OPM Delegated Examining
                   Unit Handbook includes a pledge to applicants, which states that the following
                   principles should be reflected in an agency’s recruitment process:

9
    Office of Human Resources’ Standard Operating Procedure, Recruitment Request.


                                                       12
                       Prompt acknowledgement that their application has been received,
                       Regular updates on the status of their applications as significant decisions are
                       reached, and
                       A timely decision-making process.

                   Additionally, the handbook states that it is the agency’s responsibility to ensure
                   that (1) a certificate is returned by a selecting official, (2) the case file documents
                   the action taken on each of the eligible applicants that were certified for selection,
                   (3) the certificate is signed and dated by the selecting official, (4) applicants are
                   notified of the status of their applications including assigned ratings if requested,
                   and (5) HUD complies with OPM’s schedule of records retention/disposition. It
                   also includes a listing of required information that must be included on the
                   certificate of eligible applicants or an equivalent form, identifying the job for
                   which qualified eligible applicants are being referred.

                   In addition, HUD policy10 states that the case files should contain documentation
                   such as the staffing request, position description, notice of position vacancy,
                   initial screening worksheet for merit staffing actions, panel rating worksheets,
                   selection roster, and applications for federal employment.

                   We attributed the missing, incomplete, and untimely documentation and missing
                   case files to the Staffing and Classification Division’s not ensuring that each job
                   announcement case file was documented, closed out, and filed adequately and in a
                   timely manner. Additionally, it did not have a system in place to verify that
                   application status notification letters were mailed in a timely manner. We also
                   noted that the division failed to have an adequate filing system, which would
                   ensure that all case files were properly filed, maintained, and protected. When
                   case files do not contain the information required by OPM and the Merit Staffing
                   Handbook, HUD cannot be assured that all major steps in the examining process
                   were performed properly and in a timely manner for each job announcement.
                   Further, it cannot be determined whether applicant assessments and selections
                   were made in accordance with applicable laws, regulations, principles, and
                   standards and that the agency’s vacant positions were filled with the best qualified
                   candidates.


     Recommendations


                   We recommend that HUD’s Director of Human Resources

                   1A.Establish a tracking system for logging the new hire’s (1) entrance on duty,
                         (2) paperwork completion due date, (3) responsible HR specialist, (4)


10
     HUD Merit Staffing Handbook 335.1, REV-3, paragraph 3-10.


                                                      13
       actions’ completion dates, and (5) specialist certification to ensure that
       new hire paperwork is processed in a timely manner.

1B. Retrain staff regarding new hire paperwork policies and procedures.

1C. Establish policies and procedures for a supervisory review of pending new
       hire paperwork.

1D.Fully utilize available reports (SINQ, Pending Actions, and Department of
       Treasury Mismatch Report) to track the processing of awards, promotions,
       and within grade increases, and revise or create Standard Operating
       Procedures to ensure these reports are monitored.

1E. Establish policies and procedures for a supervisory review of pending actions,
       awards, promotions, and within-grade increases.

1F. Implement a process to streamline the collection waiver request review
       process to ensure that decisions are made in a timely manner and that
       collections are not initiated prematurely.

1G.Revise policies and procedures regarding the processing of collection waiver
      requests to include specific timeliness standards for the research and
      review phases.

1H.Provide training to staff regarding the file management requirements and
      ensure that the staff fully uses the merit staffing case file checklist to
      ensure that each case file includes all required documentation that supports
      the recruitment process.

1I. Develop procedures for supervisors to follow in reviewing the checklist and
       case file upon case file closeout to ensure that it is closed out and filed
       properly and in a timely manner.

1J. Develop a tracking system for monitoring the transmission of notification
       letters to applicants and selectees/nonselectees to ensure timely
       notification during and throughout the application and selection processes.




                                 14
Finding 2: HUD’s Human Resource Management System Did Not Have
Adequate Controls to Prevent Users from Participating in Their Own
Personnel Actions
Despite system rules, certain system users were able to participate in the processing of their own
unallowable personnel action requests. These transactions were possible due to insufficient
system internal controls within HIHRTS/HR Connect. Although we found no evidence of any
illegitimate transactions, the system weaknesses resulted in HUD’s being vulnerable to the
processing of potential fraudulent personnel actions.




     HIHRTS/HR Connect Did Not
     Prevent Users from Participating in
     Their Own Actions

                 Based on our review of system controls, HIHRTS/HR Connect11 lacked internal
                 controls to prevent certain system users from participating in the processing of
                 their own unallowable personnel action requests. For the period January 1, 2006,
                 through September 30, 2007, we found 33 instances in which 20 employees were
                 able to request, initiate, authorize, and/or provide final HR approval for their own
                 individual cash or time-off award, detail, extension, promotion, and transfer
                 personnel action request transactions.12

                 The types of actions a system user can initiate are dependent on the security
                 profile. All HIHRTS/HR Connect system users are given a security profile that
                 defines which menus, pages, and records they are authorized to access. The page
                 tabs that employees can see are determined by the user’s security profile.
                 Whether a person can view certain menu items is also determined by a user’s role
                 and security profile. To view the manager’s tab, the security profile must have
                 the supervisory codes enabled. All employees have access to the employee tabs
                 and can perform functions using the employee self-service feature. The manager
                 and proxy/group tabs are visible to managers and the designated proxies, which
                 gives them the authority to initiate and approve these types of actions.

                 By using the employee self-service feature, employees were able to make changes
                 to their own personnel information, obtain information about their job and
                 benefits, and use online vehicles for job applications. Managers were able to
                 produce documents to recruit, promote, and award employees; compile various

11
   HUD’s Integrated Human Resources and Training System/HR Connect (HIHRTS/HR Connect) is the application
that supports HUD’s human resource functions.
12
   Between January 1, 2006, and September 30, 2007, there were 1,753 employee-initiated personnel action request
transactions. Of those 1,753 transactions, 1,720 represent requests that employees are allowed to initiate (i.e.,
retirement, data changes, and resignation actions).


                                                       15
                reports; and conduct a range of management functions via the manager self-
                service component. The proxy/group tab allowed a proxy to initiate and/or
                approve personnel actions on a manager’s behalf.

                Federal information systems requirements13 state that there should be controls in
                place that prevent users from having all of the necessary authority or information
                access to perform fraudulent activity without collusion. However, employees
                were able to participate in the processing of their own personnel action requests
                because they were either associated with a work list that allowed them to create
                their own actions or were proxies, which gave them the ability within the system
                to initiate and approve these types of actions. Although, we found no evidence
                that these transactions were not legitimate, HUD was vulnerable to the processing
                of potential fraudulent personnel actions.

                As a result of our review, the Office of Administration requested that Treasury
                implement an emergency system release that would prevent proxies from being
                able to participate in their own personnel action requests. On June 13, 2008,
                Treasury informed HUD that it had put the emergency release into production.
                The release added security to prevent employees from participating in the
                processing of their own unallowable actions.

Recommendations


                We recommend that HUD’s Director of Human Resources

                2A.      Inform employees that it is not allowable to participate in the processing
                         of their own actions.




13
 National Institute of Standards and Technology Special Publication 800-53, Revision 2, Recommended Security
Controls for Federal Information Systems, dated December 2007.


                                                     16
                            SCOPE AND METHODOLOGY

In December 2007, the HUD Office of Inspector General (OIG) received an anonymous
complaint regarding the lack of accountability, lack of responsibility, and mismanagement
occurring within the Office of Administration. Specifically, the complaint alleged the following:
inaccurate processing of pay and benefits; implementation of a costly system that had serious
deficiencies; lack of a fair and equitable process to address overpayment collection waiver
requests as the result of administrative errors, the lack of proper notification to request such a
waiver, and inconsistent treatment in granting waiver requests; and garnishment of paychecks
without due process. A binder, which included documentation supporting these allegations, was
also provided. The documentation included memorandums to the Secretary of Administration
documenting the problems encountered by HUD staff, e-mails from various HUD staff
documenting specific problems that were occurring, and a listing that documented each HUD
staff member who had encountered a problem with the Office of Administration and a
description of that problem.

To accomplish our objectives, we obtained an understanding of applicable health benefits,
within-grade increase, promotion, award, payroll, HIHRTS/HR Connect, waivers, and job
vacancies/new hires policies, procedures, and/or flow charts. Additionally, we evaluated
HIHRTS/HR Connect system functionality, interviewed responsible persons, and reviewed
interagency agreement procurement files and documentation detailing the testing of the system
and any issues noted during testing before implementation.

Initially, we limited our review to the types of allegations contained in the complaint binder. We
selected a nonstatistical sample of 55 of 198 complaint allegations that were documented in the
binder and contacted the HUD staff affected. The 55 complaint allegations encompassed 50
HUD staff members. We sent 50 questionnaires to the affected HUD staff members regarding
the 55 complaint allegations.14 We received 21 responses. In those responses, 14 complainants
provided information that supported the original complaint allegations. The other seven
complainants responded that they had not encountered any issues. Regarding the remaining 29
questionnaires, 24 did not respond, and five individuals were no longer HUD employees and
could not be contacted. Other methods were employed in an attempt to validate all allegations
whether the employee responded or not.

In addition to submitting questionnaires, we obtained data from HIHRTS/HR Connect to determine
whether the issues extended to all HUD employees who had the same types of personnel actions.
Our primary analysis regarding personnel actions (within-grade increases, promotions, awards, and
health benefits) was performed using two reports containing information on all HUD employees
extracted from HR Connect. The first report provided by HUD, as of February 8, 2008, contained
36,401 pending and processed personnel actions for the period January 1, 2006, through September
30, 2007.15 This report detailed the current status of the action and the proposed effective date and

14
  Some employees had more than one issue; therefore, they may have been counted more than once in our sample.
15
  The report provided by HUD was originally provided as several PDF files. We were able to convert these reports
into an Excel file so that we could readily analyze the data.


                                                       17
action for each employee’s personnel action request. Since this report did not contain all
information needed, such as when the action was requested and processed, we requested a more
detailed report. The second report, created by Treasury as of February 29, 2008, specifically to
fulfill our request, contained requests that were submitted, in process, and/or completed during the
same period, January 1, 2006, through September 30, 2007. This report provided the work in
process detail16 for the 36,401 personnel action request transactions provided in the first file. The
second file contained 138,824 transactions. Although the data included all personnel action requests
for our period of review, we only reviewed the types of actions found in the complaint binder
related to certain types of with-in grade increases, promotions, and award actions. We analyzed
and/or extracted data from both reports using Computer Assisted Audit Tools, Audit Command
Language, and Microsoft Excel software. We used these reports to determine the following: (1)
how long it took to process the personnel actions from submission/request to completion, (2) how
long pending requests remained in process, and (3) whether there were personnel actions that had
been submitted but no action had been taken. Details for each analysis performed were discussed in
finding 1. The following table documents the entire population of personnel requests; subset
population of certain types of with-in grade increases, promotions, and award actions; and sample
statistics for the personnel action requests we reviewed.



     Population and sample statistics for processed and pending personnel action requests
                  for the period January 1, 2006, through September 30, 2007
       Entire population                                 Subset population
                                                                                              Pending
                                Within-                       Individual                      personnel
                                grade                         cash                            action
                    All data    increases     Promotions      awards           Benefits       requests
 Employees            9,762          117             554              141                 2          48
 Requests            36,401            123             647              147               4           53
 Transactions       138,824            228           3,256              688               4          101

         Sample total                             Sample from subset population
 Employees*              124            25               25              25               2           48
 Requests                146            30               32              27               4           53
 Transactions            405            52             137              111               4          101
*Note: The sample number of employees does not equal the sample total (124), since one
employee was included in both the cash award and pending sample selections.

In addition to the data analysis, we reviewed and analyzed a report of emergency salary
payments and samples of waiver request and job vacancy announcement files for the period
January 1, 2006, through September 30, 2007.




16
  The work in progress detail includes such actions as the request, initiation, management authorization(s), and HR
specialist approval.


                                                        18
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.




                                               19
                              INTERNAL CONTROLS
Internal control is an integral component of an organization’s management that provides
reasonable assurance that the following objectives are achieved:

       Effectiveness and efficiency of operations,
       Reliability of financial reporting, and
       Compliance with applicable laws and regulations.

Internal controls relate to management’s plans, methods, and procedures used to meet its
mission, goals, and objectives. They include the processes and procedures for planning,
organizing, directing, and controlling program operations as well as the systems for measuring,
reporting, and monitoring program performance.



Relevant Internal Controls


              We determined that the following internal controls were relevant to our audit
              objectives:

                  Effectiveness and efficiency of operations – Timely processing of
                  overpayment collection waiver requests, new hire paperwork, job vacancy
                  documents, and personnel action requests.

                  Compliance with applicable laws and regulations – Policies and procedures
                  that management has in place to ensure that personnel action requests,
                  overpayment collection waivers, and new hire paperwork are processed and
                  job vacancy files are maintained in accordance with applicable policies and
                  procedures.

              We assessed the relevant controls identified above.

              A significant weakness exists if management controls do not provide reasonable
              assurance that the process for planning, organizing, directing, and controlling
              program operations will meet the organization’s objectives.


Significant Weaknesses


              Based on our review, we believe that the following items are significant weaknesses:

                  HUD lacked internal controls to ensure (1) the timely processing of personnel
                  actions requests, overpayment collection waiver requests, and new hire
                  paperwork; (2) that employees were always afforded the opportunity to


                                               20
request a waiver before deductions were taken; and (3) that OPM job
announcement policies and procedures and record-keeping standards were
followed.

In certain circumstances, HR Connect lacked the controls to prevent
employees from being involved in the processing of their own personnel
action requests, which made HUD vulnerable to the processing of potential
fraudulent actions.




                           21
22
                                                                                            APPENDIXES

              Appendix A
                                      HUMAN RESOURCE MANAGEMENT ORGANIZATION CHART

                                                                                       Assistant Secretary for Administration
                                                                                                   Keith Nelson
                                                                               General Deputy Assistant Secretary for Administration
                                                                                                   Dawn Luepke




                                                                            Deputy Assistant Secretary for Human Resource Management
                                                                                                Barbara Edwards
                                                                           Associate Deputy Assistant Secretary for Resource Management
                                                                                               Sharman Lancefield



                                                              HR Management Information &
                                                                  Enterprise Resource
                                                                 Management Planning
                                                                     Systems Staff
                                                                    Charles Butler




                                         Office of Human                                                                                                                      Office of Training
                                            Resources                                                                                                                              Services
                                         Emmett Aldrich                                                                                                                       William Johnson



                                Human Capital                                                                                                                                 Employee Career
                               Management Staff                                                                                                                                Development
                                Pamala Taylor                                                                                                                                    Division
                                                                                                                                                                              Reginald Hayes


                                                                                                                                                                                Leadership &
                                                                                                                                                                                Management
                                                                                                                                                                                  Division
                                              Compensation,          Headquarters                                        Executive                         Human Resources      Mia Beckett
 Headquarters      Field Staffing &            Organization            Labor &               Field Labor &               Personnel          Employee       Policy, Research
   Staffing         Classification              Analysis              Employee                  Employee                Management        Service Center    & Development
& Classification       Division               & HR Systems            Relations             Relations Division            Division        Karen Bruno          Division       Program Technical
   Division           Jim Fruge                 Division               Division             Carlos Osegueda           Earnestine Pruitt                       Lou Reese       Training Division
 Vivian White                                 William Rice          Carolyn Davis                                                                                              Francine Sutton




                                                                                                           22
2
Appendix B

     AUDITEE COMMENTS AND OIG’s EVALUATION

                  Auditee Comments




                         23
24
25
26
27
                           OIG Evaluation of Auditee Comments

Instead of commenting on our report as a whole, the Office of Administration/Office of Human
Resources (OA/OHR) only commented on our report recommendations.

Since our review and in response to our recommendations, OA/OHR has started making steps
towards addressing the concerns noted in our report. Specifically, OA has begun or plans to:

           revise or develop new Standard Operating Procedures regarding: the processing of
           new hire paperwork, monitoring of personnel action request reports, and salary
           overpayments and waiver requests processes;
           develop a tracking mechanism for the hiring process based on OPM's new "End to
           End" guideline;
           use the USA staffing eRecruitment to advertise HUD job announcements; and
           retrain staff on new hire paperwork requirements and job vacancy case file
           management.

Although some progress has been made, we will need additional documentation before OIG can
concur on the steps taken or in progress.




                                              28