oversight

Additional Details To Supplement Our Report on HUD's Fiscal Years 2013 and 2012 (Restated) Financial Statements

Published by the Department of Housing and Urban Development, Office of Inspector General on 2013-12-16.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

OFFICE OF AUDIT
FINANCIAL AUDITS DIVISION
HEADQUARTERS




           OFFICE OF THE CHIEF FINANCIAL
                      OFFICER
                  WASHINGTON, DC

     ADDITIONAL DETAILS TO SUPPLEMENT
     OUR REPORT ON HUD’S FISCAL YEARS
      2013 AND 2012 (RESTATED)FINANCIAL
                 STATEMENTS




2014-FO-0003                     DECEMBER 16, 2013
                                                        December 16, 2013

                                                        Audit Report Number: 2014-FO-0003




TO:            David P. Sidari, Acting Chief Financial Officer, F

                    \signed\
FROM:          Thomas R. McEnanly, Director, Financial Audits Division, GAF


SUBJECT: Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and
2012 (Restated) Financial Statements


    Attached is the U.S. Department of Housing and Urban Development (HUD), Office of
Inspector General’s (OIG) final results of our audit of HUD’s fiscal years 2013 and 2012
(restated) financial statements.

    HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.

    The Inspector General Act, Title 5 United States Code, section 8N, requires that OIG post its
publicly available reports on the OIG Web site. Accordingly, this report will be posted at
http://www.hudoig.gov.

   If you have any questions or comments about this report, please do not hesitate to call me at
202-402-8216.
                                            December 16, 2013
                                            Additional Details To Supplement Our Report on HUD’s
                                            Fiscal Years 2013 and 2012 Financial Statements




Highlights
Audit Report 2014-FO-0003


 What We Audited and Why                      What We Found

We are required to annually audit the       In our opinion, HUD’s fiscal years 2013 and 2012
consolidated financial statements of the    (restated) financial statements were fairly presented
U.S. Department of Housing and Urban        except for the (1) statement of budgetary resources
Development (HUD) in accordance             lines impacted by the accounting for programs from
with the Chief Financial Officers Act of    the Office of Community Planning and Development
1990 as amended. This report                (CPD) and Government National Mortgage
supplements our report on the results of    Association (Ginnie Mae) and (2) accounting and
our audit of HUD’s principal financial      presentation of balance sheet and statement of net cost
statements for the fiscal years ending      lines affected by HUD’s implementation of U.S.
September 30, 2013 and 2012                 Treasury cash management requirements in the Office
(restated). Also provided are               of Public and Indian Housing’s (PIH) Housing Choice
assessments of HUD’s internal controls      Voucher program. Our opinion is reported in HUD’s
and our findings with respect to HUD’s      Fiscal Year 2013 Agency Financial Report. The other
compliance with applicable laws,            auditors and our audit disclosed 4 material weaknesses,
regulations, and governmentwide policy      11 significant deficiencies in internal controls, and 5
requirements and provisions of              instances of noncompliance with applicable laws and
contracts and grant agreements. In          regulations, which are discussed further in this report
addition, we plan to issue a letter to      and the reports of the other auditors. 1
management describing other issues of
concern that came to our attention       Fiscal year 2013 is the 23rd year HUD has been
during the audit.                        subjected to a financial statement audit. The basis for
                                         the qualified opinions, material weaknesses, and
                                         significant deficiencies reported this year have root
  What We Recommend
                                         causes first reported in previous years. This year’s
                                         material weaknesses are due in large part to HUD’s
Current and prior-year                   longstanding weaknesses in internal controls over
recommendations are after each finding financial reporting. These control deficiencies are due
and in the Follow-up on Prior Audits     to HUD’s inability to establish a compliant control
section of this report. We identified    environment, implement adequate systems, recognize
$259 million in excess obligations and required changes, or identify appropriate accounting
are recommending that HUD transfer at principles and policies.
least $643.6 million in excess Section 8
funding held in public housing           1
                                           2014-FO-0002, Audit Report of the Federal Housing
agencies’ net restricted asset accounts. Administration’s Financial Statements, issued December 13, 2013
                                            and 2014-FO-0001, Audit Report of the Government National
                                            Mortgage Association Financial Statements, issued December 6,
                                            2013
                                               TABLE OF CONTENTS
Background and Objectives ..................................................................................................... 3
Material Weaknesses .............................................................................................................. 4
      Finding 1: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in
      Misstatements on the Financial Statements ............................................................................. 4
      Finding 2: PIH’s Housing Choice Voucher Program Cash Management Process Departed
      From GAAP and Treasury Requirements ............................................................................... 9
      Finding 3: Financial Management Systems Weaknesses Continued To Challenge HUD ... 17
      Finding 4: There Were Weaknesses in HUD’s Consolidated Financial Statement
      Preparation and Reporting Processes .................................................................................... 28
Significant Deficiencies ........................................................................................................ 34
      Finding 5: HUD Lacked GAAP-Compliant Policies for Accruals ...................................... 34
      Finding 6: Weaknesses in the Reporting of HUD’s Accounts Receivable Continued......... 39
      Finding 7: Weaknesses in HUD’s Administrative Control of Funds System Continued..... 44
      Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations .......... 49
      Finding 9: HUD’s Financial Management Governance Structure and Internal Controls Over
      Financial Reporting Were Ineffective ................................................................................... 62
      Finding 10: Weaknesses in HUD’s Rental Housing Assistance Program Monitoring
      Continued .............................................................................................................................. 68
      Finding 11: Financial and Program Management Controls Over the Emergency
      Homeowner’s Loan Program Were Weak ............................................................................ 76
      Finding 12: HUD’s Computing Environment Controls Had Weaknesses ........................... 81
Compliance with Laws and Regulations ....................................................................... 87
      Finding 13: HUD Did Not Substantially Comply with the Federal Financial Management
      Improvement Act ................................................................................................................... 88
      Finding 14: HUD Did Not Substantially Comply with the AntiDeficiency Act .................. 90
      Finding 15: HUD Did Not Comply With the HOME Investment Partnership Act.............. 93
      Finding 16: HUD Did Not Comply With the Federal Information Security Management Act
      ............................................................................................................................................... 96
Scope and Methodology ....................................................................................................... 97
Follow-up on Prior Audits ................................................................................................ 100
Appendixes ............................................................................................................................. 109
      A. Schedule of Questioned Costs and Funds To Be Put To Better Use ............................. 109
      B. Federal Financial Management Improvement Act Noncompliance, Responsible Program
         Offices, and Recommended Remedial Actions ............................................................. 110
      C. Auditee Comments and OIG’s Evaluation .................................................................... 112


                                                                          2
                      BACKGROUND AND OBJECTIVE

We are required by the Chief Financial Officers Act of 1990, as amended by the Government
Management Reform Act of 1994 and implemented by Office of Management and Budget
(OMB) Bulletin 14-02, Audit Requirements for Federal Financial Statements, to audit the U.S.
Department of Housing and Urban Development’s (HUD) principal financial statements or select
an independent auditor to do so. The objective of our audit was to express an opinion on the fair
presentation of these principal financial statements.
Management is responsible for

•      Preparing the financial statements in conformity with accounting principles generally
       accepted in the United States of America;
•      Establishing, maintaining, and evaluating internal controls and systems to provide
       reasonable assurance that the broad objectives of the Federal Financial Management
       Improvement Act of 1996 (FFMIA) are met; and
•      Complying with applicable laws and regulations.

In auditing HUD’s principal financial statements, we were required by Government Auditing
Standards to obtain reasonable assurance about whether HUD’s principal financial statements
were presented fairly, in accordance with generally accepted accounting principles (GAAP), in
all material respects. We believe that our audit provides a reasonable basis for our opinion.

In planning our audit of HUD’s principal financial statements, we considered internal controls
over financial reporting by obtaining an understanding of the design of HUD’s internal controls,
determined whether these internal controls had been placed into operation, assessed control risk,
and performed tests of controls to determine our auditing procedures for the purpose of
expressing our opinion on the principal financial statements. We are not providing assurance on
the internal controls over financial reporting. Consequently, we do not provide an opinion on
internal controls. We also tested compliance with selected provisions of applicable laws,
regulations, and government policies that may materially affect the consolidated principal
financial statements. Providing an opinion on compliance with selected provisions of laws,
regulations, and government policies was not an objective, and, accordingly, we do not express
such an opinion.

This report is intended solely for the use of HUD management, OMB, and Congress. However,
this report is a matter of public record, and its distribution is not limited.




                                                3
                                MATERIAL WEAKNESSES


Finding 1: CPD’s Formula Grant Accounting Did Not Comply With
GAAP, Resulting in Misstatements on the Financial Statements
HUD’s Office of Community Planning and Development’s (CPD) formula grant program
accounting departed from GAAP, due to its use of the first in, first out (FIFO) method to
disburse obligations. The information system used, Integrated Disbursement Information System
(IDIS) Online, a grants management system, was not designed to comply with Federal financial
management system requirements. As a result of FIFO, budget year grant obligation balances
were misstated, and disbursements were made using an incorrect general ledger attribute. Due to
the inability of IDIS Online to provide an audit trail of all of the financial events affected by the
FIFO method, the financial information within IDIS Online, which was affected by FIFO and
transferred to HUD’s core financial system and used to prepare its consolidated financial
statements, could not be quantified. Due to the magnitude and pervasiveness of the funds
susceptible to the FIFO method and the noncompliant internal control structure in IDIS Online,
the combined statement of budgetary resources and the consolidated balance sheet were not
prevented from being materially misstated.


 IDIS Online’s Accounting for
 Transactions Was a Departure
 From GAAP Accounting
 Standards

               Due to inadequate budget controls and a disregard for the United States Standard
               General Ledger (USSGL) attributes at the transaction level when making
               disbursements for CPD’s formula grant disbursements, the use of the FIFO
               method was

                   •   A departure from Federal financial accounting standards and GAAP;
                   •   Noncompliant with budgetary internal control requirements; and
                   •   Noncompliant with the overall conceptual framework established by the
                       Federal financial management laws and guidance issued by the standard
                       setters.
               During fiscal years 2013 and 2012, $5.1 billion and $5.6 billion, respectively, in
               disbursements were susceptible to this FIFO method and will be reported in
               HUD’s consolidated financial statements. These material amounts on the
               combined statement of budgetary resources and consolidated balance sheet were
               not presented in conformity with generally accepted accounting principles.



                                                 4
                 HUD’s Office of Inspector General (OIG) researched accounting literature
                 directly applicable to Federal agency accounting, such as Federal Financial
                 Accounting Standards, Federal financial management statutes, authoritative
                 literature from the U.S. Government Accountability Office (GAO), the U.S.
                 Treasury’s Financial Management Division, and OMB. Based on this research,
                 OIG determined that specific authoritative literature applicable to the use of the
                 FIFO method for disbursing obligations for formula grant programs was absent.
                 To that end, in accordance with the Federal Accounting Standards Advisory
                 Board (FASAB) Handbook, OIG believes that HUD should report the
                 disbursement of obligations for formula grant programs with expiring Treasury
                 account fund symbols (TAFS) 2 by selecting the same established accounting
                 principle for disbursing obligations for categorical grant programs and
                 administrative obligations with expiring TAFS and, therefore, matching the
                 disbursement to the underlying obligation.

                 Through its careful study of the conceptual framework, OIG has determined that
                 the use of the FIFO method was at odds with the concepts used to set the
                 standards.

                 In OMB’s role of ensuring that agency reports, rules, testimony, and proposed
                 legislation are consistent with the President’s budget and with Administration
                 policies and through its oversight and coordination of the Administration’s
                 procurement, financial management, and information and regulatory policies,
                 OMB notified HUD to discontinue the use of FIFO.

                 The recording of financial events, as well as the preparation of standard external
                 reports that HUD is required to submit to OMB and the U.S. Treasury, are
                 reported for each TAFS through the USSGL. Based upon those requirements,
                 OIG believes that the TAFS is an integral attribute, which must be included as
                 part of each financial event, including disbursement of obligations. Therefore, the
                 use of FIFO by IDIS Online, which disregards the appropriate TAFS when
                 determining from which account to make a disbursement, was not properly
                 recording the financial event at the transaction level as required by OMB and
                 Treasury. The transactions were incorrectly reported from IDIS Online to the
                 core financial systems used to prepare the combined statement of budgetary
                 resources and consolidated balance sheet.

                 CPD formula grants are mandated through Congress’s appropriation. Once the
                 appropriation has been apportioned by OMB, in accordance with the program’s
                 funds control regulations, as mandated by the Antideficiency Act, the funds are
                 allotted and assigned. Based upon a formula calculation, the assignment is
                 reserved to individual eligible grantees. These grantees then execute a grant
                 award, or obligating agreement, which then obligates the funds. The grant

2
  The Treasury appropriation fund symbol (TAFS) refers to the separate Treasury accounts for each appropriation
title based on the availability of the resources in the account. The TAFS is a combination of Federal account symbol
and availability code (for example, annual, multiyear, or no-year).

                                                         5
agreements identified the amounts and purposes of the grant, the obligations of
the parties to the award, and other terms and served as the legal point of the
obligation, requiring HUD to make disbursements within the agreement terms. In
accordance with Federal budgetary accounting laws and accounting standards, the
apportionments, allotments, assignments, reservations, and obligations require
specific accounting entries to be recorded using the USSGL and require the use of
the same TAFS attribute associated with the original appropriation law. That
TAFS defined the source of funds and established the timeframes for when the
funds are canceled and no longer available for obligation or expenditure for any
purpose in accordance with the National Defense Authorization Act of 1991.
OIG believes that the same source TAFS, which remained constant and was used
to record the other financial transaction events related to the obligation, should
also be used to record the disbursements against that obligation.

The FIFO logic used by IDIS Online was implemented before the enactment of
the public laws that affect Federal financial accounting standards and
requirements. After the enactment of these public laws, the Chief Financial
Officer did not ensure that CPD made all of the necessary changes to ensure that
the system complied with these requirements. FIFO was implemented across
almost all of the components and rules in the system when the funds were no-year
money, while the system’s main purpose was for the program office’s
administration of CPD grants. FIFO was embedded throughout IDIS Online and
affected the events that led to financial transactions.

When FIFO was used to disburse obligations, disbursements were not matched to
obligations, and obligations were improperly liquidated. Arbitrarily liquidating
the obligation funded from the oldest available budget fiscal year appropriation
source or TAFS, rather than matching it to the correct obligation and
corresponding TAFS, allows costs and disbursements to be recorded under
obligations recorded under soon-to-be canceled TAFS. When TAFS are canceled,
the unused funds are remitted to Treasury, and the fund balance with Treasury
reported on the consolidated balance sheet is reduced. In addition, the unpaid
obligations, end of year, which are later brought forward to the unpaid obligation,
brought forward balances on the combined statement of budgetary resources in
the next fiscal year, are misstated because the disbursements were recorded
against the obligation under the incorrect TAFS.

CPD was in the early stages of developing a plan to prospectively remove FIFO
from IDIS Online. CPD evaluated the impact of removing FIFO on program
regulations, grantees, and staff and estimated a cost and completion timeline of
early fiscal year 2015. The current draft plan, however, did not specifically
address in detail all of OIG’s previous recommendations that remain open, nor did
it describe how the TAFS for each accounting transaction will be recorded,
remain constant, and be maintained to ensure compliance and reporting according
to GAAP. It also did not reference Federal system requirements or criteria that
will be used to modify the system. Additionally, as the plan was prospective, it

                                 6
             did not address the $10.4 billion in undisbursed obligations as of September 30,
             2013, already affected by FIFO in IDIS Online. To that end, until CPD fully
             implements its corrections to the system, OIG will annually review undisbursed
             obligations to determine whether material obligation balances in IDIS Online are
             affected by FIFO, are included in HUD’s core financial systems, and prevent the
             combined statement of budgetary resources and consolidated balance sheet from
             being presented in conformity with GAAP.

Conclusion

             OIG determined that the use of the FIFO method is (1) a departure from Federal
             accounting standards and (2) noncompliant with budgetary internal control
             requirements and the overall conceptual framework established by the Federal
             financial management laws and guidance issued by the standard setters.
             Specifically, the use of FIFO by the information system, IDIS Online, made it
             noncompliant with OMB Circular A-127, Federal Financial Management Systems
             Requirements, due to the inadequate budget controls and misuse of USSGL
             attributes at the transaction level for CPD’s formula grant disbursements.

             During fiscal year 2013, $5.1 billion in disbursements was susceptible to this
             FIFO method, which is not in accordance with GAAP, and will be reported in
             HUD’s consolidated financial statements. It is due to this material amount that
             the combined statement of budgetary resources and consolidated balance sheet
             have been prevented from conforming with GAAP.


Recommendations

             We recommend the Assistant Secretary for the Office of Community Planning
             and Development

             1A.    Develop and implement a detailed remediation action plan to ensure that
                    grant management systems eliminate the FIFO methodology in its entirety.
                    The plan should (1) explain how the budget fiscal year-TAFS for each
                    accounting transaction (project and activity setup, commitment,
                    disbursement, etc.) will be recorded, remain constant, and be maintained,
                    (2) reference Federal system requirements and criteria, and (3) include
                    resources, specific remedies, and intermediate target dates necessary to
                    bring the financial management system into substantial compliance.

             1B.    Establish controls within the system, which provide an audit trail of the
                    use of the funds by the budget fiscal year-TAFS.




                                              7
We recommend that the Acting Chief Financial Officer

1C.    Provide oversight of CPD’s system implementation or modification to
       ensure that Federal financial management accounting standards are
       embedded into the system so that the information transferred from grant
       management systems to HUD’s core financial systems comply with these
       standards, are recorded in HUD’s consolidated financial statements in
       accordance with Federal GAAP, and ensure that compliant administrative
       control of funds for its formula grant programs is established.




                               8
Finding 2: PIH’s Housing Choice Voucher Program Cash Management
Process Departed From GAAP and Treasury Requirements
HUD’s new cash management process for the Housing Choice Voucher program departed from
Federal GAAP and treasury cash management requirements. When HUD implemented this
process, management did not consider its impact on the financial reporting process. HUD also
did not establish internal controls to ensure accurate and reliable financial reporting.
Consequently, until OIG identified the issue, HUD omitted material transactions from significant
financial events from the consolidated financial statements in fiscal years 2012 and
2013. Further, under HUD’s processes, public housing authorities (PHA) still held funds in
excess of their immediate disbursing needs, which violated Treasury cash management
regulations.


    HUD Did Not Transition PHA
    NRA Accounts or Recognize Its
    Intent To Collect the Funds in
    Its Financial Statements

                  Before January 1, 2012, HUD disbursed 100 percent of its Section 8 renewal
                  budget authority to PHAs in 12 monthly payments, and PHAs maintained any
                  excess in a net restricted asset (NRA) account. Using this method, excessive
                  funds accumulated in PHA accounts. Based on OIG recommendations and
                  HUD’s requests for reallocation, Congress mandated two large budget offsets. 3
                  To eliminate these excessive accumulations, in fiscal year 2012, Congress, in a
                  conference report, required that HUD follow Treasury regulations 4 on cash
                  management for the Section 8 Housing Choice Voucher program. These
                  regulations require HUD to monitor PHAs to ensure that Federal cash is not
                  maintained in excess of immediate housing assistance payment disbursement
                  needs.

                  To comply with Treasury regulations, HUD planned to stop PHA NRA fund
                  accumulation by December 31, 2011, and transition the existing excess balances
                  to HUD’s reserve account by December 31, 2012. HUD established its intent to
                  collect the PHA NRA reserves through the issuance of Office of Public and


3
  Congress mandated rescission of $1.5 billion in 2008 and 2009 and $650 million in 2012.
4
  Treasury Financial Manual, vol. 1, part 4A, section 2045.10 – It is the responsibility of grantor agencies to monitor
the cash management practices of their recipient organizations to ensure that Federal cash is not maintained by them
in excess of immediate disbursing needs. Agencies must establish systems and procedures to assure that balances
are maintained commensurate with immediate disbursing needs, excess balances are promptly returned to the
Treasury, and advance funding arrangements with recipient organizations unwilling or unable to comply are
terminated.

                                                           9
                 Indian Housing (PIH) Notice 2011-67 5 and a formal letter to PHA executive
                 directors stating that PHA NRA funds as of December 31, 2012, would be
                 transitioned to HUD reserves and should be readily available. 6 The issuance of
                 the notice established the accounting recognition point, at which the PHA NRA
                 reserve balance should have been recognized as an asset on HUD’s financial
                 statements in accordance with Statements of Federal Financial Accounting
                 Standards 1, Accounting for Selected Assets and Liabilities.

                 However, HUD failed to correctly account for these financial transactions during
                 fiscal years 2012 and 2013, resulting in departures from Federal GAAP. OIG
                 discussed this issue with PIH during fiscal years 2012 and 2013 and formally
                 notified the Office of the Chief Financial Officer (OCFO) in early September
                 2013 of its concerns related to the incomplete transition of the PHA-held NRA
                 balances to HUD and recognition of these balances as a HUD-held asset.

                 Since HUD did not properly account for transactions as they occurred during the
                 cash management process, in late October 2013, OCFO adjusted its fiscal year
                 2013 beginning advance balance by $986 million and its expenses by $534
                 million, resulting in an ending advance balance of $451 million for fiscal year
                 2013. Subsequently in November 2013, OCFO recognized a beginning advance
                 balance of $1.8 billion and an expense of $902 million, resulting in an ending
                 advance balance of $986 million for fiscal year 2012. However, OCFO did not
                 inform the OIG about the adjustment until December 2013. These adjustments
                 were made based on estimates provided by PIH management. OCFO indicated
                 that these estimates were the only supportable transactions and proceeded with the
                 adjustments, which were based on beginning and ending PHA NRA balance
                 estimates. OIG could not determine the accuracy of these estimates due to several
                 factors: (1) OCFO and PIH did not provide their methodology and assumptions
                 used to support their estimate until mid-November 2013; (2) PIH could not
                 provide proper accounting records to support the activity and expenses that
                 occurred throughout the year; (3) the estimates were based on Voucher
                 Management System (VMS) 7 data, which are PHA self-reported data and not
                 adequately verified by HUD, in fiscal years 2012 or 2013; 8 and (4) the timing of
                 the adjustment did not allow sufficient time for audit procedures that we deemed
                 necessary to be completed. Since we could not determine the reasonableness of
                 these estimates, we could not form an opinion on the reliability of the
                 adjustments.

5
  PIH Notice 2011-67, issued December 9, 2011, Implementation of New Cash Management Requirements for the
Housing Choice Voucher Program, states that existing NRA balances held by PHAs will be transitioned to the cash
management process and the program reserves.
6
  On February 1, 2013, HUD issued a memorandum to PHA executive directors to prepare for the transition of the
excess funds as of December 2012. NRA balances reported by December 31, 2012, were to be extracted from VMS
and used as the basis for establishing HUD-held reserves. The amount reported would be reduced by subsequent
legitimate housing assistance expenses.
7
  VMS is a Web-based tool through which PHAs report monthly program data, including housing assistance
expenditures, to HUD.
8
  See finding 10 for further information on our concerns with VMS data.

                                                      10
                 In addition to HUD’s departures from Federal GAAP, as of September 30, 2013,
                 HUD had not completed the transition of PHA NRA reserves to HUD-held
                 reserves; therefore, HUD did not fully comply with Treasury’s cash management
                 regulations. HUD intended to complete the transition; however, as of September
                 30, 2013, a final transition plan and timeline had not been approved. PIH
                 management originally delayed the transition so that it would not complicate the
                 2012 offset for the rescission, which was congressionally mandated in the fiscal
                 year 2012 HUD appropriations bill. 9 Then, PIH’s Assistant Secretary further
                 delayed the transition because she assumed that in addition to the 2012 rescission,
                 the across-the-board and sequestration rescissions ordered in March 2013 would
                 sufficiently decrease the PHAs’ reserves. 10

                 HUD should have transitioned the excess NRA funds to HUD-held reserves to
                 comply with Treasury cash management rules and safeguard its assets. Under
                 HUD’s process, PHAs have immediate access to their excess NRA funds, and
                 there are not sufficient controls in place to ensure that these funds are used only
                 for eligible housing assistance expenses. When HUD performed the offset for the
                 2012 rescission, 71 PHAs reported having insufficient funds to cover the offset.
                 HUD’s Quality Assurance Division reviewed 65 of these PHAs 11 and found
                 several discrepancies between the NRA excess cash PHAs reported to HUD and
                 the amount on hand. Of the 65 PHAs, the Division found that 45 PHAs
                 underreported their cash by $19.2 million and 46 PHAs did not have $10.8
                 million (38 percent) of the NRA they reported to HUD. Further the Division’s
                 review of 29 of the 65 PHAs revealed that 18 PHAs should have reported an
                 additional $5.3 million in NRA and 10 PHAs overreported their NRA by
                 $535,746. HUD’s Real Estate Assessment Center also reported that the
                 Division’s review of 32 PHAs in fiscal year 2011 identified 19 PHAs that
                 understated NRA by $13.6 million and 13 PHAs that overstated NRA by $2.7
                 million. These reviews showed that HUD did not have sufficient controls in place
                 to ensure that NRA balances were properly valued or that NRA funds were spent
                 properly.

                 Since HUD had not transitioned these funds to HUD-held reserves and did not
                 have sufficient controls in place to safeguard them at the PHA level, they were
                 more susceptible to fraud, waste, and abuse. Additionally, since HUD had not
                 transitioned these funds, PHAs that did not have the cash reserves as reported may
                 not have been held accountable to repay the funds to HUD.



9
  Consolidated and Further Continuing Appropriations Act, 2012, Public Law 112-55, issued November 18, 2011
10
   Across-the-board rescission stated in Consolidated and Further Continuing Appropriations Act, 2013, Public Law
113-6, issued March 26, 2013. Sequestration cuts were ordered in an executive order, issued March 1, 2013. The
across-the-board rescission treasury warrant date was May 29, 2013, and the sequestration rescission treasury
warrant date was August 24, 2013.
11
   The Quality Assurance Division could not review six of the PHAs because two did not respond to Division
requests and four were transferred.

                                                       11
Cash Reconciliations Were Not
Completed in a Timely Manner
or Recognized in HUD’s
Financial Statements

           Beginning in January 2012, to comply with Treasury requirements, HUD stopped
           disbursing 1/12 of the total renewal budget authority monthly and began
           disbursing only the amount HUD determined the PHA needed based on prior-
           quarter (VMS) data. Amounts that were not disbursed remained in HUD-held
           reserves for the PHA. HUD used cash reconciliations to determine the
           differences between HUD disbursements and PHA actual housing assistance
           expenses. Any shortages owed to the PHA were later disbursed by HUD, and any
           excesses were offset in a future disbursement.

           Although HUD performed quarterly cash reconciliations, its manual process did
           not allow for recognition of financial transactions or timely adjustments to PHA
           disbursements. Our review found that adjustments to future disbursements
           occurred 6-12 months after the quarter ended, allowing PHAs to hold additional
           excess funds for up to 12 months, which is contrary to the objectives of cash
           management and congressional intent. Further, the excesses or shortages that
           were identified in this process were not recognized in HUD’s financial systems or
           accounting record as required by Federal GAAP. Any excesses or shortages
           identified through the quarterly cash reconciliation process met the definition of
           an account receivable or account payable in accordance with Statement of Federal
           Financial Accounting Standards (SFFAS) 1 and should have been recognized at
           the time the amounts were identified. As of September 30, 2012, excesses and
           shortages identified should have resulted in receivables and payables amounting
           to $154 million and $19 million, respectively. As of June 30, 2013, excesses and
           shortages identified should have resulted in receivables and payables amounting
           to $29 million and $69.8 million, respectively. Due to the delays in preparing the
           cash reconciliations, the necessary information to estimate figures as of
           September 30, 2013, was not available and could not be estimated.

Moving to Work PHAs Were
Not Included in the Cash
Management Process

           In addition to the issues noted above, we found that the cash management process
           did not include all PHAs. Specifically, quarterly cash reconciliations were not
           completed for 35 Moving to Work (MTW) PHAs, which HUD paid more than $3
           billion during fiscal years 2012 and 2013. These payments to MTW PHAs
           represented approximately17.2 and 16.2 percent of fiscal year 2012 and 2013
           Section 8 program funding, respectively.



                                           12
                 PIH could not complete these reconciliations because PHAs are required to report
                 only their housing assistance expenses in VMS; they are not required to report
                 non-HAP expenses. Unlike other PHAs, MTW PHAs are allowed to combine
                 operating funds, capital funds, and housing choice voucher funds. Since PHAs
                 are not required to report expenses for all of these funds in VMS, PIH could not
                 accurately perform its reconciliations. PIH indicated that it was in the process of
                 updating VMS to allow for separate reporting. PIH also reported that it sent to
                 OMB for approval a memorandum, which would require that MTW PHAs report
                 non-housing assistance expenses. PIH reported that without OMB approval, PIH
                 could not require MTW PHAs to report non-housing assistance expenses under
                 the Paper Reduction Act.

                 Since PIH could not perform reconciliations for MTW PHAs, these PHAs may
                 have been holding funds in excess of their immediate disbursing needs.
                 Additionally, PIH could not determine any excesses (accounts receivable) or
                 shortages (accounts payable) that should have been recognized in HUD’s
                 accounting records and financial statements.

     Internal Controls Over the
     Cash Management Process
     Were Weak

                 HUD failed to implement adequate internal controls over the cash management
                 process to ensure complete, accurate, and reliable financial reporting as required
                 by OMB Circular A-123. 12

                 First, PIH’s cash management process lacked an automated process. The cash
                 reconciliation master file used to determine appropriate adjustments was manual,
                 maintained on an Excel spreadsheet by one individual, and the integrity of the
                 data was not properly protected or secured. Additionally, the process to perform
                 adjustments to future disbursements in HUD’s Centralized Accounting and
                 Program System (HUDCAPS) was also manual. Due to HUDCAPS’ functional
                 limitations, HUD could not capture and recognize transactions resulting from the
                 quarterly reconciliations because HUDCAPS operates only on a fiscal year basis
                 and the Section 8 Housing Choice Voucher program funding is on a calendar year
                 basis.


12
   Section II, part A, states, “Reliability of financial reporting means that management can reasonably make the
following assertions:
     • All assets, liabilities, and transactions that should be reported have been included and no unauthorized
         transactions or balances are included (completeness);
     • The financial report is presented in the proper form and any required disclosures are present (presentation
         and disclosure);
     • All assets have been safeguarded against fraud and abuse; and
     • Documentation for internal control, all transactions, and other significant events is readily available for
         examination.”

                                                       13
                  With more than 2,200 PHAs that require a quarterly reconciliation and potential
                  adjustment, the amount of resources available was limited compared to the
                  vastness of the task. Lack of an automated process substantially increased the risk
                  for human error. Further, a lengthy manual reconciliation process prevented
                  recognition of accounting transactions from financial events from being reflected
                  accurately and in a timely manner in the core financial system as required by
                  OMB Circular A-127 and FFMIA. This manual process also did not provide an
                  appropriate accounting and audit trail or provide the data integrity to ensure the
                  accuracy of transactions as required by OMB Circular A-123. 13 The insufficient
                  audit trail hampered our ability to trace and validate adjustments as part of our
                  audit work.

                  Secondly, PIH failed to develop detailed operating procedures to govern the cash
                  management process in time for our consideration. PIH developed a general plan;
                  however, it did not include important factors such as yearend cutoff procedures
                  and steps to verify the cash reconciliations or posting of transactions to
                  HUDCAPS. Due to the manual nature of the process, procedures and internal
                  controls are essential in ensuring the cash management process is implemented
                  accurately and consistently.

     HUD’s Yearend Accounting
     Adjustments Failed to Mitigate
     Impact of Inadequate
     Accounting on Financial
     Statements

                  As previously discussed, HUD did not appropriately recognize its intent to collect
                  PHA NRA reserves or record excesses and shortages from the cash reconciliation
                  process in its accounting records or financial statements during the fiscal year.
                  This condition was due primarily to the lack of OCFO oversight, planning,
                  communication, and coordination in implementing this significant program
                  change. OCFO appeared to first become aware of the problem when OIG raised
                  this as an audit issue in August 2013. The Chief Financial Officers Act of 1990
                  (CFO Act) specifically states that it is the responsibility of the Chief Financial
                  Officer to direct, manage, and provide policy guidance and oversight of all agency
                  financial management personnel, activities, and operations. However, since
                  OCFO did not oversee this process, it could not adequately consider financial
                  accounting and reporting requirements. Additionally, PIH did not complete a
                  required front-end risk assessment, 14 which could have highlighted the need for
                  financial statement recognition.

13
   OMB Circular A-123, section I, part A: “management should have a clear, organized strategy with well-defined
documentation processes that contain an audit trail, verifiable results, and specify document retention periods so that
someone not connected with the procedures can understand the assessment process.”
14
   HUD Handbook 1840.1, chapter 8, states that a front-end risk assessment is a formal, documented review by
management to determine the susceptibility of a new or substantially revised program or administrative function to
waste, fraud, abuse, and mismanagement. Its purpose is to detect conditions that may adversely affect the

                                                          14
                  Since HUD failed to properly account for cash management financial transactions
                  at the start of this process, HUD misstated its balance sheet and statement of net
                  cost of operations in fiscal years 2012 and 2013. Although HUD eventually
                  estimated an advance adjustment, the issues identified during the 2012 offset,
                  other Quality Assurance Division reviews, 15 and Real Estate Assessment Center
                  studies indicate that the advance recorded could have been inaccurate. Due to the
                  timing of the accounting adjustments performed by OCFO and the lack of
                  accounting records to support the activity, we could not determine the
                  reasonableness of the estimates made by management. However; we believe
                  these amounts to be material to the financial statements.

 Conclusion

                  When PIH implemented its new cash management process, it did not establish
                  adequate internal controls or consider its impact on financial reporting. In
                  addition, cash management was not fully implemented as of September 30, 2013.
                  Consequently, accounting transactions resulting from significant financial events
                  were not recognized in the core financial system or consolidated financial
                  statements, MTW PHAs were not included in the process, and PHAs had access
                  to funds in excess of their immediate disbursing need. In efforts to address the
                  need to properly account for the activity, OCFO performed material accounting
                  adjustments, which could not be sufficiently evaluated by OIG in time for the
                  issuance of the financial statements. As a result, OIG could not determine the
                  reasonableness of these material adjustments. PIH needs to fully implement
                  Treasury’s cash management regulations by immediately transferring PHA NRA
                  excess funds and work with OCFO to ensure accurate and timely financial
                  reporting of all financial events resulting from the process.

 Recommendations

                  We recommend that the Assistant Secretary for Public Housing, in coordination
                  with the Acting Chief Financial Officer,

                  2A.      Transition the PHA NRA excess funds, which are as much as $643.6
                           million as of June 30, 2013, to HUD’s control as soon as possible to
                           safeguard the program resources.

                  2B.      Identify PHAs with insufficient cash to cover their NRA and order the
                           repayment of funds.

achievement of program objectives and to provide reasonable assurance that the following goals will be met:
safeguarding of assets, effectiveness and efficiency of operations, reliability of financial reporting, and compliance
with applicable laws and regulations. A front-end risk assessment must be conducted for programs with significant
changes in the way program funds are delivered to participants.
15
   See finding 10 for further information on other Quality Assurance Division VMS reviews.

                                                          15
2C.    Implement a cost-effective method for automating the cash management
       process to include an electronic interface of transactions to the standard
       general ledger.

We recommend that the Acting Chief Financial Officer

2D.    Review and validate the fiscal years 2012 and 2013 data that support the
       estimated adjustments recorded in the accounting records from the cash
       management process to ensure that all factors and assumptions are
       adequately supported and comply with GAAP.

2E.    Review the cash management process to identify all financial events to be
       recognized in accordance with GAAP. Establish procedures to account
       for the cash management activity in a timely manner in compliance with
       GAAP.

2F.    Require PIH to perform a front-end risk assessment on the the Housing
       Choice Voucher program due to the significant change to the program to
       ensure that the program meets cash management requirements.

2G.    Ensure that PIH’s automation of its cash management process complies
       with Federal financial management requirements.




                                16
Finding 3: Financial Management Systems Weaknesses Continued To
Challenge HUD
Although HUD had taken steps and efforts were underway in fiscal year 2013 to address some of
the OIG’s concerns, weaknesses in HUD’s financial management systems remained a serious
problem. HUD continued to face these challenges due to shortcomings in its financial
management systems and the lack of system capabilities and automation. As a result of HUD’s
inherent system limitations and weaknesses, HUD’s financial management systems could not be
readily accessed and used by financial and program managers without extensive manipulation
and excessive manual processing. This situation negatively impacted management’s ability to
perform required financial management functions and efficiently manage financial operations of
the agency, which translated to lost opportunities for achieving mission goals and improving
mission performance.


     Impediments to HUD’s
     Substantial Noncompliance
     With FFMIA Continued

                   As reported in previous audits of HUD’s financial statements and in fiscal year
                   2013, weaknesses in HUD’s financial management systems continued to affect
                   HUD’s substantial compliance with FFMIA (see OIG’s assessment of HUD’s
                   compliance with laws and regulations related to FFMIA 16). One of the stated
                   goals of FFMIA is for the agency to have a system that can generate reliable,
                   useful, and timely information, including cost data, with which to make informed
                   decisions and helps ensure accountability on an ongoing basis.

                   • HUD lacked an integrated core financial system. Since fiscal year 1991, OIG
                     has reported on the lack of an integrated core financial system, which impeded
                     HUD’s ability to generate and report information needed to both prepare
                     financial statements and manage operations accurately and in a timely manner
                     on an ongoing basis. Due to a lack of system functionality in HUD’s general
                     ledger, HUDCAPS, HUD had to extract data from HUDCAPS into the
                     Financial Datamart and then use a financial tool, Hyperion, to manipulate
                     HUDCAPS accounting data from the Financial Datamart to produce the
                     agencywide financial statements. This process required extensive and time-
                     consuming manual reconciliation procedures of three disparate systems
                     (HUDCAPS, Financial Datamart, and Hyperion) and expended major effort
                     and resources to develop information that a core financial system should be
                     able to provide on a daily or recurring basis.

                      Additionally, to prepare and consolidate component entities’ financial
                      statements and notes, HUD required the Federal Housing Administration

16
     Public Law 104-28, dated September 30, 1996

                                                   17
                       (FHA) and the Government National Mortgage Association (Ginnie Mae) to
                       submit financial statement information on spreadsheet templates, which were
                       loaded into a software application. Also, all consolidating notes and
                       supporting schedules had to be manually posted, verified, reconciled, and
                       traced. To overcome these system deficiencies with respect to the preparation
                       of its annual financial statements, HUD again relied on extensive compensating
                       procedures that were costly, labor intensive, and not always efficient. Because
                       of HUD’s nonintegrated systems, errors in the consolidation process occurred,
                       and HUD’s core financial systems did not support management’s need for
                       timely and accurate information for day-to-day decision making.

                   • HUD’s financial systems could not provide managerial cost data. In fiscal
                     year 2006, GAO reported 17 that HUD’s financial systems did not have the
                     functionality to provide managerial cost accounting across its programs and
                     activities. This lack of functionality resulted in the lack of reliable and
                     comprehensive managerial cost information on its activities and outputs. HUD
                     lacked an effective cost accounting system that was capable of tracking and
                     reporting the costs of HUD’s programs in a timely manner to assist in
                     managing its daily operations. This condition rendered HUD unable to
                     produce reliable, cost-based performance information. We noted no
                     improvement in this area during the fiscal year 2013 audit.

                  • HUD’s core financial system did not meet FFMIA’s system requirements.
                    HUDCAPS was not compliant with core financial system requirements for the
                    payment management function. The core financial system requirements state
                    that the agency core financial system must contain automated processes to
                    perform payment management functions. We found that HUDCAPS did not
                    import or update vendor data in accordance with requirements and did not meet
                    all accounts payable, invoicing, disbursing, and payment follow-up
                    requirements related to how payments were processed. For instance,
                    HUDCAPS did not record full or partial receipt and acceptance of goods and
                    services by document line item; perform matching options that matched
                    invoices to obligations, receiving reports, and acceptance data; and validate
                    invoice period of performance and invoice delivery and performance dates and
                    was not used to calculate the payment amount, including discounts, interest,
                    and penalties. To be FFMIA compliant, a core financial application or an
                    application performing core financial functions must comply with core
                    financial system requirements. Therefore, HUDCAPS was noncompliant with
                    FFMIA because it did not meet core financial system requirements for payment
                    processing.

                   •   HUD’s procurement applications did not meet FFMIA’s system requirements.
                       In fiscal year 2006, 18 we audited the HUD Procurement System (HPS) and the
                       Small Procurement System (SPS) and determined them to be noncompliant
17
     GAO-06-1002R, Managerial Cost Accounting Practices, dated September 21, 2006
18
     Audit Report No. 2007-DP-0003: Review of HUD’s Procurement Systems, issued January 25, 2007

                                                      18
                      with Federal financial management requirements. We determined that HUD’s
                      use of HPS and SPS as part of its integrated financial management system did
                      not adequately manage and monitor procurement transactions. One of the
                      issues specifically cited was that there was no payment information within
                      either system or their interfaces with HUDCAPS. The Office of the Chief
                      Procurement Officer (OCPO) worked to improve those applications and to
                      implement the HUD Integrated Acquisition Management System (HIAMS) as
                      a replacement application between fiscal years 2007 and 2011. OCPO began
                      a phased implementation of HIAMS in October of 2011. The implementation
                      was completed in January 2012.

                  OMB Circular A-127’s definition of a financial management system includes the
                  core financial systems and the financial portions of mixed systems necessary to
                  support financial management. It also defines a mixed system as an information
                  system that can support both financial and nonfinancial functions. Procurement
                  applications, such as HIAMS, are defined as mixed financial systems. Agencies
                  are required to adopt the standard government business processes included in the
                  core financial system requirements documentation. The core system requirements
                  do not apply to mixed systems unless the systems perform the core system
                  function. Acquisition systems are specifically cited within the Framework for
                  Federal Financial Management Systems model. These systems must be able to
                  provide consistent, standardized information for program managers, financial
                  managers, agency executives, and oversight organizations, and they must meet
                  Federal statutes, regulations, and standards. Core functional requirements require
                  data from both the financial and acquisition systems to perform edits and
                  validations in support of the payment process.


                  •   HIAMS did not interface with HUDCAPS to perform payment management
                      function. As part of the review we performed on HUDCAPS, we determined
                      that HIAMS did not send acquisition data required to perform core financial
                      system payment management functions to HUDCAPS. While Federal
                      requirements allow for automated and manual processes, both core financial
                      system and Joint Financial Management Improvement Program (JFMIP) 19
                      acquisition interface requirements mandate that the payment management
                      functions be performed through an automated process. There was no interface
                      between HIAMS and HUDCAPS that would allow the applications to perform
                      the following core financial functions: define duplicate vendor invoice edit
                      criteria and validate for duplicate invoices; validate payments to Central


19
  JFMIP is a joint undertaking of Treasury, GAO, OMB, and the Office of Personnel Management, working in
cooperation with one another, with other agencies, and with the private sector to improve financial management in
the Federal Government. Acquisition/Financial Systems Interface Requirements is one of a series of functional
systems requirements documents published by JFMIP dealing with Federal financial management systems. It
addresses the shared information requirements between Federal financial and acquisition management systems.
Specifically, it identifies existing governmentwide statutory and regulatory requirements associated with the mutual
functional interfaces between finance and acquisition.

                                                         19
                      Contractor Registry20 vendors; perform matching options that match invoices
                      to obligation, receiving reports, and acceptance data; and validate invoice
                      period of performance and invoice delivery and performance dates. In
                      addition, HIAMS did not interface with HUDCAPS for payment (that is,
                      acceptance and delivery) data; therefore, the required payment processing core
                      financial functions were not completed through an automated process as
                      mandated. Data within both applications (HIAMS and HUDCAPS) are
                      required to meet the core financial system requirements for payment
                      processing. HUD’s use of the HIAMS application as part of its integrated
                      financial management system did not adequately manage and monitor
                      procurement transactions. HUD’s implementation of HIAMS did not provide
                      the agency with the data necessary to automate the performance of the
                      payment management core financial functions. Instead, the process was
                      performed manually. HUD invested more than $10 million to implement the
                      HIAMS application between fiscal years 2011and 2013. However, the
                      implementation of the HIAMS application did not improve HUD’s financial
                      processing of payments.

                         o HUDCAPS obligation balances could not be traced to HIAMS. OIG
                           performed a limited review of the implementation of HIAMS in fiscal
                           year 2012 21 and determined that the OCPO did not establish adequate
                           data validation procedures or perform adequate testing of data manually
                           entered into the new application. This deficiency resulted in
                           inaccuracies in the obligation balances recorded in HIAMS and
                           discrepancies between the obligation balances in HIAMS and the
                           balances in HUDCAPS. Because HUD’s former procurement
                           applications, HPS and SPS, did not contain the same level of contract
                           data as was recorded in HIAMS, OCPO developed a data cleanup and
                           transfer process that used a combination of electronic and manual
                           migration of data from the legacy systems to HIAMS. Due to the
                           legacy systems’ limitations in capturing subaccount line data, the
                           contracting officials used hardcopy award documents to manually enter
                           the appropriate subaccount line data into the HIAMS application.

                             OCPO declared the reconciliation process complete and the obligation
                             balances between HIAMS and HUDCAPS to be the same on
                             September 23, 2013. However, documentation provided by OCPO to
                             provide evidence for the closure was not conclusive. Additional
                             information requested by OIG was not provided in time to be reviewed
                             for this audit.

20
   The Central Contractor Registry (CCR) database is the common source of vendor data for the Federal
Government. Both current and potential Government vendors are required to register in CCR to be awarded
contracts by the Government. CCR validates the vendors’ information and electronically shares the data with the
Federal agencies’ finance offices to facilitate paperless payments through electronic funds transfer.
21
   Audit Report No. 2013-DP-0005: Fiscal Year 2012 Review of Information Systems Controls in Support of the
Financial Statements Audit

                                                       20
     HUD Initiated New Plans To
     Implement a Departmentwide
     Core Financial System

                 HUD uses five separate financial management systems to accomplish the core
                 financial system functions. HUD had been working to replace its core financial
                 management system since fiscal year 2003. The previous project, the HUD
                 Integrated Financial Management Improvement Project (HIFMIP), was based on
                 plans to implement a solution that would replace two of the applications it uses
                 for core processing, HUDCAPS and HUD’s Program Accounting System (PAS).

                 In October 2011, the Financial Services Advisory Board 22 determined that
                 HIFMIP was at risk of missing project milestones and the May 2012 “go live”
                 date. In February 2012, HUD’s Chief Information Officer, with support from
                 OMB, sponsored an operational assessment of HIFMIP. HUD convened an
                 independent government assessment team composed of subject-matter experts
                 from multiple government agencies to rapidly evaluate the status of HIFMIP and
                 provide recommendations for a “go forward” strategy. The government
                 assessment team agreed that the mid-May 2012 go-live date was at high risk.

                 In March 2012, work on HIFMIP was stopped. Project sponsorship was
                 transferred from OCFO to the Deputy Secretary. The Deputy Secretary and a
                 working group comprised of OCFO, Office of the Chief Information Officer
                 (OCIO), and OCPO reassessed HUD’s options and determined that a course
                 correction for the PeopleSoft implementation was not a viable option. As a result,
                 the HIFMIP effort was canceled. HUD spent more than $35 million on the failed
                 HIFMIP project.

                 In the fall of 2012, HUD determined that it would reevaluate alternatives for
                 meeting HUD’s original program objectives. As a result of that decision, the New
                 Core Project was created to move HUD forward to implement a new core
                 financial system. The New Core Project has the same scope as HIFMIP, to
                 replace at a minimum, the functionality required to decommission HUDCAPS
                 and PAS during the initial phase of the project. This would be considered the first
                 release, but HUD expected to use a phased approach to modernize all of its
                 financial systems and processes to achieve the targeted state.

                 In July 2013, the project management team issued an alternative analysis that
                 assessed the benefits and risks of using a Federal shared service provider (full and
                 partial service options) and HUD’s taking on a new system modernization effort
                 with a commercial integrator (as was done in HIFMIP), as well as remaining with
                 the HUDCAPS-PAS applications. The New Core Project management team

22
  The Financial Services Advisory Board is a board established by OMB under the Chief Financial Officer Council
to review financial systems information technology (IT) projects in accordance with OMB Memorandum M-10-26.

                                                      21
           recommended a migration to a full-service Federal shared service provider,
           concluding that this option provided the most value to HUD by leveraging
           modern technologies in cloud computing and by reducing implementation risks.

           On July 30, 2013, HUD signed an interagency agreement with the Bureau of
           Public Debt (BPD) to obtain full Federal shared services. Full service leverages
           BPD’s financial management, procurement, human resources, and travel
           applications. BPD will support full transaction processing to operate these
           systems. In September 2013, HUD began the definition stage of the project to
           determine what business process changes would be required as a result of the
           transition. HUD planned a phased implementation with an initial go live date of
           October 1, 2014.

An Annual Cyclical Review of
Financial Management Systems
Was Not Implemented

           In fiscal year 2007, HUD made a strategic decision to conduct its annual financial
           management systems review (A-127 review) internally instead of contracting it
           out. Since bringing the A-127 review process in-house, HUD had reduced the
           number of reviews completed from three in fiscal year 2009 to none in each of the
           next 4 fiscal years. In response to an OIG audit recommendation, in fiscal year
           2010, HUD had planned to conduct an A-127 review of one core financial system
           and five financial management systems each year. However, during our review in
           fiscal year 2013, we determined, for the third consecutive year, that HUD had not
           made significant progress in implementing its annual scheduled A-127 reviews.
           For example, the Federal Housing Administration- Subsidiary Ledger (FHA-SL)
           core system review, which began in 2010, had been in draft form since 2011 and
           was not complete as of September 30, 2013. In addition, the Ginnie Mae
           Financial System (GFAS) core system review began in 2012 and was still in
           process at the end of fiscal year 2013. HUD had neither initiated any new reviews
           in fiscal year 2013 nor completed any of its prior years’ pending systems reviews.

           To support HUD’s annual assurance statement, HUD officials said they leveraged
           the results of the A-123 and Federal Information Security Management Act
           (FISMA) reviews. In OIG’s view, the results of the A-123 and FISMA reviews
           can be leveraged to support HUD’s annual assurance statement on financial
           management systems but cannot be used to substitute for the A-127 reviews
           because of the limited nature of those reviews. Additionally, OIG’s fiscal year
           2013 assessment of HUD’s compliance with FISMA noted significant
           deficiencies in HUD’s departmentwide information security program (see
           compliance with laws and regulations related to FISMA).




                                           22
There Were Weaknesses in
CPD’s Grants Management
Systems

          As reported in prior years, weaknesses in CPD’s IDIS Online continued to impede
          HUD’s financial management accountability on its formula grant programs.
          Specifically, CPD’s IDIS Online system did not account for its formula grant
          transactions using the specific identification method in accordance with the
          conceptual framework within Federal accounting standards. Rather, the system
          used the first in, first out (FIFO) method to account for and disburse formula grant
          obligations. The system’s processing deficiencies impeded HUD’s ability to
          accurately capture, track, and report the budgetary obligations and costs of the
          formula grant recipients at a granular level required by the Federal accounting
          standards conceptual framework.

          The IDIS Online system is a mixed system used by CPD for the management of
          CPD’s formula grant programs. A mixed system is an information system that
          can support both financial and nonfinancial functions. Section 803(a) of FFMIA,
          through the implementation of OMB Circular A-127, required maintenance of the
          agency’s core systems to comply substantially with Federal accounting standards
          and the United States Standard General Ledger (USSGL) at the transaction level.
          Although IDIS Online, as a mixed system, was not required to record transactions
          using the USSGL account, data coming from the mixed system (grantee
          disbursement requests serve as the financial portion of IDIS Online) must be
          posted to HUD’s core financial system using proper USSGL accounts and
          accounting standards.

          The recording of financial events as well as the preparation of standard external
          reports that HUD is required to submit to OMB and Treasury are reported for
          each TAFS through the USSGL. Based on those requirements, OIG believes that
          the TAFS is an integral attribute, which must be included as part of each financial
          event, including disbursement of obligations. Therefore, the system, through use
          of FIFO, which did not specifically identify the appropriate TAFS when making a
          disbursement, was not properly recording the financial event at the transaction
          level using the USSGL attribute for disbursement transactions. Based upon this
          interpretation, those transactions were incorrectly reported from IDIS Online to
          the core financial systems used to prepare the combined statement of budgetary
          resources and consolidated balance sheet. This matter is discussed further in
          finding 1: CPD’s Formula Grant Accounting Did Not Comply With GAAP,
          Resulting in Misstatements on the Financial Statements.

          Since fiscal year 2009, OIG has reported the processing deficiencies of the IDIS
          Online system. Initially, HUD disagreed, and after 2 years at an impasse, HUD
          deferred further action on this matter without third-party intervention. Therefore,
          OIG brought the matter, along with other related appropriations law issues,
          forward to GAO in May 2011. HUD brought the matter forward to OMB later.

                                           23
           In the fourth quarter of 2013, GAO and OMB rendered their opinions on the issue
           in favor of OIG. As of the date of this report, HUD was in the early planning
           stages of developing a plan to address IDIS Online’s processing deficiencies.

Processing of Accounting
Transactions and Events Was
Not Automated

           HUD has several material programs in which the processing of accounting
           transactions and events was not automated in accordance with FFMIA.

           •   Section 108 and Section 184 loan guarantee programs did not have automated
               financial systems. HUD did not adequately design or implement financial
               management requirements for the Section 108 and Section 184 loan guarantee
               programs in its departmentwide financial management system. CPD’s Section
               108 loan guarantee program, in addition to PIH’s Section 184 loan guarantee
               program, did not have computerized systems to perform their respective financial
               management processes in accordance with FFMIA, which requires the agency to
               implement and maintain financial management systems that comply
               substantially with the USSGL at the transaction level. Further, JFMIP-SR-00-
               01, Guaranteed Loan System Requirements, requires guaranteed loan systems
               to interface with other financial management systems, including the core
               financial system, and perform fund control checks, initiate or record
               payments, record the results of other guarantee loan-related financial
               transactions, acknowledge receipt of financial information exchange, perform
               automatic system balancing, support managerial cost accounting, and support
               credit subsidy reestimates.

               These programs were not maintained in PAS, the Line of Credit Control
               System (LOCCS), or HUDCAPS, which constitute HUD’s core financial
               system. Instead, the program offices relied on Excel spreadsheets and Access
               databases to account for more than $1.989 billion in CPD loan guarantees and
               $3.525 billion in PIH loan guarantees.

               With specific regard to CPD, there was no automated input interface to obtain
               associated grant data from IDIS Online. Additionally, when a CPD grantee
               did not make a payment on the loan, CPD instructed OCFO’s accounting staff
               to make a manual deduction of funds available in the line of credit for the
               CDBG grant.

               In the case of PIH, the loan guarantee program office used a system of four
               separate Access database tables to process and maintain data on loan
               guarantees, defaults, and lender claims. The program office noted that the risk
               of duplications across these four databases existed and that overpayments on
               claims due to the duplication of payments had occurred. The program did not
               use HUDCAPS to perform required funds control checks, and when data were

                                            24
   submitted monthly to OCFO accounting staff, the staff had no access to the
   program’s project-level detail to substantiate summarized amounts to be
   booked to the general ledger.

   Without an integrated automated financial system to record detailed program
   transactions, HUD’s loan guarantee programs were unable to appropriately
   monitor loan commitments, note issuances, and repayment amounts, which could
   result in unreliable data affecting the financial statements.

• Accounting and reporting of Ginnie Mae’s budgetary resources were not
  automated. Ginnie Mae did not have an automated budgetary accounting
  system in place to fully and accurately account for and report on its more than
  $13 billion in budgetary resources in accordance with FFMIA and OMB
  Circular A-11. FFMIA requires the agency to implement and maintain
  financial management systems that comply substantially with the USSGL at
  the transaction level. This means that each time a transaction or event is
  approved, it should generate an appropriate general ledger account for posting
  the transaction according to the rules defined in the USSGL. Additionally,
  OMB Circular A-11 states that the agency’s financial management systems
  must support the preparation and execution of the agency’s budget.

  To support Ginnie Mae’s accounting and external reporting requirements under
  FFMIA and OMB Circular A-11, the automated system would be essential in
  ensuring that Ginnie Mae has the capability to (1) monitor and track its
  budgetary activities for funds control and decision making and (2) produce
  reliable and timely financial information for external financial reporting. The
  condition above occurred because Ginnie Mae was not performing budgetary
  accounting. Historically, the primary user of Ginnie Mae’s stand-alone
  financial statements was the private sector. Therefore, Ginnie Mae’s core
  financial management system had been designed to support the accounting and
  reporting requirements of its commercial but not budgetary activities.
  However, Ginnie Mae is required to report on its budgetary resources and
  prepare Federal GAAP basis financial information for consolidation with HUD
  and FHA in HUD’s financial statements. Due to a lack of system functionality
  for budgetary accounting, certain obligated balances were inadvertently
  omitted, such as the undelivered orders, and the unobligated balance and
  unpaid obligations brought forward had inaccurate opening balances. This
  condition resulted in material misstatements in the balances reported by Ginnie
  Mae in sections 1 (budgetary resources), 2 (status of budgetary resources), and
  3 (change in obligated balance) of HUD’s combined statement of budgetary
  resources.




                                25
     HUD Did Not Have a
     Functional Automated Property
     Management System

                 HUD did not have a functional, automated property management system during
                 the majority of fiscal year 2013 as required by Title 40 of the United States Code
                 (U.S.C.), which sets forth executive agencies’ responsibilities to maintain
                 adequate inventory controls and accountability systems. Further, FFMIA
                 mandates that the agency head establish administrative and internal accounting
                 controls that reasonably ensure that funds, property, and other assets are
                 safeguarded against waste, loss, unauthorized use, or misappropriation.

                 FIRMS (Facilities Integrated Resource Management System 23) was under a
                 maintenance contract until August 8, 2011, when it was not renewed. The Office
                 of Facilities Management Service (OFMS) learned of the contract lapse in
                 October 2011 when FIRMS system problems with data transfer and upkeep of the
                 system were identified. During fiscal year 2012, FIRMS encountered many
                 problems and became nonfunctional. On May 23, 2013, a short-term maintenance
                 contract for FIRMS was executed, and depreciation reports were generated and
                 sent to OCFO for review in June 2013. However, HUD was in the process of
                 performing a HUD-wide inventory to ensure that all personal property data were
                 captured in the system, were accurate, and were reconciled appropriately.
                 Therefore, the depreciation reports generated and provided to OCFO before
                 completion of the HUD-wide inventory may not have been accurate due to the
                 acquisition of new personal property during the time FIRMS was nonfunctional.
                 Inventory items acquired during that period would not be included in the system
                 until the inventory was completed. OFMS estimated that the inventory process
                 would take approximately 6 months to complete.

                 As a result of the lack of functionality, FIRMS did not meet the Office of the
                 Chief Human Capital Officer’s (OCHCO) needs. Specifically, the system did not

                 •   Produce depreciation reports,
                 •   Maintain historical data,
                 •   Provide an audit trail,
                 •   Properly upload items scanned with the inventory bar code scanners,
                 •   Reconcile items entered into the system, and
                 •   Integrate with HUD’s financial and procurement systems.

                 Further, since FIRMS was not functional for a significant period and did not
                 integrate with other systems, OFMS, which oversees HUD’s personal property
                 management policy development, implementation, and administration, had to rely


23
  FIRMS was used by HUD staff to consolidate, automate, and provide reports on furniture, equipment, personal
property, and space and lease life-cycle processes.

                                                      26
             on OCPO, OCIO, and purchase card holders for necessary acquisition and
             disposal information.

             HUD’s financial management systems plan had deemed FIRMS as noncompliant
             since fiscal years 2010, and remediation plans have been developed by the Human
             Capital Office and progress in resolving the noncompliance has been monitored
             by the OCFO. However, as of the end of our review, FIRMS remained
             noncompliant.

Conclusion

             Complete and reliable financial information is critical to HUD’s ability to
             accurately report on the results of its operations to both internal and external
             stakeholders. During fiscal year 2013, as in prior years, HUD made limited
             progress in bringing the financial management systems into compliance with
             FFMIA. The FFMIA requires HUD to develop and maintain financial
             management systems that can generate reliable, useful and timely information for
             managing current operations to make fully informed decisions and to ensure
             accountability on an ongoing basis.

             Until these weaknesses are fully remediated, HUD’s ability to produce reliable,
             useful and timely financial information needed for accountability, performance
             reporting, and decision making will remain a serious problem. As such, we will
             continue to monitor HUD’s progress in addressing our concerns in this area.

Recommendations

             We recommend HUD’s Chief Financial Officer, in coordination with the
             Assistant Secretary for Public and Indian Housing


             3A.    Design and Implement a loan guarantee system that complies with the
                    Guaranteed Loan System Requirements. Ensure that the implemented
                    loan guarantee system should be integrated with HUD’s financial
                    management systems and be included in its financial management system
                    plans.

             We recommend HUD’s Chief Financial Officer, in coordination with Ginnie
             Mae’s Chief Financial Officer,

             3B.    Develop and implement plans to ensure that Ginnie Mae’s core financial
                    system is updated to include functionality in the system to perform
                    budgetary accounting at a transaction level using the USSGL to comply
                    with FFMIA requirements.




                                             27
Finding 4: There Were Weaknesses in HUD’s Consolidated Financial
Statement Preparation and Reporting Processes
In fiscal year 2013, our audit work identified weaknesses in HUD’s financial statement
consolidation, preparation, and reporting related to Ginnie Mae. Specifically, we noted the (1)
improper valuation and presentation of certain line items related to Ginnie Mae and FHA in
HUD’s consolidated balance sheet, (2) failure to make the appropriate conversion adjustments to
account for the differences in the accounting standards applicable to Ginnie Mae’s stand-alone
financial statements and HUD’s consolidated financial statements, and (3) inaccurate accounting
and reporting of Ginnie Mae’s budgetary resources. We attributed these financial reporting
deficiencies to weaknesses in HUD’s Federal GAAP basis financial reporting environment and
the inadequate oversight of component entities’ financial statement preparation and reporting
processes. As a result, HUD’s previously issued financial statements had to be restated to
correct material errors.


     Asset Related to Ginnie Mae’s
     Defaulted Loans Receivable
     Had Improper Valuation

                  HUD did not properly account for and value Ginnie Mae’s defaulted loans
                  receivable in HUD’s consolidated balance sheet in accordance with GAAP,
                  causing that balance to be materially misstated. The defaulted loans receivable
                  balance related to Ginnie Mae and reported in HUD’s consolidated balance sheet
                  represented seriously delinquent loans (mortgage loans over 120 days delinquent)
                  that were bought out of a defaulted mortgage issuer’s mortgage-backed securities
                  pools. Because the majority of these loans were insured by FHA, they were
                  recognized at 100 percent of the loans’ unpaid principal balance in Ginnie Mae’s
                  books as loans receivable until the proceeds of an insurance claim were received.

                  Since fiscal year 2010, HUD’s consolidated balance sheet had reported Ginnie
                  Mae’s defaulted loans receivable account at 100 percent of the loans’ unpaid
                  principal balance. However, this was not the appropriate valuation of the asset to
                  HUD since these were considered severely impaired loans, 24 and the 100 percent
                  insurance from FHA should not have been considered in the valuation of this
                  asset at HUD’s consolidated financial statement level because HUD cannot file an
                  insurance claim against itself. In accordance with Accounting Standards




24
  ASC (Accounting Standards Codification) 310-10-35-16 states that a loan is impaired, when based on current
information and events, it is probable that a creditor will be unable to collect all amounts due according to the
contractual terms of the loan agreement.

                                                         28
                 Certification (ASC) 35-10-35-22, 25 when a loan is impaired, the impairment
                 amount should be based on the present value of expected future cash flows
                 discounted at the effective interest rate, except that as a practical expedient, a
                 creditor may measure impairment based on a loan’s observable market price or
                 the fair value of the collateral if the loan is a collateral-dependent loan. As of
                 September 30, 2012, the unpaid principal balance of the defaulted loans
                 receivable account related to Ginnie Mae was $7.6 billion, and its net carrying
                 value was approximately $3.4 billion (assuming 45 percent recovery rate on fair
                 value of the collateral). Therefore, HUD’s loans receivable account balance
                 related to Ginnie Mae in the consolidated balance sheet as of September 30, 2012,
                 was misstated by $4.2 billion.

                 We brought this matter to the attention of Ginnie Mae, FHA, and HUD during the
                 fiscal year 2013 audit, and HUD agreed to restate the 2012 consolidated balance
                 sheet to correct the material accounting error in the valuation of the asset.

     The Balance Sheet Presentation
     Was Not in Accordance With
     USSGL Requirements

                 In addition to the improper asset valuation as noted above, HUD’s presentation of
                 Ginnie Mae’s loans receivable account as “other assets” in the consolidated
                 balance sheet, instead of a separate line item, was a deviation from USSGL
                 requirements. In accordance with the USSGL, Section V, USSGL Crosswalks to
                 External Reports, loans receivable account balances (that is, the 1300 USSGL
                 account series) are crosswalked to a separate line item in the balance sheet.
                 HUD’s presentation of Ginnie Mae’s loans receivable as “other assets” was not in
                 accordance with USSGL requirements (considered GAAP in the Federal
                 Government), and, therefore, we deemed this issue a presentation error.

                 The USSGL provides a uniform chart of accounts and technical guidance to be
                 used in standardizing Federal agency accounting. Using the USSGL promotes
                 consistency in financial transaction processing and reporting. The defined
                 accounts and pro forma presentation standardize the accumulation of agency
                 financial information as well as enhancing financial control and supporting
                 financial statement preparation and other external reporting.

                 Ginnie Mae used a manual crosswalk in Excel format to prepare its general
                 purpose financial statements. Ginnie Mae’s manual crosswalk was not prepared
                 in accordance with USSGL requirements. A deviation from the standardized
                 Federal agency accounting and reporting, as defined in the USSGL, could provide
                 misleading information to the users of the financial statements. The dollar

25
  It is HUD’s position that Ginnie Mae is not a Credit Reform agency. Therefore, the accounting for Ginnie Mae’s
defaulted loans receivable under SSFAS No 2, Accounting for Direct Loan and Loan Guarantees, does not apply to
Ginnie Mae.

                                                       29
           amount of adjustments needed to reclassify the defaulted loans receivable
           balances from the “other assets” account to a separate line item in fiscal year 2012
           was $7.6 billion (net).

           We brought this matter to the attention of HUD during the fiscal year 2013 audit,
           and HUD agreed to report Ginnie Mae’s defaulted loans receivable as a separate
           line item in the consolidated balance sheet in fiscal year 2013 and also made
           adjustments to reclassify the loans receivable from “other assets” to a separate
           line item in the 2012 consolidated balance sheet. The reclassification adjustment
           had no effect on the total assets, but the adjustments were necessary to ensure that
           HUD’s presentation conformed to USSGL requirements.

FASB-FASAB Conversion
Adjustments Were Not
Properly Considered Before
Consolidation

           During the fiscal year 2013 audit of HUD’s consolidated financial statements, we
           noted a GAAP departure in HUD’s consolidation process related to certain Ginnie
           Mae assets. Ginnie Mae’s stand-alone financial statements are prepared in
           accordance with accounting standards promulgated by the Financial Accounting
           Standards Board (FASB) (commercial GAAP) and are correctly presented as a
           stand-alone entity. However, HUD’s consolidated financial statements need to
           comply with Federal Accounting Standards Advisory Board (FASAB) accounting
           standards (Federal GAAP). To consolidate Ginnie Mae accounting information, a
           conversion process is needed, and we determined that the adjustments being made
           were inadequate and misstated the value of the Ginnie Mae on HUD’s
           consolidated financial statements.

           The accounting for certain Ginnie Mae transactions under commercial GAAP
           vary in certain significant respects from Federal GAAP, and adjustments are
           necessary so that Ginnie Mae accounting information can be consolidated
           properly. We brought this matter to the attention of HUD and Ginnie Mae in June
           2013 and requested that they perform an FASB-FASAB GAAP reconciliation
           analysis and make the appropriate adjustments based on the results of that
           analysis. In August 2013, HUD completed its GAAP reconciliation analysis and
           identified two key significant differences in the accounting for certain Ginnie Mae
           transactions under commercial GAAP and Federal GAAP as follows:

           •   Mortgage servicing rights. Under the commercial GAAP, Ginnie Mae
               recognizes the fair value of the mortgage servicing rights at the end of each
               quarter. The mortgage servicing rights represent the fair value of servicing
               assets and servicing liabilities that arise from situations in which Ginnie Mae
               assumes the servicing rights on the pooled loan portfolio as a result of issuer
               default. However, there is no servicing rights concept under Federal GAAP.
               Therefore, Ginnie Mae’s accounting treatment for the mortgage servicing

                                            30
               rights would be to remove this line item from its Federal GAAP basis
               financial statements. Additionally, a prior period adjustment would be needed
               in its fiscal year 2012 consolidated balance sheet and consolidated statement
               of changes in net position to remove the effect of the mortgage servicing
               rights fair values in the cumulative results of operations.

           •   Guarantee asset-guarantee obligation. Under commercial GAAP, Ginnie
               Mae recognizes a guarantee asset (GA) and guarantee obligation (GO) for the
               issuance of a guarantee under its Mortgage-Backed Securities program. The
               GA represents a receivable (at net present value) for the guarantee fees that
               Ginnie Mae expects to collect for the period during which the guarantee is
               provided (typically 30 years of cash flows over the life of the loan). The GO
               represents what Ginnie Mae expects to owe over the term of the guarantee in
               the event that specified events or conditions occur. However, FASAB does
               not have a requirement that specifically allows for the recognition of an asset
               or a liability as it relates to future collection of fees and future occurrence of
               cash outflows, respectively. Therefore, Ginnie Mae’s accounting treatment
               for the GA-GO would be to remove them from its Federal GAAP basis
               financial statements.

           In summary, the conclusion drawn from the above FASB-FASAB reconciliation
           is that HUD needs to restate its fiscal year 2012 consolidated financial statements
           in fiscal year 2013. The impact of the restatement is (1) the removal of the
           mortgage servicing rights, GA, and GO line items in HUD’s consolidated balance
           sheet and (2) to make prior-period adjustments in its fiscal year 2012 consolidated
           balance sheet and consolidated statement of changes in net position.

Ginnie Mae Inaccurately
Accounted for and Reported on
Budgetary Resources

           Ginnie Mae did not completely and accurately account for and report on the
           activities and changes related to its budget authority in accordance with OMB
           Circular A-11. Since Ginnie Mae operates more like a financial services
           company than a government agency, it prepares commercial basis financial
           statements but does not perform budgetary accounting. Accordingly, its core
           financial system was not configured to perform Federal GAAP budgetary
           accounting. As a result, Ginnie Mae did not have the capability to completely and
           accurately account for its budgetary resources at a level needed to adequately
           support budget execution and funds control processes.

           To generate its statement of budgetary resources, Ginnie Mae used a manual
           process by pulling the information from other Treasury reports and Ginnie Mae’s
           proprietary accounting data. However, the information gathered from this manual
           process was incomplete because it did not capture all of the budgetary activities,
           such as the undelivered orders. Additionally, because transactions were not

                                             31
             recorded in the accounting system in real time, Ginnie Mae’s ability to monitor
             and track the balance of its budgetary resources (obligated and unobligated
             balances) and any changes during the life cycle of the funds on an ongoing basis
             for funds control and decision making was impeded.

             Ginnie Mae is responsible for managing a substantial amount of budgetary
             resources. The balance of Ginnie Mae’s budgetary resources as of October 1,
             2012, was $13 billion, representing 8 percent of HUD’s total budgetary resources,
             including approximately $4 billion in spending authority from offsetting
             collections received each year. Given the materiality of the Ginnie Mae’s
             budgetary resources to HUD and the significance of the impact of the GAAP
             departure on the reported balances due to weaknesses in the preparation of Ginnie
             Mae’s statement of budgetary resources, we could not rely on the balances
             reported by Ginnie Mae to HUD.

             We brought this matter to the attention of Ginnie Mae and HUD during the fiscal
             year 2013 audit and HUD agreed to restate the affected SBR line items in the
             Combined Statement of Budgetary Resources in fiscal year 2012 to correct the
             material errors in the accounting and reporting of the SBR balances and also took
             actions to report the appropriate SBR balances going forward as of the end of
             fiscal year 2013. However, due to timing of the completion of the SBR
             restatement analysis we were unable to perform all the appropriate audit
             procedures that we deem necessary to form an opinion on the reliability of the
             restated SBR balances as determined by HUD/Ginnie Mae at year-end.

Conclusion

             HUD management’s responsibilities for the consolidated financial statements
             include, among other things, preparing the financial statements in conformity with
             Federal GAAP and establishing and maintaining internal controls over financial
             reporting. Accurate reporting in the agency’s financial reports and other
             management of reports used to guide managerial decision making is essential for
             successful financial management.

             However, weaknesses in Ginnie Mae’s financial reporting environment and
             OCFO’s inadequate oversight of component entities’ financial preparation and
             reporting processes allowed material misstatements to HUD’s consolidated
             financial statements to occur without being detected or prevented in the normal
             course of its activities by either Ginnie Mae or HUD. This material weakness in
             the internal controls over financial reporting resulted in the restatement of HUD’s
             fiscal year 2012 consolidated financial statements in fiscal year 2013. The
             restatement necessitated adjustments to HUD’s fiscal year 2012 consolidated
             balance sheet and consolidated statement of changes in net position to correct
             material errors.



                                              32
Recommendations

          We recommend that HUD’s Acting Chief Financial Officer, in coordination with
          Ginnie Mae’s Chief Financial Officer,

          4A.     Restate HUD’s fiscal year 2012 consolidated balance sheet to correct
                  material errors resulting from improper valuation of defaulted loans
                  receivable related to Ginnie Mae.

          4B.     Restate HUD’s fiscal year 2012 consolidated balance sheet to ensure that
                  Ginnie Mae’s defaulted loans receivable is presented as a separate line
                  item instead of other assets in accordance with USSGL requirements.

          4C.     Review and update Ginnie Mae’s manual USSGL crosswalk to ensure that
                  it conforms to Treasury’s USSGL requirements.

          4D.     Restate HUD’s fiscal year 2012 consolidate balance sheet to account for
                  the differences in the accounting for certain Ginnie Mae transactions under
                  FASB and FASAB.

          4E.     Determine the amount of adjustments needed to correct the accounting and
                  reporting errors identified in Ginnie Mae’s Statement of Budgetary
                  Resources for fiscal years 2012 and 2013 and provide its analysis and
                  support for its determination.

          We recommend that HUD’s Acting Chief Financial Officer

          4F.     Establish and implement policies, procedures, and practices to strengthen
                  the oversight of its component entities’ financial preparation and reporting
                  processes.

          4G.     Establish an appropriate accounting and financial reporting governance
                  structure within OCFO with the appropriate level of accounting,
                  experience, and training to support the size and complexity of HUD’s and
                  its component entities’ financial reporting requirements.

          4H.     Provide instructions to the component entities, such as the applicable
                  GAAP and accounting policies to be applied for external reporting.




                                           33
                                SIGNIFICANT DEFICIENCIES
Finding 5: HUD Lacked GAAP-Compliant Policies for Accruals
HUD’s accounting policies and procedures related to accrual of expenses did not recognize
liabilities in accordance with Federal GAAP. Our concern on this departure is that liabilities
arising from exchange and nonexchange transactions were not recognized on the financial
statements relating to (1) unpaid amounts due from grant and entitlement programs but not
reported, (2) goods and services received but not invoiced, and (3) charge card purchases
incurred but not billed. The absence of recognition of these financial events existed because
OCFO did not allocate resources to ensure that research and identification of new or changed
accounting standards and their applicability to HUD were performed. This deficiency resulted in
a lack of policies and procedures to require the preparation and implementation of appropriate
methodologies for an accrual estimate for liabilities as of the reporting date. The absence of an
accrual estimate for these significant transactions would result in misstatements on HUD’s
consolidated financial statements due to underreporting of liabilities, expenses, and obligations.


     Liabilities Were Not
     Recognized for the Accrual of
     Grant Expenses Incurred but
     Not Reported

                 HUD’s lack of accounting policies related to grant accruals resulted in
                 misstatements in its balance sheet due to OCFO’s not appropriately recognizing
                 liabilities arising from unpaid amounts owed by grant and entitlement programs.
                 The applicable Federal GAAP requirements for accruals of such expenses are
                 included in SFFAS 5: Accounting for Liabilities of the Federal Government, and
                 FASAB Accounting Technical Release 12 (FASAB TR 12), Accrual Estimates
                 for Grant Programs.

                 We sampled from HUD’s major grant programs 26 20 grant disbursements totaling
                 $39.6 million made in fiscal year 2013, specifically October 2012, and reviewed
                 supporting documentation to determine when the related expense was incurred by
                 the grantee. Approximately $980 million was disbursed from the major grant
                 programs from which we selected our sample, 90 percent of which was in
                 amounts between $15,000 and $6 million. Seventeen of our twenty sample
                 disbursements fell within that range and totaled almost $13 million, $11 million
                 (85 percent) of which represented expenses incurred by the grantee in fiscal year
                 2012. Of our entire sample, we found that more than $33.1 million of
                 approximately $39.6 million, or 84 percent, represented expenses incurred by the
                 grantee in fiscal year 2012 but not reported to HUD for payment until fiscal year

26
  The grant programs included in OIG’s analysis were (1) Community Development Block Grant, (2)
Neighborhood Stabilization Program, (3) Homeless Assistance Grants, (4) Emergency Solution Grants, (4) HOME,
(5) Native American Housing Block Grant, (6) PIH Capital Fund Modernization Grant, and (7) Hope VI.

                                                     34
                 2013. These disbursements included expenses incurred for mixed-use
                 development projects, payroll, transportation services, and miscellaneous
                 maintenance and repairs. These liabilities, although incurred, had been omitted
                 from the general ledger and financial statements as of September 30, 2012.
                 Likewise, the financial statements as of September 30, 2013, were understated by
                 relative amounts due to the lack of an accrual policy, resulting in an omission of
                 an estimate of accrued expenses.

                 SFFAS 5 requires that Federal entities recognize a liability27 arising from
                 nonexchange transactions be recognized for any unpaid amounts due as of the
                 reporting date. Over the years, FASAB had received complaints regarding the
                 costs associated with performing accruals, particularly grant accruals. A task
                 force was convened, consisting of representatives from Federal agencies and
                 independent accounting and consulting firms, that collaborated on the need for
                 additional guidance in this area. The work of the task force resulted in FASAB’s
                 releasing FASAB TR 12, which provides guidance to agencies to develop
                 reasonable estimates of accrued grant expenses, including acceptable procedures
                 for estimating accruals for grant programs, particularly procedures that are
                 acceptable until sufficient relevant and reliable historical data become available.

                 The absence of an accrual estimate for transactions executed by States,
                 entitlements, or grantees but not yet reported to HUD for reimbursement results in
                 incomplete and misstated financial statements. This error would be reflected as
                 an underreporting of liabilities on the balance sheet and a program operating
                 expense on the statement of net cost, in addition to obligations on the statement of
                 budgetary resources as of the reporting date.

     Liabilities Were Not
     Recognized for the Accrual of
     Goods and Services Received
     but Not Invoiced

                 We tested October 2012 disbursements made for goods and services received in
                 accordance with contractual agreements made by HUD and outside vendors to
                 determine whether these disbursements represented expenses incurred by HUD in
                 the prior fiscal year. In addition, we reviewed charge card master invoices to
                 determine whether the related purchase card activity was incurred during fiscal
                 year 2012 but paid in fiscal year 2013. If so, we wanted to determine whether an
                 appropriate accrual estimate of the expense was recognized in the accounting
                 records to reflect these transactions in accordance with SFFAS 5, which states
                 that a liability arising from reciprocal or “exchange” transactions should be
                 recognized when one party receives goods or services in return for a promise to

27
  The liability includes amounts due from the Federal entity to pay for benefits, goods, or services provided under
the terms of the program, as of the Federal entity’s reporting date, whether or not such amounts have been reported
to the Federal entity.

                                                        35
           provide money or other resources in the future. Further, general purpose Federal
           financial reports should recognize probable and measurable future outflows or
           other sacrifices of resources arising from past exchange transactions that are
           unpaid amounts due as of the reporting date.

           We reviewed all contract disbursements made in October 2012 and found that
           OCFO did not recognize an accrual for these expenses in the general ledger and
           financial statements for goods and services that had been received under contract
           terms but not invoiced as of the reporting date. More than $13.1 million in
           disbursements was made in October 2012 for goods and services received but not
           invoiced before September 30, 2012. We also reviewed the October 2012 charge
           card master invoice and found that approximately $644,522 represented fiscal
           year 2012 purchase activity that was paid for in fiscal year 2013. These expenses,
           although incurred, had not been included in the general ledger and financial
           statements as of September 30, 2012. The absence of an accrual estimate for
           expenses related to goods and services received but not invoiced and charge card
           purchases incurred but not billed resulted in misstated financial statements due to
           incomplete and underreported liabilities on the balance sheet and a program
           operating expense on the statement of net cost, in addition to obligations on the
           statement of budgetary resources.

There Was No Formal
Financial Management Policy
on Expense Accruals

           Complying with SFFAS 5 requires the agency to recognize liabilities from (1)
           transactions when one party receives goods or services in return for a promise to
           provide money or other resources in the future and (2) for grants in which
           expenses have been incurred by the grantee but not yet reported as of the
           reporting date. However, there was no group within OCFO charged with the
           responsibility of researching Accounting Standards, new and revised; determining
           their applicability to the Agency; and formulating and implementing the related
           internal policies and operating procedures that would ensure that these
           Accounting Standards are reflected within the financial statements, thereby
           making them consistent with Federal GAAP and governmentwide financial
           reporting. As a result, there had been no formal policies and procedures
           developed, which required the preparation of an appropriate methodology for an
           accrual estimate of liabilities related to grant expenses incurred but not reported,
           goods and services received but not invoiced, or charge card purchases incurred
           but not billed as of the reporting date.

           HUD’s basis of accounting as reported in note 2 of the HUD’s consolidated
           financial statements states that the financial statements are presented on the
           accrual basis of accounting, which requires HUD to recognize an expense when a
           liability is incurred, without regard to receipt or payment of cash. It goes on to
           state that “the Department’s disbursement policy permits grantees to request funds

                                            36
             to meet immediate cash needs to reimburse themselves for eligible incurred
             expenses…” Therefore, the need to have an adequate accrual policy for
             estimating liabilities related to grant expenses, contract and vendor expenses, and
             credit card expenses incurred but not yet billed is essential to comply with HUD’s
             basis of accounting and Federal GAAP.

Conclusion

             OCFO did not recognize liabilities arising from exchange and nonexchange
             transactions in accordance with Federal GAAP. This lack of recognition of
             financial events occurred because OCFO did not have a function in place to
             research and identify accounting standards and their applicability to HUD,
             resulting in its lack of a development of policy and procedures that would require
             the preparation and implementation of an appropriate methodology for an accrual
             estimate of liabilities as of the reporting date. This departure from Federal GAAP
             and resulting absence of accrual estimates caused misstatements on HUD’s
             consolidated financial statements due to incomplete reporting and underreporting
             of liabilities, expenses, and obligations on HUD’s consolidated financial
             statements. OCFO needs to develop and implement policies to ensure that
             appropriate estimates are performed and recognized in the consolidated financial
             statements.

Recommendations

             We recommend that the Acting Chief Financial Officer, in conjunction with each
             of the program offices,

             5A.    Evaluate all HUD grant programs in accordance with FASAB TR 12
                    requirements for materiality and risk of material misstatement on the
                    financial statements. If indicated, based on this evaluation, OCFO should
                    develop a methodology to prepare reliable and timely accrual estimates for
                    all of HUD’s grant programs in accordance with FASAB TR 12.

             5B.    Develop policies and procedures that require the development of grant
                    accrual estimates for existing and new grant programs and the
                    implementation of internal control procedures to ensure that these
                    estimates are consistently based on relevant and reliable data.

             5C.    Ensure that the policies and procedures developed under 5B above are
                    communicated to pertinent HUD management officials and employees
                    who may have a hand in providing the data needed to prepare the
                    estimates.

             We recommend that the Acting Chief Financial Officer, in conjunction with each
             of the program offices,

                                             37
5D.   Develop GAAP-compliant policies and procedures that require the
      development and recordation of an accrual estimate for goods and services
      received and charge card purchases incurred but not yet billed to ensure
      that HUD’s financial statements are complete and properly stated in
      accordance with GAAP.

5E.   Implement the GAAP-compliant policies and procedures developed under
      5D above and develop a methodology that accurately estimates accrual of
      expenses incurred by HUD for goods and services received and charge
      card purchases incurred but not yet billed.




                              38
Finding 6: Weaknesses in the Reporting of HUD’s Accounts Receivable
Continued
Weaknesses identified in fiscal year 2012 28 regarding recognition of and proper accounting for
accounts receivable remained. Specifically, we found (1) that HUD did not always record or
estimate receivables in the accounting records when a determination was made that funds were
owed to HUD and required repayment, and (2) weak oversight of the accounting for accounts
receivable derived from Section 8 financing adjustment factor (FAF) bond refunding. This
condition occurred because of a weak financial management governance structure and poor
accounting monitoring controls. As a result, we identified $1.7 million in accounts receivable
not included in HUD’s consolidated financial statements, resulting from program monitoring
findings and repayment agreements. Additionally, an estimated $57.3 million in receivables
from OIG audit recommendations was not included in HUD’s consolidated financial statements
as of September 30, 2013. Lastly, the total receivable balance for FAF bond refunding totaling
$17.1 million was at risk for misstatement due to the lack of oversight of the accounting for the
portfolio.


     Recognition of Accounts
     Receivable Was Not Always
     Timely

                As reported in fiscal year 2012, HUD did not always record a receivable when
                sustained OIG audit recommendations, final program monitoring letters,
                repayment agreements, or demand letters required funds to be repaid. A majority
                of repayments were recorded as receivables on the date the funds were collected.
                In accordance with Federal GAAP, receivables should be recognized on the date
                the funds are determined to be owed to HUD or a reasonable estimate should be
                made. Specifically, SFFAS 1 states that a receivable should be recognized when
                a Federal entity establishes a claim to cash against other entities, such as a
                payment due date. If the exact amount is unknown, a reasonable estimate should
                be made. Additionally, HUD’s Debt Collection Handbook 1900.25, REV-4,
                specifics that funds are often determined to be owed to HUD during routine
                monitoring and accounting activities, sustained audit findings, and investigations.
                The funds are recognized as a receivable, and the monitor or other person
                discovering the funds owed is required to notify the action official for the
                program activity. Further, HUD’s Audit Management System Handbook
                2000.06, REV-4, states that the action official should notify the accounting office
                of any audit reports with disallowed costs due HUD and any modifications to
                costs and monitor the costs.


28
  Audit Report 2013-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and
2011 Financial Statements, issued November 15, 2012

                                                    39
           We sampled 48 receivables, worth $8.6 million, collected during fiscal year
           2013. We identified 12 receivable collections totaling $1.2 million, which
           originated from program monitoring findings, demand letters, or other binding
           documents. We also found three receivable collections totaling $0.6 million,
           which were in accordance with established repayment agreements. Collections
           for all 15 transactions occurred between 51 and 634 days after the receivable
           event occurred. However, HUD did not accrue any of the receivables until the
           payment collection date. For those that had repayment agreements in place, we
           determined that there had been no accruals for the outstanding balance recorded in
           the accounting records as of March 31, 2013, and August 31, 2013.

           In addition, our review found that adequate controls were not in place to ensure
           that the accounting center was notified of the funds to be repaid at the time
           repayment was recognized, either through a final program monitoring letter,
           repayment agreement, or other binding document. We determined that in 12 of
           15 instances, OCFO was not notified about the anticipated collection. HUD’s
           program offices did not have adequate procedures or were not aware of the
           requirements to report these owed funds to the accounting center for proper
           accrual. We also noted as of September 30, 2013, CPD’s Grants Management
           Process (GMP) system reported significant amounts identified as a result of
           program monitoring findings that are to be repaid to the grantee’s local program
           account or to the agency either through (1) offsets of future grant disbursements
           or (2) repayment to the grantee’s line of credit held by HUD. A portion of these
           amounts, however, may eventually be supported as eligible costs based on grantee
           submitted documents, and therefore will not be required to be repaid. We
           confirmed with the OCFO that they were unaware of these potential receivables,
           and that there exists no procedures or methodology in place to record an
           appropriate estimate to recognize these amounts so that they can be reflected in
           the financial statements.

An Estimate of Accounts
Receivable From OIG Audit
Recommendations With Costs
That Had Not Been Finalized
Was Developed, but More
Work Is Needed

           Follow-up of prior-year audit recommendations determined that HUD had made
           great strides in developing an appropriate estimate to recognize receivables from
           OIG audit recommendations with costs that had not been finalized by the
           management decision date. A methodology was developed to estimate accounts
           receivable resulting from OIG audit recommendations with disallowed costs that
           would be recovered. Under this methodology, the anticipated amount owed to
           HUD was determined to ensure that an appropriate accounts receivable amount
           was accrued. However, because OCFO did not have any historical information on
           HUD’s sustained audit receivables, the baseline anticipated recovery rate used in

                                           40
           the methodology was based on actual receivables reversed as of August 31, 2013.
           As of September 30, 2013, OCFO estimated a 64.7 percent anticipated recovery
           rate, resulting in $57.3 million in estimated accounts receivable. Since the
           financial statements are presented on a comparative basis, OCFO could not
           prepare a reasonable estimate for September 30, 2012, in time for inclusion in the
           fiscal year 2013 financial statements due to the lack of historical information and
           manual process involved. Consequently, the estimate developed as of September
           30, 2013, was omitted from the fiscal year 2013 financial statements.

Section 8 Financing Adjustment
Factor Receivables Had Errors

           HUD failed to effectively monitor and account for receivables that were incurred
           from the FAF-McKinney bond refunding project. This portfolio of receivables
           was maintained outside of PAS, LOCCS, and HUDCAPS and relied heavily on
           the use of manual entries to Excel spreadsheets and the general ledger. Our
           review of this portfolio resulted in the observation of incorrect application of
           collections received to outstanding FAF receivables or the incorrect classification
           of collections as overpayments. Our review also noted one FAF receivable that
           was prepaid in 2010 but HUD failed to liquidate the related FAF receivable from
           the Excel subledger spreadsheet, reflecting this financial event.

           GAO Standards for Internal Control in the Federal Government, November 1999,
           GAO-AIMD-00-21.3.1, states that internal controls and all transactions and other
           significant events need to be clearly documented and the documentation should be
           readily available for examination. All documentation and records should be
           properly managed and maintained. In addition, this standard conveys that internal
           controls should generally be designed to ensure that ongoing monitoring occurs in
           the course of normal operations and that it is performed continually and is
           ingrained in the agency’s operations. It includes regular management and
           supervisory activities, comparisons, reconciliations, and other actions people take
           in performing their duties.

           OCFO did not ensure that established internal controls in place were implemented
           to ensure that the FAF accounts receivable were effectively monitored and
           thereby accurately and properly presented on the agency’s financial statements.
           Our audit detected OFCO’s failure to reconcile the amounts due and paid in
           accordance with the sweeps savings schedule, its reliance on negative
           confirmations of the FAF receivable balances with the trustees instead of positive
           confirmations, a lack of monitoring by supervisory personnel, and a lack of
           segregation of duties, all of which are required and outlined in internal accounting
           policies.

           Weaknesses in internal controls, specifically monitoring, allowed for pervasive
           errors and inconsistencies in accounting treatment to go undetected within the
           FAF portfolio of receivables, due to a communicated shortfall of resources. Our

                                            41
                    audit work reflects results as of August 31, 2013 only, as HUD was unable to
                    deliver yearend data to us either not at all – as of this report issuance; or within a
                    timeframe that would allow for a proper assessment of yearend results. We
                    therefore, could not assess the yearend balances reported for the FAF receivables
                    as of September 30, 2013. However, based on deficiencies found during interim
                    internal control and substantive testing, HUD had only limited assurance that the
                    FAF receivables balance of $17.1 million as of September 30, 2013, was accurate
                    and properly presented in the financial statements. As of August 31, 2013, the
                    outstanding balance for FAF receivables was potentially misstated by at least $1.9
                    million.

     Conclusion

                    Work is needed to (1) ensure that amounts due from program monitoring findings,
                    sustained audit findings, and repayment agreements are communicated to the
                    accounting center in a timely manner to ensure inclusion in the accounting records
                    and (2) prepare a reasonable estimate of accounts receivable from program
                    monitoring findings with costs to be repaid to HUD and OIG audit
                    recommendations with costs that have not been finalized. To ensure that HUD’s
                    financial statements present accurate accounts receivable balances, OCFO needs
                    to fully implement prior-year recommendations 29 requiring the development of
                    comprehensive procedures to ensure that amounts from program monitoring
                    findings, repayment agreements, and other binding documents are communicated
                    to the accounting center. Additionally, OCFO needs to continue collecting data
                    necessary to perform an estimate of accounts receivable from OIG audit
                    recommendations with costs not finalized and ensure that this data is recognized
                    on the financial statements comparatively. Lastly, OCFO needs to enforce
                    already existing internal control procedures in place for the FAF receivable
                    portfolio to ensure proper and accurate accounting.

     Recommendations

                    We recommend that the Acting Chief Financial Officer

                    6A.       Collect all data necessary to perform an estimate of accounts receivable
                              from OIG audit recommendations with costs not finalized by the
                              management decision date and ensure that the data are recognized on
                              HUD’s financial statements comparatively going forward.

                    6B.       Develop and implement a methodology for identifying and estimating
                              potential account receivables due to HUD arising from program
                              monitoring findings and ensure they are recognized on the financial
                              statements.

29
     See the Follow-up of Prior Year Audits section of this report.

                                                            42
6C.    Enforce already existing internal control procedures to ensure proper
       supervision over accounting for Section 8 FAF receivables.

We recommend that the Acting Chief Financial Officer, in conjunction with the
Assistant Secretary for the Office of Housing,

6D.    Perform a thorough analysis of outstanding FAF receivables and fiscal
       year 2013 collections to ensure that the receivables accurately represent
       the amounts owed to HUD, including but not limited to positive
       confirmations of outstanding receivable balances with the trustees.




                                43
Finding 7: Weaknesses in HUD’s Administrative Control of Funds
System Continued
HUD did not have a fully implemented and complete administrative control of funds system that
provided oversight of both obligations and disbursements. Our review noted instances where
disbursements were made before the point of obligation documented in the funds control plan,
program codes that were not included in funds control plans, and funds control plans that were
out of date or did not reflect the controls and procedures in place. These conditions existed
because of decisions made by HUD OCFO, failures by HUD’s allotment holders to update their
funds control plans, a lack of compliance reviews in prior years, and timing issues related to the
issuance of obligating documents. As a result, HUD could not ensure that its obligations and
disbursements were within authorized budget limits and complied with the Antideficiency Act
(ADA). We have reported on HUD’s administrative control of funds in our audit reports and
management letters since fiscal year 2005, and several prior-year recommendations remained
unimplemented.



 Disbursements Were Made
 Before the Documented Point of
 Obligation

               To determine the effectiveness of HUD’s administrative control of funds system
               we reviewed a statistically selected sample of HUD’s obligations incurred and
               disbursements. Our review of disbursements at HUD’s Financial Management
               Center noted 70 disbursements, totaling $570 million, that occurred before the
               legal point of obligation documented in the applicable funds control plan. The
               disbursements were made for payments under HUD’s Section 8 tenant-based
               programs. Statistically projecting these sample results to the fiscal year 2013
               disbursements for these programs, we can be 95 percent confident that at least
               $5.6 billion in disbursements were processed prior to the point of obligation.

               According to the approved funds control plans for the Section 8 programs the
               point of legal obligation is the generation and signing of the Public Housing
               Authority (PHA) Notification Letter. However, obligations are recorded in
               HUDCAPS before the Notification Letters are generated, and once obligations are
               recorded in HUDCAPS disbursements can be made. Financial Management
               Center staff informed us that the disbursements were made before the point of
               obligation because of delays in approving either the allotments or the distributions
               to the PHAs. Due to the delays, the Financial Management Center did not have
               time to generate and mail the PHA notification letters before the disbursement due
               dates. Rather than delay the payments to the PHA’s, the Financial Management
               Center processed the disbursements before generating the PHA Notification
               Letters.

                                                44
           There were controls in place to ensure that disbursements were not made before
           funds were available. Specifically, HUDCAPS verified the availability of funds
           when the funds were both initially committed and again when they were
           obligated. Additionally, HUDCAPS does not allow a disbursement to be
           processed unless funds had been obligated in the system. As a result of the
           controls and processes in place, there was no risk of an Anti-Defiency Act
           violation, however, to ensure proper internal controls, obligations should not be
           recorded in HUD’s financial systems prior to the point of legal obligation.

All HUD Programs Were Not
Included in a Funds Control
Plan

           HUD uses funds control plans to describe and document its administrative control
           of funds. Our review of HUD’s funds control plans found that all of HUD’s
           activities and program codes were not included in a plan. Specifically, we
           identified 139 program codes that were not documented in a funds control plan.
           HUD’s program codes are used to identify funds obligated and expended for
           specific programs and activities in its financial systems. During fiscal year 2013,
           expenditures of $3.2 billion were made from these program codes.

           This condition existed as a result of several factors. First, in the past, HUD
           decided not to create funds control plans for programs or accounts that were only
           expending funds and not incurring new obligations. However, OMB Circular A-
           11, Section 150, Administrative Control of Funds, states that the purpose of an
           agency’s funds control system is to restrict both obligations and expenditures
           from each appropriation of fund account to the lower of the amount apportioned
           by OMB or the amount available for obligation or expenditure in the
           appropriation or fund account. Additionally, HUD Handbook 1830.2, REV-5,
           Administrative Control of Funds: Policies and Procedures, states that proper
           execution of a funds control plan should provide reasonable assurance that
           obligations and expenditures will not exceed the authorized limits of the allotted
           funds. Second, staff in HUD OCFO stated that the funds control plans were at the
           TAFS level and that they would not contain all program codes. However, HUD
           Handbook 1830.2, REV-5, Appendix 9, Form and Content of Funds Control
           Plans, states that funds control plans must contain detailed information for the
           program line item or other activity included in the allotment, broken down to the
           lowest level of any corresponding assignment of funds, and list the hierarchy of
           accounting codes associated with each funded activity covered in the allotment to
           show how funded activities are controlled and rolled up to the allotment level as a
           required element of a funds control plan.

           The Federal Managers’ Financial Integrity Act of 1982 (FMFIA) states that
           internal accounting and administrative controls of each executive agency must be
           established in accordance with standards prescribed by the Comptroller General

                                           45
           and must provide assurance that obligations and costs comply with applicable
           law. As a result of the lack of funds control plans for all activities and program
           codes, HUD did not have documented internal controls over the obligation and
           disbursement of all of its funds and, thus, could not monitor the internal controls
           to ensure that they functioned effectively.

Funds Control Plans Were Not
Kept Up to Date

           All of HUD’s funds control plans were not updated in a timely manner.
           Specifically, we noted the following:

              •   30 of 33 salaries and expenses funds control plans were not updated to
                  reflect the implementation of the HUD Integrated Acquisition
                  Management System (HIAMS) that occurred during fiscal year 2012.
              •   The salaries and expenses funds control plans did not reflect the December
                  2012 rescission of forms HUD-718, Funds Reservation and Contract
                  Authority, and HUD-720, Requests for Contract Services, formerly used
                  to request contract actions through HUD’s Office of the Chief
                  Procurement Officer.
              •   The funds control plan for OCHCO had not been updated since its
                  reorganization and renaming from the Office of Administration in 2009,
                  thus the plan referenced divisions and offices no longer in existence. As
                  of the end of fiscal year 2013, OCHCO was in the process of revising their
                  funds control plan.
              •   78 of 187 funds control plans were not recertified for fiscal year 2013. 70
                  of the 78 plans were not recertified for fiscal year 2013 because they were
                  under revision.
              •   One funds control plan had an out-of-date allotment holder.

           These conditions existed because HUD’s allotment holders did not update their
           funds control plans or notify the Chief Financial Officer in a timely manner after
           changes occurred. HUD Handbook 1820.2, REV-5, states that an allotment
           holder must immediately advise the Chief Financial Officer of any changes to its
           funds control plan during the fiscal year. Administrative changes to the funds
           control plans must be communicated in writing, including the precise timing of
           any changes to the persons or positions authorized to initiate, approve, and
           process actions that commit, obligate, or expend funds.

           Another factor leading to the out-of-date funds control plans was OCFO’s lack of
           oversight and monitoring of the program offices’ compliance with their funds
           control plans in prior years. The CFO Act of 1990 states that the responsibilities
           of an agency Chief Financial Officer include directing, managing, and providing
           policy guidance and oversight of all agency financial management personnel,
           activities, and operations. Because of the lack of oversight and monitoring,
           OCFO was not aware that changes within the program offices were going
                                            46
           unreported and, thus, could not correct the behavior. During fiscal year 2013,
           OCFO’s Funds Control Assurance Division began performing reviews of program
           office compliance with the funds control plans. The reviews will be performed
           over a 5-year cycle, meaning that 20 percent of the funds control plans will be
           reviewed each year.

The Section 184 Funds Control
Plans Did Not Reflect the
Actual Controls and Procedures
in Use

           Under the Credit Reform Act of 1990, the Section 184 Indian Home Loan
           Guarantee Program is accounted for using both a program account and financing
           account. The funds control plans for both accounts were inconsistent with the
           actual procedures in use. Specifically, form HUD-53037, Section 184 Loan
           Guarantee Firm Commitment Form, was no longer in use. The funds control plan
           for the Section 184 program account cited the point of commitment and obligation
           as the signing and dating of the HUD-53037 by the program director. Instead of
           the HUD-53037, the program office provided lenders with an unofficial firm
           commitment form produced by the Computerized Homes Underwriting
           Management System. The funds control plan for the financing account cites the
           point of commitment as the “fully signed execution and recording of the obligated
           HUD-53037.” Instead, funds were committed in the financing account when a
           lender’s claim was received by the program office.

           This condition existed because the funds control plans were not updated by the
           allotment holder when new procedures were developed as required by HUD
           Handbook 1830.2. The new procedures were developed and implemented in
           response to an increase in the volume of loan guarantees issued under the Section
           184 program. In the last 10 years, $3.5 billion in loan guarantees were issued,
           compared with $190 million during the first 10 years of the program. As a result
           of having funds control plans that were inconsistent with their procedures, HUD
           could not effectively monitor the controls in place and ensure that obligations and
           expenditures did not exceed authorized limits.

           In addition to the inconsistencies related to form HUD-53037, our review
           identified inconsistencies related to the verification of the availability of funds.
           The funds control plans for both the program and financing accounts stated that
           the availability of funds would be verified with OCFO before funds were
           obligated. However, our review noted that the availability of funds was not
           verified either with OCFO or within the accounting system, HUDCAPS, before
           obligations were executed by program staff. This condition occurred because
           PIH’s budget office did not ensure that program staff was properly trained and
           made aware of its responsibilities for verifying that funds were available before
           executing obligations. Verifying the availability of funds is an internal control
           designed to ensure that obligations and expenditures do not exceed authorized

                                             47
             limits. When the verification is not performed, the risk of incurring obligations
             greater than authorized limits and violating ADA requirements increases.

Conclusion

             HUD did not have a fully implemented and complete administrative control of
             funds system during fiscal year 2013. As a result, it did not have adequate
             assurance that its obligations and disbursements complied with applicable laws
             and limitations. HUD’s ability to determine the responsible parties in the event of
             an ADA violation was also hindered as a result of its incomplete funds control
             system. In addition, processing disbursements before the documented point of
             legal obligation may lead to ADA violations.

Recommendations


             We recommend that the Assistant Secretary for the Office of Public and Indian
             Housing

             7A.    Review the funds approval and obligation processes for the Section 8
                    tenant-based programs to identify and correct any delays, to allow
                    adequate time for the processing of PHA notification letters before
                    payment due dates.

             7B.    Work with the Office of the Chief Financial Officer to review the Section
                    8 tenant-based programs’ funds control plans and ensure that the proper
                    point of obligation is documented.

             7C.    Review the procedures in use for the Section 184 Indian Housing Loan
                    Guarantee Program to ensure that they provide assurance that obligations
                    and expenditures do not exceed limitations and update the funds control
                    plans accordingly.




                                              48
Finding 8: HUD Continued To Report Significant Amounts of Invalid
Obligations

Deficiencies in HUD’s processes for monitoring its unliquidated obligations and deobligating
balances tied to invalid obligations continued to exist. Specifically, we identified $125.9 million
in invalid obligations previously not identified by HUD and $43 million in obligations that HUD
determined needed to be closed out and deobligated during the fiscal year that remained on the
books as of September 30, 2013. These deficiencies were attributed to ineffective monitoring
efforts and the inability to promptly process contract closeouts. As a result, HUD’s unpaid
obligation balances were potentially overstated by $168.9 million. Additionally, HUD lacked an
established process to reconcile the subsidiary and general ledger obligation controlling
accounts, causing differences to not be identified on a timely basis or at all, resulting in balances
within the general ledger that were at risk of being unsupported or incomplete.


     Homeless Obligations Were Not
     Closed in Accordance With
     Funds Control Plans

                Expired Shelter Plus Care and Supportive Housing Program grants were not
                closed within the 90-day period after the expiration date as required by the
                programs’ funds control plans. The Office of Special Needs Assistance Programs
                (SNAPS) was occupied with implementing a new program, running two
                competitions, and deobligating contracts that expired before June 30, 2012.
                Therefore, SNAPS did not finalize or implement policies and procedures to
                ensure that expiring contracts were closed within the 90-day period. The expired
                grants with an available balance report as of September 30, 2013, showed that
                approximately 1,855 contracts, which expired between July 1, 2012, and June 30,
                2013, were not closed within the 90-day period and the remaining undisbursed
                obligation balances of approximately $50.9 million were not recaptured.

                The expired grants with an available balance report also showed that
                approximately 3,400 expired contracts and $97.8 million in unexpended balances
                reported during the fiscal year 2010 audit 30 had decreased to 31 contracts and $1.5
                million, the 1,400 expired contracts with $32 million in unexpended balances
                reported during the fiscal year 2011 audit 31 had decreased to 293 contracts and
                $7.3 million, and the 1,800 expired contracts with $50.6 million in unexpended
                balances reported during the fiscal year 2012 32 had decreased to 860 contracts and

30
   Audit report number 2011-FO-0003, “Additional Details To Supplement Our Report on HUD’s Fiscal Years 2010
and 2009 Financial Statements,” issued November 15, 2010
31
   Audit report number 2012-FO-0003, “Additional Details To Supplement Our Report on HUD’s Fiscal Years 2011
and 2010 Financial Statements,” issued November 15, 2011
32
   Audit report number 2013-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012
and 2011 Financial Statements, issued November 15, 2012

                                                    49
                    $22.4 million. These decreases reflect the phases 1 and 2 efforts of a Closeout
                    Taskforce established during fiscal year 2013 to assist with closing expired grants
                    and resolving outstanding OIG audit findings. However, the approximately 1,855
                    contracts with undisbursed obligation balances of approximately $50.9 million
                    that expired during fiscal year 2013 were not closed, and the funds were not
                    recaptured.

                    In response to OIG findings from the fiscal year 2010 audit, internal control
                    policies to review and close out expired contracts and monitor expiring contracts
                    were drafted; however, they were not finalized or implemented 33 due to
                    competing priorities, such as the implementation of a new program authorized by
                    the Homeless Emergency Assistance and Rapid Transition to Housing Act of
                    2009.

                    When SNAPS implemented the new program, it also updated and published the
                    Homeless Emergency Assistance and Rapid Transition to Housing: Continuum of
                    Care Program Interim Rule. In an effort to expedite the closeout process and
                    assist HUD in obtaining the information needed to complete the closeout process,
                    the Interim Rule specifies that for grantees seeking renewal, the failure of
                    grantees to submit final performance reports or other required reports to HUD
                    within 90 days may cause the grantee’s renewal funds to be withdrawn and
                    repayment of grant funds expended on the renewal grant. Receipt of these reports
                    is necessary for HUD to complete the grant closeout process so it can recapture
                    the unused grant funds. While these stipulations are effective going forward,
                    beginning with the second competition that SNAPS ran during fiscal year 2013,
                    they do not apply to the 1,855 contracts with undisbursed obligation balances of
                    approximately $50.9 million that expired between July 1, 2012, and June 30,
                    2013, and were not closed within the 90-day period.

     Invalid Obligations Were Not
     Deobligated by September 30

                    Each year, OCFO coordinates a review of HUD’s unliquidated obligations. For
                    this review, OCFO establishes thresholds to ensure that at least 95 percent of
                    HUD’s obligations are reviewed. For fiscal year 2013, program obligations
                    exceeding $243,000 and administrative obligations exceeding $23,000 were
                    required to be reviewed.

                    During the fiscal year 2013 review, 1,938 obligations with remaining balances
                    totaling $77 million were marked for deobligation. By September 30, 2013, HUD
                    had deobligated 1,238 of these obligations, leaving 700 invalid obligations on
                    HUD’s books with remaining balances totaling $43 million. While the
                    deobligated actions accounted for 64 percent of the invalid obligations. HUD’s
                    inability to process all of the closeouts and deobligations by the end of the fiscal

33
     See the Follow-up of Prior Year Audits section of this report, item 8.b (2012-FO-0003-002-C).

                                                          50
           year can be attributed to the following factors. First, HUD did not effectively
           review and close out contracts throughout the year; therefore, the program offices
           marked a large number of obligations for deobligation during the annual review.
           Second, HUD placed a higher priority on processing new awards and obligations
           than processing closeouts and deobligations. Therefore, HUD was unable to
           process all of the necessary contract closeouts and deobligations before the end of
           the fiscal year on top of its regular workload. All 700 obligations remaining on
           HUD’s books at yearend had not been forwarded from the program offices to the
           appropriate office, either to OCPO for administrative obligations or OCFO for
           program obligations, for closeout and deobligation. As a result, HUD’s
           unliquidated obligation balances were overstated by $43 million. HUD had
           initiated the process of closing these obligations, and the associated funding
           should be recaptured during fiscal year 2014.

HUD’s Administrative
Obligations Were Not
Effectively Monitored

           HUD’s administrative obligations are a result of contracts entered into for the
           goods and services necessary to operate, such as employee training, printing
           services, subscriptions, information technology (IT) support, and other service
           contracts. HUD did not effectively monitor these obligations to determine that a
           bona fide need still existed and the obligations were still valid. Our review
           identified 2,103 administrative obligations with remaining balances totaling $22.4
           million with no activity since fiscal year 2011. Of these, 302 with remaining
           balances totaling $1.0 million were tied to funds that were canceled on September
           30, 2013.

           Through a review of HUD’s funds control plans, we noted that several of HUD’s
           program offices relied on the OCFO-coordinated unliquidated obligations review
           to monitor their administrative obligations. Administrative obligations that fell
           under $23,000 were not required to be reviewed during the fiscal year 2013
           review. Of the obligations we identified as inactive, 1,384 were under the
           $23,000 threshold and not reviewed. Additionally, since the OCFO-coordinated
           review was performed annually, any obligations that become invalid during the
           period between the end of the review and the end of the fiscal year would not be
           identified until the following fiscal year.

           As a result, HUD’s September 30, 2013, obligation balances were potentially
           overstated by $21.4 million. Additionally, because most of HUD’s administrative
           obligations are made using annual appropriations, by not periodically reviewing
           their validity throughout the fiscal year, HUD may lose the opportunity to use
           funds tied to obligations that become invalid during the year.




                                           51
Inactive and Expired Section
202 and 811 Obligations Were
Not Identified

           HUD’s Sections 202 and 811 programs provide affordable housing and supportive
           services for the elderly and persons with disabilities. Generally, funds
           appropriated for Section 202 and 811 programs are available for obligation for 3
           years. After 3 years, the funds expire and are not available for obligation,
           necessitating the need to track funds obligated under these programs.

           During fiscal year 2013, HUD did not adequately monitor and deobligate
           unliquidated balances from expired and inactive Section 202 and 811 obligations.
           We reviewed the subsidiary ledger supporting the unliquidated obligations to
           determine whether the reported obligations were valid and whether any invalid
           obligations had been canceled and deobligated. Our review identified $9.3
           million tied to 115 obligations that had either expired or were no longer needed.
           HUD initiated the closeout of these obligations, and the associated balances
           should be recaptured during fiscal year 2014.

Other Inactive Housing
Program Obligations Were
Identified

           We reviewed the subsidiary ledgers supporting the obligation balances in TAFS
           0303 and 0319 to determine whether the reported balances were valid. These
           TAFS mainly contained funds used for Section 8 project-based obligations;
           however, they also contained funds for several small grant and other assistance
           programs. Within these small programs, our review identified 215 expired or
           inactive obligations with remaining balances totaling $26 million. This condition
           can be attributed to a lack of effective monitoring due to these small programs’ no
           longer receiving appropriations and HUD’s focus on its larger obligation
           balances. As a result, HUD’s unliquidated obligation balances were potentially
           overstated by $26 million.

Remaining Operating Subsidy
Funds Were Not Deobligated or
Recaptured in a Timely Manner

           HUD’s operating subsidy funds are appropriated for payments to PHAs for the
           operation and management of public housing in the year in which they are
           appropriated. Operating subsidy funding is allocated using a preliminary
           determination of eligibility before the start of the funding year. The preliminary
           determination uses a formula and information from the prior year to determine
           funding levels; however, HUD also performs a final allocation, which includes
           changes to the initial estimates that occurred during the year. When actual
                                            52
eligibility is determined, PHAs are no longer eligible for preliminary amounts
above the final allocation, however; HUD did not recapture this difference in a
timely manner. We identified $11 million, tied to 212 operating subsidy funding
lines in fund 0163, that had been inactive for more than 1 year. After contacting
field offices responsible for a sample of these obligations, we believe these
amounts represented the differences between the estimated and actual amounts
and were, therefore, invalid obligations.

Instead of immediately recapturing funds from PHAs that were overfunded, HUD
offsets future funding and notes that a recapture is required when PHA funding is
insufficient to cover the offset. However, HUD’s Financial Management Division
did not recapture the funding noted for recapture until the 5-year obligation period
ended. As an alternative, the Division notified the responsible field offices and
asked them to place the funds into a locked line item in LOCCS so that they could
not be drawn down. These funds would sit in LOCCS and on the unpaid
obligation balance until the end of the 5-year obligation period, when they would
be deobligated by the Division.

GAO guidance and OCFO Handbook 1830.2 dictate that when using an estimate,
appropriate adjustments must be made when events permit a more accurate
estimate. GAO guidance also states that to be a valid obligation, the funds must
be “legally available for a given expenditure.” When actual eligibility is
determined, HUD should immediately recapture the funds, which would properly
adjust the unpaid obligation balance to include only funds that are available to
PHAs.

Operating subsidy funds are subject to the annual open obligation review
coordinated by OCFO. Regarding the annual review of unliquidated obligations,
OCFO Handbook 1830.2 states, “Particular attention must be given to
unliquidated obligations whose status has not changed for six months or more, to
ensure that they are still valid outstanding obligations.” However, during the
annual departmentwide unliquidated obligations review, field offices were
instructed to look only at obligations that were nearing their expiration date, not
obligations that had no recent activity or that were unavailable to the PHA.
Consequently, field offices may be aware that these funds are no longer available
to the PHA but do not report them for recapture.

Since these obligations were no longer available to PHAs, HUD’s unliquidated
obligation balance on the consolidated financial statements was potentially
overstated by $11 million. In addition to the overstated balance, when funds sit
around, they become susceptible to fraud, waste, and abuse. While field offices
were instructed to lock these funds in LOCCS, there was no assurance that field
offices locked the funds so they could not be drawn down.




                                 53
Unavailable Balances on CPD
ARRA Grants Were Not
Recaptured

           As of September 30, 2013, $4.7 million in CPD’s American Recovery and
           Reinvestment Act (ARRA) grant program Community Development Block Grant-
           Recovery (CDBG-R) and $2.6 million in unspent funds for the Homelessness
           Prevention and Rapid Re-Housing Program (HPRP) grant program were not
           reclaimed by HUD in accordance with Memorandum M-11-43 and returned to
           Treasury in accordance with the Dodd-Frank Wall Street Reform and Consumer
           Protection Act. These unspent funds are no longer available to the program
           grantees. Contracts for all of the grants were not closed out, and the necessary
           deobligation forms were not sent to OCFO to process the recapture. In addition,
           OCFO’s manual process to ensure that ARRA funds that were unspent as of
           September 30, 2013, were recaptured and returned to Treasury was not fully
           implemented.

           In accordance with ARRA, HUD imposed an expenditure deadline for CDBG-R
           grantees of September 30, 2012. ARRA required HPRP grantees to expend 100
           percent of their grant funds within 3 years after the date HUD signed the grant
           agreement. HPRP’s last grant was obligated on September 29, 2009, making
           September 28, 2012, the latest date for grantee expenditure. However, HPRP
           grantees had up to 90 days after the 3-year expenditure deadline to draw down
           funds to pay eligible HPRP costs incurred during the 3-year grant period, or
           December 28, 2012. After the 90-day period, no further funds could be drawn
           down. Approximately 1 year after the expenditure deadlines, $4.7 million in
           unspent funds for CDBG-R and $2.6 million for HPRP remained.

           CPD established grant closeout procedures for the CDBG-R and HPRP programs.
           The procedures generally required the grantee to complete some administrative
           actions and submit a grant closeout agreement certification with the final unspent
           grant fund balance. Upon CPD’s receipt, review, and signature, the grant closeout
           agreement certification was to be forwarded to OCFO to process the recapture.
           Not all ARRA grants had completed this closeout process; therefore, the grant
           closeout agreement certifications were not obtained or submitted to OCFO.

           While the grant closeout procedures established by CPD would have led to each
           individual grant’s unspent funds being recaptured, OCFO also determined a
           mechanism to recapture any remaining unspent balances for the ARRA grants, as
           of September 30, 2013, regardless of the status of the grant closeout procedures
           by the program office. However, the manual process identified was not
           completed, leaving the approximately $7.3 million in unspent funds for CDBG-R
           and HPRP programs not reclaimed by HUD and returned to Treasury.




                                           54
     The Subsidiary Ledgers Were
     Not Reconciled to the
     Obligation Balances in the
     General Ledger for all of
     HUD’s Open Appropriation
     Accounts

                 HUD’s obligation controlling accounts were not reconciled to the supporting
                 records for HUD’s open appropriation accounts. This condition was due to
                 management lacking a process to ensure that a periodic reconciliation between the
                 subsidiary ledgers and the general ledger took place. Reconciliations were
                 performed only when requested by OIG during routine audit procedures. As a
                 result, differences that existed between the two ledgers were not identified and
                 resolved in a timely manner. Further, incorrect or unsupported balances were at
                 risk of being transferred to the new accounting system. 34

                 The Accounting Monitoring and Analysis Division within OCFO did not have a
                 reconciliation process that included verifying that HUD’s monthly, quarterly, and
                 annual obligation reports to Treasury and OMB agreed with HUD’s obligation
                 control accounts for each open appropriation account as required by GAO Title 7,
                 chapter 3.7. Reconciliations were performed only for certain appropriation
                 accounts when requested by OIG for review. However, OIG’s review of those
                 reconciliations noted several deficiencies: (1) reconciliations were performed
                 inconsistently; (2) all appropriate general ledger accounts were not always
                 included in the reconciliation; (3) supporting files did not agree with the
                 reconciliation; (4) the review process was inadequate, at times lacking evidence;
                 (5) reconciliations were not completed in a timely manner, requiring extensive
                 research and data manipulation to complete the task; and (6) millions of dollars in
                 differences among the systems were identified, which could not be explained or
                 reconciled or required extensive research to determine the cause of the difference.
                 Our review of the reconciliations performed identified the following differences
                 as of September 30, 2013:

                                                     Table 1
                           Program                    Appropriation            Differences
                   Housing Choice Voucher                   0302               $73.8 million
                   Program
                   Homeless Assistance                        0192              29.2 million
                   CDBG                                       0162              $2.8 million
                   Total                                                      $105.8 million



34
  See further discussion regarding the interagency agreement with BPD to obtain full Federal shared services,
including a financial management application in Finding 3: Weaknesses in Financial Management Systems
Continued To Challenge HUD.

                                                        55
             Policies and procedures were not in place to ensure that all undelivered orders
             were periodically reconciled between the subsidiary ledgers and the general
             ledger for each open appropriation account and that the reconciliations were
             formally reviewed. In addition, subsidiary and general ledger system reports were
             not available as of the period end dates and, therefore, required substantial data
             manipulation to arrive at the balance as of the period end date.

             In response to a similar finding reported in a prior year management letter, the
             Accounting Monitoring and Analysis Division planned to hire a contractor and
             work with the OCFO Systems Division to determine the appropriate system
             reports needed to complete the reconciliations and create and document
             reconciliation policies and procedures. However, due to budget and staffing
             limitations, no action was taken. Additionally, management decided that since
             HUD was planning to implement a new accounting system, it would be in its best
             interest to wait until after the implementation of the new accounting system to
             create the procedures.

             Without formal procedures to require the completion of periodic reconciliations,
             the differences between the subsidiary and general ledger systems may not have
             been identified. When differences are not identified in a timely manner, the
             number of transactions and time and research needed to reconcile the differences
             increases.

Conclusion

             HUD’s processes for (1) monitoring the validity and need for its unliquidated
             obligations and (2) timely closeout of expired grants, continued to not be fully
             effective during fiscal year 2013. As a result, we identified $125.9 million tied to
             expired or inactive obligations, or grants that had not completed the closeout
             process. Additionally, HUD did not close out all of the obligations identified as
             invalid by the end of the fiscal year, resulting in $43 million in invalid obligations
             remaining on HUD’s books at yearend. . In total, HUD’s unliquidated obligation
             balance on the statement of budgetary resources was potentially overstated by
             $168.9 million.

             HUD’s lack of an established process in place to reconcile the subsidiary and
             general ledger systems caused differences between obligations controlling
             accounts and supporting records to not be identified on a timely basis if at all,
             leaving unsupported or incomplete balances in the general ledger, which were at
             risk of being transferred to the new accounting system.




                                               56
Recommendations

          We recommend that the Assistant Secretary for the Office of Community
          Planning and Development

          8A.     Review the status of these 1,855 expired contracts, which make up the
                  $50.9 million; close out the contracts; and recapture the excess funds.

          8B.     Complete the closeout of any remaining CDBG-R and HPRP grants and
                  forward all grant closeout agreement certifications to OCFO for recapture.

          8C.     Deobligate $14,425,629 tied to 238 program obligations marked for
                  deobligation during the departmentwide unliquidated obligations review.
                  Additionally, OCFO should review the 93 obligations with remaining
                  balances totaling $316,935 and close out and deobligate amounts tied to
                  obligations that are no longer valid, either based on the criteria defining
                  the availability of appropriations at 31 U.S.C. 1301 or the criteria for
                  recording obligations at 31 U.S.C. 1501.

          We recommend that the Assistant Secretary for the Office of Housing

          8D.     Deobligate $12,755,325 tied to 165 administrative obligations and
                  $2,734,967 tied to 25 program obligations marked for deobligation during
                  the departmentwide unliquidated obligations review. Additionally, the
                  Office of Housing should review the 429 obligations with remaining
                  balances totaling $5,764,905 and close out and deobligate amounts tied to
                  obligations that are no longer valid, either based on the criteria defining
                  the availability of appropriations at 31 U.S.C. 1301 or the criteria for
                  recording obligations at 31 U.S.C. 1501.

          8E.     Research and deobligate at least $9.3 million tied to the 115 inactive
                  and/or expired Section 202/811 funding lines.

          8F.     Review and deobligate at least $26 million tied to 215 inactive and/or
                  expired Section 8 obligations.

          We recommend that the Assistant Secretary for the Office of Public and Indian
               Housing

          8G.     Deobligate $5,555 tied to 17 administrative obligations marked for
                  deobligation during the departmentwide unliquidated obligations review.
                  Additionally, the Office of Public Housing should review the 299
                  obligations with remaining balances totaling $1,331,460 and close out and
                  deobligate amounts tied to obligations that are no longer valid, either
                  based on the criteria defining the availability of appropriations at 31
                  U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501.

                                           57
8H.    Review and, if necessary, recapture all 212 operating subsidy (0163)
       funding lines with remaining balances totaling $11 million.

8I.    Develop formal procedures to annually determine which PHAs require a
       recapture based on operating subsidy actual allocation figures and
       recapture the funds immediately.

We recommend that the Chief Human Capital Officer

8J.    Deobligate the $2,483,254 tied to 12 administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.
       Additionally, OCHCO should review the 730 obligations with remaining
       balances totaling $10,227,309 and close out and deobligate amounts tied
       to obligations that are no longer valid, either based on the criteria defining
       the availability of appropriations at 31 U.S.C. 1301 or the criteria for
       recording obligations at 31 U.S.C. 1501.

We recommend that the Acting Chief Financial Officer

8K.    Deobligate the $1,419 tied to three administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.
       Additionally, OCFO should review the 42 obligations with remaining
       balances totaling $3,115,954 and close out and deobligate amounts tied to
       obligations that are no longer valid, either based on the criteria defining
       the availability of appropriations at 31 U.S.C. 1301 or the criteria for
       recording obligations at 31 U.S.C. 1501

8L.    Issue a memorandum to the program offices, instructing them to actively
       monitor their administrative funds and deobligate funds tied to unneeded
       or inactive obligations, or obligations for which performance is complete
       (goods or services have been delivered).

8M.    Design and implement a policy to ensure that reconciliations between the
       subsidiary ledgers (supporting records) and the obligation balances in the
       general ledger (controlling accounts) are periodically performed for all HUD
       appropriations. The policy should also address the follow-up and clearance
       of identified differences and the responsibilities for the preparers and
       reviewers.

8N.    Work with the program offices to determine the ARRA funds that were
       not spent by September 30, 2013; implement the manual process
       identified; and recapture, to the extent permitted by law, the unspent
       ARRA funds and return them to Treasury, including at least $4.7 million
       and $2.6 million in unspent grant funds for the CDBG-R and HPRP
       programs, respectively

                                 58
We recommend that the Chief Information Officer

8O.    Deobligate $7,263,662 tied to 178 administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.

We recommend that the Director of the Office of Departmental Equal
Employment Opportunity

8P.    Deobligate $2,244 tied to 10 administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.
       Additionally, the Office should review the 10 obligations with remaining
       balances totaling $83,300 and close out and deobligate amounts tied to
       obligations that are no longer valid, either based on the criteria defining
       the availability of appropriations at 31 U.S.C. 1301 or the criteria for
       recording obligations at 31 U.S.C. 1501.

We recommend that HUD’s General Counsel

8Q.    Deobligate $71,274 tied to five administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.

We recommend that the Office of Departmental Operations and Coordination

8R.    Deobligate $12,277 tied to 19 administrative obligations marked for
       deobligation during the departmentwide unliquidated obligations review.
       Additionally, the Office should review the seven obligations with
       remaining balances totaling $76,327 and close out and deobligate amounts
       tied to obligations that are no longer valid, either based on the criteria
       defining the availability of appropriations at 31 U.S.C. 1301 or the criteria
       for recording obligations at 31 U.S.C. § 1501.

We recommend that the Acting Director for the Office of Sustainable Housing
and Communities

8S.    Deobligate $6,220 tied to 4 administrative obligations marked for
       deobligation during the Department wide Unliquidated Obligations
       Review. Additionally, review the 3 obligations with remaining balances
       totaling $4,464 and close-out and deobligate amounts tied to obligations
       that are no longer valid either based on the criteria defining the availability
       of appropriations at 31 U.S.C § 1301 or the criteria for recording
       obligations at 31 U.S.C § 1501.

We recommend that the Director of the Office of Healthy Homes and Lead
Hazard Control



                                 59
8T.    Deobligate $3,488,009 tied to 23 program obligations marked for
       deobligation during the Department wide Unliquidated Obligations
       Review.

We recommend that the Assistant Secretary of the Office of Fair Housing and
Equal Opportunity

8U.    Review the 52 obligations with remaining balances totaling $145,060 and
       closeout and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.

We recommend that the Chief Procurement Officer

8V.    Review the 14 obligations with remaining balances totaling $26,829 and
       close out and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.

We recommend that the Assistant Secretary for the Office of Field Policy and
Management

8W.    Review the 30 obligations with remaining balances totaling $11,420 and
       close out and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.

We recommend that the Assistant Secretary for the Office of Policy Development
and Research

8X.    Review the 44 obligations with remaining balances totaling $166,083 and
       close out and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.

We recommend that the Office of the Secretary

8Y.    Review the 41 obligations with remaining balances totaling $132,080 and
       close out and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.

                                60
We recommend that the Director of the Office of Strategic Planning and
Management

8Z.    Review the seven obligations with remaining balances totaling $7,391 and
       close out and deobligate amounts tied to obligations that are no longer
       valid, either based on the criteria defining the availability of
       appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at
       31 U.S.C. 1501.




                                61
Finding 9: HUD’s Financial Management Governance Structure and
Internal Controls Over Financial Reporting Were Ineffective
HUD did not have a fully implemented and effective financial management governance structure
or system of internal controls over financial reporting. This condition stemmed from HUD’s
inadequate implementation of the CFO Act of 1990. Specifically, HUD’s financial management
structure did not have permanent staff in critical financial management positions and relied on
the delegation of key financial management functions without providing adequate policy and
oversight. Additionally, as we have reported in prior-year audits, HUD did not have reliable
financial information for reporting, did not have integrated financial management systems, and
had not implemented a compliant core financial system. As a result, multiple deficiencies
existed in HUD’s internal controls over financial reporting, resulting in misstatements and
instances of noncompliance with laws and regulations.


 HUD Lacked an Adequate Tone
 at the Top for Financial
 Management

              The effectiveness of HUD’s financial management governance structure, which
              was responsible for administering $57.6 billion in appropriations for fiscal year
              2013, was compromised by long-term vacancies in key executive positions.
              Specifically, HUD had not had an appointed Chief Financial Officer since August
              2011. The CFO Act states that the responsibilities of a Chief Financial Officer
              include

                  •   Developing and maintaining integrated accounting and financial
                      management systems;
                  •   Directing, managing, and providing policy guidance and oversight of all
                      agency financial management personnel, activities, and operations;
                  •   Approving and managing financial management systems design and
                      enhancement projects;
                  •   Developing budgets for financial management operations and
                      improvements;
                  •   Overseeing the recruitment, selection, and training of personnel to carry
                      out agency financial management functions;
                  •   Implementing agency asset management systems, including systems for
                      cash management, debt collection, and property inventory management
                      and control; and
                  •   Monitoring the financial execution of the agency budget in relation to
                      actual expenditures.



                                               62
                     In addition, during fiscal year 2013, HUD experienced turnover and vacancies in
                     its Assistant Chief Financial Officer positions in all four divisions within OCFO.
                     As of the date of this report, three of the four positions had not been permanently
                     filled.

                     In addition to the vacancies within OCFO, HUD lacked a Senior Management
                     Council and Senior Assessment Team or equivalent committees responsible for
                     (1) assessing and monitoring deficiencies in internal control resulting from the
                     FMFIA assessment process, (2) advising the HUD Secretary of the status of
                     corrections to existing material weaknesses, and (3) apprising the Secretary of any
                     new material weaknesses that may need to be reported to the President and
                     Congress through the Annual Financial Report. While establishment of a Senior
                     Management Council and Senior Assessment Team is not required by OMB
                     Circular A-123, Management’s Responsibility for Internal Control, it is
                     recommended. According to OMB Circular A-123, the Chief Financial Officer
                     should be a member of the Senior Management Council, and the Senior
                     Assessment Team should report to the Chief Financial Officer. The Senior
                     Assessment Team provides oversight and accountability for the agency’s internal
                     controls over financial reporting and should include executives from areas
                     responsible for maintaining controls over key processes and systems.

                     Without permanent executive leadership within OCFO and an appropriate focus
                     on internal controls, HUD had difficulties fully implementing the CFO Act and
                     creating an effective financial management governance structure and system of
                     internal controls over financial reporting. While these vacancies were not the sole
                     cause of the deficiencies in the structure of HUD’s OCFO and financial
                     management systems, HUD’s ability to identify and make significant changes was
                     impaired. In turn, the governance structure and application-based deficiencies led
                     to four material weaknesses and eight significant deficiencies, including three
                     departures from GAAP that are reported in this report. 35

     Stronger Direction and Involvement
     With Program Accounting Is Needed
     From OCFO

                     HUD’s Chief Financial Officer did not always provide policy guidance and
                     oversight for all agency financial management personnel, activities, and
                     operations as required by the CFO Act. OCFO lacked dedicated positions or
                     divisions to (1) monitor the issuance of accounting standards and guidance from
                     entities such as the Federal Accounting Standards Advisory Board (FASAB),
                     OMB, and Treasury; (2) determine their impact on HUD and prepare and issue
                     new or updated accounting and financial management policies if necessary; and
                     (3) interpret and oversee the program offices’ accounting and financial
                     management policies and determine whether they comply with GAAP and other

35
     See findings 1, 2, and 5 in this report.

                                                      63
                 accounting and financial reporting requirements. As a result, HUD did not
                 develop or update its policies and procedures when new or updated accounting
                 standards and guidance were issued and was unaware that it was not compliant
                 with the new and updated standards. Additionally, the lack of Chief Financial
                 Officer oversight of the program offices’ accounting and financial management
                 policies and procedures led to an environment in which program-related needs
                 and concerns were assigned a higher priority than financial management and
                 reporting requirements.

                 Specifically, the lack of a position or division responsible for monitoring the
                 issuance of accounting standards and preparing and issuing new or updated
                 accounting and financial management policies, if necessary, resulted in a material
                 weakness and a significant deficiency, both leading to departures from GAAP.
                 First, OCFO did not identify the need for and develop policies to account for
                 transactions and assets resulting from a congressional requirement 36 to implement
                 Treasury regulations on cash management for the Section 8 Housing Choice
                 Voucher program. As a result, HUD failed to properly account for these
                 transactions, which led to a departure from GAAP. Second, HUD did not have
                 policies and procedures in place to recognize expenses when incurred and accrue
                 related liabilities. As a result, HUD failed to comply with Statement of Federal
                 Financial Accounting Standard (SFFAS) 5: Accounting for Liabilities of the
                 Federal Government, which led to a departure from GAAP. These deficiencies
                 are discussed in detail within this report. 37

                 Due to the size and nature of HUD, its Chief Financial Officer delegated and
                 relied on the program offices for several core financial management functions,
                 including determining disbursement methodology for CPD’s formula grants; the
                 administrative control of funds; and in the case of Ginnie Mae, financial
                 reporting. The lack of adequate Chief Financial Officer oversight of these and
                 other delegated functions led to two material weaknesses and three significant
                 deficiencies identified in our audit. The lack of oversight was the result of the
                 OCFO’s not having a position or division with the responsibility for overseeing
                 and coordinating financial management functions handled by the program offices.
                 As a result, program-related needs and concerns were assigned a higher priority
                 than financial management and reporting requirements, such as compliance with
                 GAAP.

                 Specifically, CPD was using the first in, first out (FIFO) method to obligate and
                 disburse funds for its formula grants program. This method disregarded United
                 States Standard General Ledger (USSGL) attributes at the transaction level when
                 making disbursements and created a departure from GAAP. The Chief Financial
                 Officer also failed to adequately oversee the conversion of Ginnie Mae’s financial

36
   In the Conference Report on H.R 2112, Consolidated and Further Continuing Appropriations Act, 2012, when
addressing the PIH tenant-based rental assistance program, Congress stated, “The conferees expect HUD to follow
Treasury’s rules on cash management in this account.”
37
   See findings 2 and 5 in this report.

                                                       64
                      statements from commercial GAAP to Federal GAAP when consolidating the
                      financial statements for HUD. Deficiencies in the conversion process led to a
                      material weakness. Inadequate oversight and monitoring of agency financial
                      management functions also led to significant deficiencies in HUD’s reporting of
                      accounts receivable, its administrative control of funds system, and processes for
                      reviewing obligations and deobligating funds that were no longer needed. These
                      deficiencies are discussed in detail elsewhere within this report. 38

     Integrated Accounting and
     Financial Management Systems
     Were Not Implemented and
     Maintained

                      The CFO Act states that the responsibilities of an agency Chief Financial Officer
                      include developing and maintaining integrated accounting and financial
                      management systems and implementing agency asset management systems,
                      including systems for cash management, debt collection, and property inventory
                      management and control. Ideally, financial management systems should provide
                      complete, reliable, timely, and useful financial management information
                      efficiently and automatically. HUD was not able to develop newer, more efficient
                      systems to replace the multiple legacy financial management systems required to
                      perform core financial system functions. Consequently, the Chief Financial
                      Officer did not maintain integrated accounting and financial management systems
                      or implement agency asset management systems as required by the CFO Act.
                      Specifically, we noted the following:

                          •    In fiscal year 2012, OCFO’s efforts to replace its noncompliant core
                               financial management system failed due to poor planning and lack of
                               consideration of components’ functional needs;
                          •    OCFO did not ensure that program office feeder systems, such as HIAMS
                               and IDIS Online, were designed to provide compliant financial
                               information;
                          •    OCFO did not ensure that adequate systems were in place for credit-
                               granting programs
                          •    A cash management system that properly recognized accounts receivable
                               or payable or ensure that assets were properly protected was not
                               implemented;
                          •    HUD’s property inventory management and control system support
                               contract lapsed during August 2011, and HUD operated without a
                               functioning inventory management system. Contrary to CFO Act
                               requirements, OCFO did not ensure property management control over
                               accountable assets and was not able to produce auditable depreciation
                               schedules.


38
     See findings 1, 4, 6, 7, and 8 in this report.

                                                      65
             HUD’s inability to complete its core financial system implementation project;
             implement asset management, cash management, and credit management systems;
             and ensure feeder system compliance resulted in HUD’s inability to routinely
             provide reliable financial information consistently, accurately, and uniformly.

Conclusion

             In fiscal year 2013, HUD did not have permanent leadership within OCFO, an
             effective financial management governance structure within OCFO, adequate
             policy and guidance over financial management and reporting, compliant
             information systems, or effective monitoring of financial management activities
             and operations. The absence of a Chief Financial Officer, permanent Assistant
             Chief Financial Officers, and a Senior Management Council limited the ability of
             OCFO to facilitate and stress the importance of financial management and
             internal controls over financial reporting throughout HUD. Deficiencies in
             HUD’s implementation of the CFO Act also contributed to this condition.
             Specifically, OCFO did not provide policy guidance on and oversight of all
             agency financial management activities and operations, nor did it see to proper
             implementation of financial and asset management systems. This deficiency
             created an environment in which program office operational objectives received
             precedence over financial management and reporting requirements. As a result,
             we identified multiple significant deficiencies in HUD’s internal controls and a
             material weakness, including departures from GAAP.

Recommendations

             We recommend that the Deputy Secretary for HUD

             9A.    Conduct a study on what improvements could be made in HUD OCFO to
                    increase compliance with the CFO Act agency requirements.

             9B.    After conclusion of the study, issue a directive or memorandum to HUD,
                    reemphasizing the Chief Financial Officer’s authority and responsibility
                    for departmentwide financial management and internal controls over
                    financial reporting and changes in any financial management governance.

             9C.    Create and chair a Senior Management Council or equivalent to ensure
                    that HUD remains committed to implementing and operating the
                    recommendations made in the study and ensure that an appropriate system
                    of internal controls is in place.

             We recommend that the Acting Chief Financial Officer

             9D.    Initiate and complete the selection process to fill vacant Assistant Chief
                    Financial Officer positions.

                                              66
9E.   Implement a function to monitor issuances of accounting standards and other
      related guidance, determine the issuances’ impact on HUD, and develop and
      issue new or updated policies and procedures as needed.

9F.   Ensure that documented policies and procedures are in place for all of
      HUD’s accounting processes and that they are periodically evaluated for
      necessary updates.




                               67
Finding 10: Weaknesses in HUD’s Rental Housing Assistance Program
Monitoring Continued
HUD needs to improve the monitoring of its more than 2,200 PHAs to ensure that they (1) report
accurate financial, compliance, and performance data; (2) comply with statutory objectives; (3)
utilize their funds and leasing capacity; and (4) verify tenant data to reasonably ensure correct
housing subsidy payments. Although HUD had improved some aspects of its internal controls
from previous years, more improvements are needed to ensure that these objectives are met.
Consequently, the accuracy of Voucher Management System (VMS) self-reported data was
questionable, compliance with Moving To Work program (MTW) statutory requirements could
not be determined, PHAs did not fully utilize their funding, and PHAs continued to make
significant amounts of improper payments.



     Financial Data Reported in
     VMS Were Not Sufficiently
     Verified To Reasonably Ensure
     Accuracy


                  VMS collects PHA data that enable HUD to fund, obligate, and disburse voucher
                  funding to PHAs in the Section 8 Housing Choice Voucher program. Since HUD
                  uses VMS data to determine annual funding allocations, calculate quarterly PHA
                  disbursements under the new cash management process, and determine PHA net
                  restricted asset (NRA) excess funds, it is critical that the data it contains be
                  reliable. The 2012 appropriations law also requires VMS data validation; 39
                  however, we found that the majority of the monitoring reviews and analytical
                  procedures that HUD performed were not adequate to ensure the accuracy of the
                  data.

                  The Financial Management Division and the Financial Management Center
                  performed analytical testing on the VMS data; however, this testing was designed
                  only to identify significant inconsistencies in PHA-reported data. 40 This method
                  did not ensure that PHAs accurately calculated and reported their expenditures;
                  therefore, HUD could not rely on this method to reasonably ensure the validity of
                  VMS data.



39
   Public Law 112-55, Division C, Title II, states that the HUD Secretary, for the calendar year 2012 funding cycle,
must provide renewal funding for each PHA based on validated VMS leasing and cost data for the prior calendar
year.
40
   The Financial Management Center and Financial Management Division compare a PHA’s lowest and highest
monthly leasing rate and housing assistance expenses during a given period. If the range is greater than a certain
threshold, a financial analyst follows up with the PHA.

                                                         68
                 HUD primarily uses Quality Assurance Division reviews to validate VMS data.
                 However; in fiscal year 2013, the Division did not conduct sufficient onsite or
                 remote VMS validation and financial management reviews to adequately achieve
                 this objective. In fiscal year 2013, it reviewed only source documentation to
                 validate VMS data for 59 PHAs, or 2.5 percent of the PHA population, onsite and
                 170, or 7.3 percent of the PHA population, remotely. The results of these
                 reviews 41 indicate that they directly enhanced the quality of VMS data because
                 they resulted in the identification of large discrepancies that led to significant
                 changes to VMS data. For fiscal year 2013, the Quality Assurance Division
                 found that 25 of 29 PHAs reviewed during onsite VMS validation had housing
                 assistance payment discrepancies that required VMS adjustments of $2.9 million.
                 Further, the Division found that 27 of 30 PHAs reviewed during onsite financial
                 management reviews misreported NRA by a total of $47.6 million and
                 unrestricted net assets by a total of $16.4 million. Finally, of the 170 remote
                 VMS and financial management reviews, The Division found 55 PHAs with
                 discrepancies that required VMS adjustments of $3.6 million. The high number
                 of errors identified through the limited number of reviews completed indicated
                 that VMS data contained a significant number of errors and additional validation
                 is needed. This is essential because VMS is used for several significant funding
                 calculations, such as annual funding allocations, quarterly PHA disbursements,
                 and PHA NRA excess funds. Since VMS data is not adequately validated, PHAs
                 could be holding significant amounts of funds in excess of their immediate
                 disbursing needs and utilizing funds for ineligible expenses, exposing HUD to
                 increased risk of improper payments in addition to making the Section 8 program
                 more susceptible to fraud, waste, and abuse.

     The Quality Assurance Division
     Monitoring Reviews Were Not
     Sufficient

                 To provide timely validation of PHA program and financial information and
                 ensure compliance with voucher program requirements, in 2003, a congressional
                 committee recommended that HUD establish a Quality Assurance Division for the
                 Section 8 Housing Choice Voucher program. Congress believed that by verifying
                 PHA monthly leasing rates and costs, HUD and Congress could improve the
                 monitoring of Section 8 spending and project future budget requirements.
                 However, in fiscal years 2012 and 2013 Quality Assurance Division staff was
                 given only 53 (71 percent) and 47 (63 percent) of the 75 personnel recommended



41
  Reviews are considered complete when the corrections have been made in VMS and the review results are
uploaded to SharePoint. After the Quality Assurance Division finalizes the review, PHAs are given 30 days to
respond to its findings before the results are finalized. Once this process is complete, the Division uploads VMS
corrections to SharePoint. For our review, we used VMS correction results posted on the Division’s Web site as of
November 6, 2013, for all reviews except financial management reviews, which the Division provided on November
12, 2013.

                                                       69
                by Congress. 42 Further, the Division was allocated only $455,000 for travel and
                given only $251,178, which forced it to stop onsite reviews. Additionally, the
                Division was told to limit its contact with PHAs due to the proration of PHA
                administrative fees. Consequently, it could review only source documentation to
                validate VMS financial data for 2.5 percent of the PHA population onsite and 7.3
                percent remotely through VMS and financial management reviews. Further, the
                Division reviewed less than 1 percent of PHAs comprehensively to determine rent
                reasonableness. Without reviewing source documentation, the reviews provided
                little assurance that PHAs submitted accurate financial information and complied
                with Section 8 requirements.

                The majority (90 percent) of Quality Assurance Division reviews were “RATS”
                and “Portfolio Rent” reviews, 43 which are conducted remotely and use fewer
                resources. However, these reviews do not review source documentation and are
                primarily used to plan further reviews. “RATS” reviews compare only PHA-
                reported information entered into VMS and FASS-PH. While some of the data in
                FASS-PH are audited, RATS procedures instruct staff to review the most recent
                yearend financial statements, regardless of whether they are audited. Since PHAs
                have 9 months to submit audited statements, it is likely that the Division staff
                compared VMS PHA submissions to unaudited FASS-PH data, which lacked the
                independent auditor assurance. Consequently, RATS reviews provided only
                assurance that PHAs submitted matching data and no assurance that the data were
                correctly reported in either system. Similarly, rent reasonableness portfolio
                reviews require the use of fewer resources; however, if the Division identified a
                possible problem with a PHA’s rent during a portfolio review, the problem may
                not have been corrected until a future review was conducted, thereby greatly
                reducing its ability to ensure PHA compliance with Section 8 requirements.

                More importantly, the Quality Assurance Division did not have a central database
                for tracking PHA corrective actions and ensuring that its findings were resolved.
                When QAD reports a finding, other than a VMS correction, the PHA is required
                to develop a corrective action plan which is reviewed by the Division, but the
                field office was ultimately responsible for ensuring that findings are resolved.
                However, field offices were not responsible for reporting the resolution process to
                the Division; therefore, the Division could not ensure that its findings had been
                resolved.

                Since the majority of the Quality Assurance Division’s reviews did not review
                supporting documentation, the Section 8 Housing Choice Voucher program relied

42
   On July 24, 2003, the House of Representatives Congressional Appropriations Committee recommended that
HUD establish a Quality Assurance Division with 75 full-time employees for the Section 8 Housing Choice
Voucher program to provide more timely validation of PHA program and financial information and ensure
compliance with program requirements. The Division had 53 and 47 employees in fiscal years 2012 and 2013,
respectively.
43
   VMS FASS-PH remote data analysis protocol reviews are referred to as RATS reviews. These reviews accounted
for 75 percent of Quality Assurance Division reviews from October 1 to August 15, 2013. Portfolio rent
reasonableness remote reviews accounted for 15 percent of the reviews from October 1 to August 15, 2013.

                                                     70
                 heavily on PHA self-reported information. The Division’s impact was further
                 hampered by decreased communication with PHAs and its lack of a central
                 tracking database. This situation was especially problematic because as noted in
                 the sections above, HUD did not have sufficient internal monitoring controls in
                 place to ensure validation of PHA program and financial information. This
                 deficiency further increased HUD’s risk of improper payments and made the
                 Section 8 program more susceptible to fraud, waste, and abuse.

     Opportunities Exist To Improve
     the Use of Housing Choice
     Voucher Program Funds

                 In previous years, we reported that PHAs had not maximized leasing rates or used
                 all of their available resources, which caused excessive accumulations in PHA
                 NRA accounts. However, two rescissions corrected this problem in fiscal year
                 2013. In March 2013, Congress approved two funding reductions amounting to
                 $975 million for the Housing Choice Voucher program. 44 With less funding,
                 PHAs used up their resources and drew funds from their NRA accounts to cover
                 their costs. Therefore, the NRA balance decreased significantly during fiscal year
                 2013. 45

                 Before the effects of the rescissions, PIH implemented the Housing Choice
                 Voucher program Info Path system and 2-year forecasting tool to improve the
                 utilization of program funds and decrease shortfalls. The InfoPath system flags
                 PHAs with potential shortfalls to alert field offices and ensure that they work with
                 the PHA to avoid shortfalls. The 2-year forecasting tool projects program
                 leasing, 46 spending, and funding over a 2-year period to allow field offices to
                 monitor unit and fund utilization. Since funding levels impacted unit utilization,
                 it was difficult to determine the effectiveness of these tools; however, they
                 appeared to increase the communication between the field offices and PHAs,
                 which is essential in reducing shortfalls and increasing utilization.

                 Although HUD was using these new tools, PIH data indicated that as of June 30,
                 2013, 447 PHAs, or 19 percent of the 2,200 PHAs, had the resources to lease
                 additional units but did not reach their 95 percent utilization goal. Further, as of
                 June 30, 2013, the PIH data showed 457 PHAs, or 19.6 percent, with potential
                 shortfalls with a cash shortage of $96 million. These results are in line with a


44
   The fiscal year 2013 third quarter consolidated financial statements listed an across-the-board rescission and
sequestration recession totaling $975,528,215. The across-the-board rescission was stated in the Consolidated and
Further Continuing Appropriations Act, 2013, Public Law 113-6, issued March 26, 2013. Sequestration cuts were
ordered in a presidential order, issued March 1, 2013. The across-the-board rescission Treasury warrant date was
May 29, 13, and sequestration rescission Treasury warrant date was August 24, 2013.
45
   During fiscal year 2013, the NRA balance decreased by $342,730,540. The estimated NRA ending balances as of
September 30, 2012, and June 30, 2013, were $986,303,505 and $643,572,965, respectively.
46
   Leasing is considered maximized at 95 percent.

                                                       71
                  recent OIG audit report on the Housing Choice Voucher program, 47 which stated
                  that HUD had generally implemented the guidance for optimizing and stabilizing
                  housing choice voucher utilization through HUD’s utilization protocol; however,
                  opportunities existed to strengthen controls to ensure stable optimal utilization. In
                  the report, OIG recommended that HUD implement all utilization protocols and
                  improve controls.


     MTW Program Statutory
     Objectives Were Not Measured

                  In prior years, OIG and GAO 48 reported that HUD’s internal controls were not
                  sufficient to capture and evaluate MTW PHAs’ performance and use of funds to
                  determine HUD’s compliance with the program statutory objectives. 49 To
                  address this concern, in fiscal year 2013, HUD revised its standardized reporting
                  framework and data collection process; however, HUD had not determined how it
                  would use this information to measure PHA compliance with statutory objectives.
                  Therefore, this underlying problem continued to exist. Consequently, a recent
                  OIG audit report on the MTW program 50 reported that HUD’s program oversight
                  was inadequate because HUD still had not (1) implemented programwide
                  performance indicators, (2) evaluated agencies’ programs according to its policy,
                  (3) evaluated agencies’ compliance with key statutory requirements, (4) verified
                  agencies’ self-reported performance data, and (5) performed required annual
                  program risk assessments.

                  HUD revised its standard reporting framework in its annual MTW plan and report
                  to include standard metrics for each of the statutory objectives. Starting in June
                  2013, HUD required MTW PHAs to use the revised format for any new proposed
                  activities. HUD expected all MTW PHAs to use the new MTW plan and report
                  format for all MTW activities by March and April of 2014, respectively. 51 In
                  addition to revised reporting documents, HUD was simplifying its process for
                  data collection. Previously, HUD required MTW PHAs to submit program data
                  in both the annual MTW report and HUD systems, resulting in the submission of
                  duplicative or conflicting information. To simplify this process and eliminate
                  confusion, HUD now requires MTW PHAs to submit only audited program data
                  in FASS. With the new reporting requirement, PHAs will report the program

47
   Audit Report 2013-NY-0002, HUD Can Improve Public Housing Agencies Use of Housing Choice Vouchers by
Consistently Implementing All Utilization Protocols and Improving Controls, issued July 18, 2013
48
   GAO-12-490, Opportunities Exist to Improve Information & Monitoring, issued April 19, 2012
49
   OMB Circular A-123, section I, states, “The proper stewardship of Federal resources is an essential responsibility
of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources
are used efficiently and effectively to achieve desired objectives.”
50
   Audit Report 2013-PH-0004, HUD’s Oversight of Its Moving to Work Demonstration Program Needs
Improvement, issued September 27, 2013
51
   HUD’s MTW office provided MTW PHAs with a 120-day transition timeframe to submit the annual MTW plans
and reports in the new format. Each MTW PHA’s submission due date depended on the fiscal year start date.

                                                         72
                  results in a simplified format that will permit cost and production comparisons
                  over time.

                  While HUD had implemented a new framework for collecting information, it
                  needs to determine how it will evaluate and use the data it collects. HUD had
                  been meeting with representatives of MTW agencies to develop an agreement on
                  a methodology that will be used to evaluate the basic performance of agencies
                  against the statutory objectives. HUD planned to finalize the methodology for
                  assessing performance by April 2014. Tracking the performance of MTW PHAs
                  is necessary to ensure that physical conditions for public housing residents are
                  suitable, public housing units are appropriately utilized, and agencies maintain a
                  satisfactory financial condition within available resources. Without performance
                  tracking, more than $3 billion in funding for the MTW program would be
                  susceptible to fraud, waste, and abuse.

                  In fiscal year 2012, OIG recommended 52 that HUD establish and implement
                  policies and maintain adequate staffing levels to ensure proper oversight of the
                  MTW program. The final action target dates for the recommendations were
                  between December 2013 and December 2014.

     Significant Improper
     Payments in Rental Housing
     Programs Continued in
     Fiscal Year 2012

                  HUD’s rental housing assistance programs had previously been assessed as being
                  at high risk of significant improper payments. These programs constituted over
                  30 billion, or 30 percent, of HUD’s total payments in fiscal year 2012. HUD’s
                  RHAP are administered by Public Housing Agencies (PHAs) and multifamily
                  housing owners or management agents on HUD’s behalf. In general,
                  beneficiaries pay up to 30 percent of their adjusted income as rent, and HUD
                  payments cover the remainder of the rental cost (or the operating cost, in the case
                  of public housing). From fiscal year 2000 through 2011, HUD reduced the gross
                  improper payments for from $3.22 billion to $1.12 billion, a reduction of 65
                  percent. However, the total error still significantly higher than the threshold
                  established by the Improper Payment Elimination and Reduction Act of 2010 53.



52
   HUD OIG’s fiscal year 2012 Consolidated Financial Statement Audit report 2013-FO-0003
53
   Improper Payment Elimination and Reduction Act of 2010 requires that Agencies to perform statistical study to
determine the level of error in their program. If the gross error is higher than 1.5 percent for 2013, then the program
is considered susceptible to significant improper payments. Therefore, HUD is required to perform a quality control
study on the RHAP to estimate the level of improper payments due to following type of error (1) subsidy calculation
and eligibility errors made by the PHAs and Owner-administrated projects and (2) from tenants that underreported
their income. An improper payment is any payment that should not have been made or that was made in an
incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other
legally applicable requirements

                                                          73
                  Therefore, HUD needs to ensure that rental housing assistance program funds 54
                  are expended in compliance with the program’s regulations. 55 HUD must
                  establish internal controls to ensure that PHAs and private multifamily project
                  owners or management agents (1) correctly calculate housing subsidies by
                  corroborating tenants’ eligibility, income level, reasonable market rent rates and
                  unit sizes, and (2) provide safe, decent, and sanitary housing.

                  HUD’s most recent contracted quality control study 56 of fiscal year 2012
                  estimated that HUD made substantial improper payments in three major rental
                  housing assistance programs. The study reported gross erroneous payments of
                  approximately $190.8 million in public housing, $430.7 million in PHA-
                  administered Section 8, and $177.2 million in owner-administered Section 8
                  programs, amounting to approximately $798.8 million. The study was based on
                  analyses of a statistical sample of tenant files, tenant interviews, and third-party
                  documents verifying income. Errors in this study are a combination of program
                  administrators’ not entering correct data into PIH’s Information Center system
                  and HUD’s Tenant Rental Assistance Certification System and program
                  administrators’ not verifying tenant-reported information.

                  Additionally, the contractor performed a second study to identify tenants who
                  intentionally did not report the income from their employers. Improper payments
                  amounted to approximately $203.7 million in PHA-administered public housing,
                  $168.8 million in PHA-administered Section 8, and $46.7 million in owner-
                  administered Section 8 programs, totaling $419.2 million in subsidy costs. HUD
                  did not conduct a study to estimate the error from the multifamily project owners
                  billing to HUD for fiscal year 2012 but used the $106 million estimated billing
                  error to arrive at the total gross error amount of $1.32 billion in improper
                  payments.

     Conclusion

                  HUD did not have sufficient controls in place to ensure that PHAs calculated and
                  reported accurate financial, program, and compliance information on the 2,300
                  PHAs that received $18 billion in fiscal year 2013. Therefore, in fiscal year 2013,
                  HUD could not reasonably ensure that its disbursements to PHAs were based on
                  accurate VMS data or assert that PHAs had processes in place to ensure Section 8
                  program compliance for the MTW programs. Consequently, HUD was at risk of

54
   HUD’s three major rental using housing programs are (1) the public housing operating subsidy, (2) the public
housing Section 8 (Housing Choice Voucher and Modern Rehabilitation) and (3) the multifamily project owner-
administered project-based programs. Rental housing assistance program combined funding provided to the PHAs
and administrators amounted to $30 billion in 2012.
55
   OMB Circular A-123, section I, states, “The proper stewardship of Federal resources is an essential responsibility
of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources
are used efficiently and effectively to achieve desired objectives.”
56
   Quality Control for Rental Assistance Subsidy Determination, issued September 27, 2013. This report was
produced for HUD by ICF International.

                                                         74
          increased improper payments, and the Section 8 program was more susceptible to
          fraud, waste, and abuse.

Recommendations

          We recommend that the Assistant Secretary for the Office of Public Housing

          10A.    Develop a risk assessment process that evaluates risk for all PHAs. Based
                  on the risk assessment determine which PHAs need to be reviewed within
                  the fiscal year to reasonably ensure VMS data is accurate and expenses are
                  valid.

          10B.    Allocate resources so that all of the reviews determined as necessary in the
                  risk assessment can be performed and clearly documented to show the
                  qualitative and quantitative findings.

          10C.    Perform a cost benefit analysis on RATS reviews to determine whether (1)
                  the results of the reviews are beneficial in determining accuracy of PHA
                  self-reported data, (2) the process can be automated, and (3) staff
                  performing RATS reviews can be reallocated to teams that perform other
                  types of monitoring reviews.

          10D.    Develop and implement a mechanism to track the resolution process for
                  all Quality Assurance Division reviews and require field offices to use this
                  system during their follow-up.

          10E.    Develop and implement standard operating procedures for addressing
                  PHAs that have not submitted financial statements, including a process for
                  assessing and collecting late penalties in a consistent and timely manner.




                                           75
Finding 11: Financial and Program Management Controls Over the
Emergency Homeowner’s Loan Program Were Weak
HUD did not implement sufficient controls over the Emergency Homeowner’s Loan Program
(EHLP) to ensure compliance with program, accounting, and financial reporting requirements.
This condition was due to a lack of permanent program management structure, causing the
administration of the program to be fragmented among three different program offices, resulting
in the lack of established policies and procedures to ensure adequate administration, monitoring,
and oversight of the program. As a result, (1) $90.1 million in obligations remained as of
September 30, 2013, that potentially no longer had a bona fide need, (2) loans were potentially
issued in excess of the maximum loan amount mandated by law, and (3) the portfolio lacked an
adequate subsidiary ledger to support the loan receivable balance recognized on the financial
statements.


     Obligations Were Not Routinely
     Evaluated for Need

                The passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act
                enacted the Emergency Homeowners’ Relief Fund on July 21, 2010, which
                authorized $1 billion in assistance in the form of a declining balance, nonrecourse,
                zero-interest, subordinate secured loan up to $50,000 to eligible homeowners.
                HUD administered these funds through EHLP in two ways: (1) direct loans to
                eligible homeowners (HUD-administered) and (2) grants to States with
                substantially similar assistance programs (substantially similar States or SSS).
                Our prior-year report 57 determined that the program lacked a permanent
                management structure, a condition which continued. The two methods described
                above are formally administered by HUD’s Office of Policy Development and
                Research, which relies on OCFO and the Office of Housing to perform essential
                monitoring functions. However, our review found that substantial amounts of
                obligations that were potentially invalid remained obligated and were unreviewed
                by the program offices.

                Our review of the program obligations determined that administrative and
                assistance obligations were not routinely evaluated for need as required by Title 7,
                GAO, and HUD requirements. We found $24.3 million in potential invalid
                obligations, $8.8 million of which represented cases that had been terminated
                from the program and forwarded to the National Servicing Center (NSC).
                Additionally, $5.7 million and $2.7 million in projects were obligated in fiscal
                years 2011 and 2012, respectively, but as of September 30, 2013, had not been



57
  Audit Report 2011-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Year 2011 and 2010
Financial Statements, issued November 15, 2011

                                                    76
                  disbursed. Additionally, we reviewed the fiscal agent agreement 58 and
                  outstanding obligation balance as of September 30, 2013. Based on an analysis of
                  the task pricing structure of the original contract and an assessment of future
                  fiscal agent costs projected to be incurred through the end of the program, we
                  determined that potentially $17.9 million of the remaining $18.7 million
                  undisbursed obligation was no longer needed to fund the remainder of the
                  program and, therefore, could be deobligated. The large reduction in the need for
                  funding was primarily due to a significant shortfall in borrower program
                  participation from that originally projected at contract execution.

                  Our review of the State grantees’ outstanding obligations as of September 30,
                  2013, calculated projected run-out costs of the program based on quarterly files of
                  application and loan-level data submitted by each of the five States compared
                  with the outstanding obligation balance in LOCCS as of October 4, 2013. This
                  analysis projected $25.6 million needed to fund remaining active loans for the
                  duration of their term and identified as much as $47.9 million in excess
                  obligations that could be eligible for deobligation, $27 million of which could be
                  tied to loans that had already been terminated from the program.

     HUD Did Not Have Adequate
     Assurance of Controls Over Its
     Fiscal Agent and State Grantees

                  Our review also determined that HUD did not have adequate assurance of controls
                  over EHLP, including its fiscal agent, to ensure program compliance and accurate
                  financial reporting on the program. Specifically, HUD lacked a Statement on
                  Standards for Attestation Engagements (SSAE) 16 59 review of the fiscal agent
                  performing all loan processing functions of the HUD-administered portion of the
                  portfolio, which would have reported on the internal controls in place at the fiscal
                  agent. This examination was not completed because the requirement to complete
                  one was not included in the fiscal agent contract at the time of execution. The
                  initial proposal from the fiscal agent included the requirement for an SSAE 16;
                  however, HUD decided to have it excluded from the contract. The lack of this
                  review resulted in HUD’s loss of assurances that (1) internal controls were in
                  place and operating effectively for the program loan processing performed by the
                  fiscal agent and (2) funds appropriated by Congress for the direct loan
                  subcategory of EHLP totaling $209.8 million were protected against fraud, waste,
                  abuse, and misappropriation at the time of contract obligation. After OIG’s
                  inquiries, in September 2013, HUD began implementing reporting and
                  reconciliation processes for the fiscal agent to compensate for the lack of an
                  SSAE 16. Additionally, an onsite review at the fiscal agent was conducted in
58
   An agreement entered into by HUD with another entity to provide general accounting and fiscal administrative
control services on HUD’s behalf.
59
   SSAE 16, Reporting on Controls at a Service Organization – Examination engagements undertaken by a service
auditor to report on controls at organizations that provide services to user entities when those controls are likely to
be relevant to user entities’ internal control over financial reporting.

                                                           77
September 2013 to ensure program compliance, which HUD planned to continue
in the next fiscal year. The lack of these compensating measures for the 2 years
since implementation of the program, however, resulted in HUD’s inability to
protect $25.5 million invested in the fiscal agent.

For the SSS subcategory, HUD’s assurance that State grantees were administering
EHLP in accordance with statutory requirements significantly decreased in fiscal
year 2013 when contract services to perform financial and program reviews of
SSS’s EHLP were halted. Monitoring of the States was conducted by an
independent public accounting firm; however, the contract for these reviews was
not renewed by HUD, resulting in the lack of monitoring reviews performed in
fiscal year 2013.

The absence of monitoring and oversight efforts resulted in the disbursement of
loan amounts in excess of the legally established $50,000 maximum for two
borrowers that were issued loans from the State of Pennsylvania. Due to the lack
of monitoring and oversight of these grantees, these instances of potential
noncompliance were identified by OIG through routine audit work and not by
HUD.

Additionally, we found 16 instances in which SSS project amounts reported to
NSC by the States exceeded amounts reassigned to HUD. Further, the excess
amount reported for 15 of these 16 projects, after OIG inquiries, was revealed to
be the result of (1) unrelated State program funding simultaneously granted to
borrowers and (2) borrower contributions, all of which were erroneously reported
to HUD in combination with the SSS-related amounts. Additionally, we
identified instances of duplicate projects within the NSC records, each with
different principal amounts.

Similarly, we compared the NSC data as of September 30, 2013, with HUD’s
general ledger records for the HUD-administered subcategory of EHLP. We
noted that of 998 fully disbursed projects, 794 projects were not identified in
NSC’s records. These 794 projects had a combined disbursed amount of $5.4
million. Of the 204 projects that were identified in NSC’s records, 182 reflected a
principal balance that did not match the disbursed amount within the general
ledger records. The total variance of these 182 projects was $4.6 million.

We also compared the NSC data as of September 30, 2013, with those projects in
HUD’s general ledger records that were not yet fully disbursed but were
terminated from the program based on the fiscal agent’s records. As a result, we
identified 15 projects that were terminated from the program between October
2012 and April 2013 but were not in NSC’s records as of September 30, 2013.
These 15 projects had a combined disbursed amount of $0.6 million. Lastly, we
identified 308 projects that were reported by the fiscal agent as having been
terminated from the program between July 2012 and September 2013. These
projects were identified in NSC’s records; however, the total disbursed amount

                                78
             for these projects, according to HUD’s general ledger records, did not match
             NSC’s original principal amount. The total general ledger disbursed amount for
             these 308 projects was $9 million; the difference identified in NSC’s record was
             $1.8 million. We communicated these results to HUD and asked for explanations
             for the differences. HUD confirmed that the NSC files, which represent the basis
             from which HUD’s EHLP financial data were recorded, included inaccurate data
             in both amounts and project numbers and were undergoing review. Since HUD
             relied on NSC data for principal amounts and payments to record EHLP activity
             in the accounting records, the inaccurate data caused HUD’s financial statements
             to be misstated.

HUD Lacked an Adequate
Subsidiary Ledger To Support
the General Ledger

             HUD failed to implement an adequate subsidiary ledger with loan-level detail for
             loans that were still active that supported the financial statements. Instead,
             LOCCS was used as a subsidiary ledger. However, LOCCS is a component of
             HUD’s core financial system, and, therefore, any loan receivable balances must
             be supported by an adequate financial system (subsidiary ledger) that is linked
             electronically to the core financial system and can perform the required functions
             of a loan system.

             The HUD-administered EHLP loan portfolio was not entered into a direct loan
             system (subsidiary ledger) until September 2013, 2 years after program
             implementation. This delay prevented OCFO from properly monitoring,
             servicing, and reporting on these loans in accordance with GAO and program
             requirements.

Conclusion

             HUD did not implement sufficient controls over EHLP to ensure compliance with
             program, accounting, and financial reporting requirements. As a result, excess
             obligations remained as of September 30, 2013, that potentially no longer had a
             bona fide need, some of which were tied to borrowers who had been terminated
             from the program; loans were potentially issued in excess of the maximum loan
             amount mandated by law; and the portfolio lacked an adequate subsidiary ledger
             to support the loan receivable balance recognized on the financial statements.
             HUD needs to implement sufficient policies and procedures to establish internal
             controls over the program to ensure that it has adequate assurances regarding the
             loan processing completed by the fiscal agent and the States. Further, periodic
             reviews of all administrative and assistance obligations should be completed to
             ensure that invalid obligations do not remain available for disbursement. Lastly,
             HUD needs to ensure that an adequate subsidiary ledger is in place that supports
             all loan-level detail of the entire EHLP portfolio.

                                             79
Recommendations

          We recommend the Office of Policy Development and Research

          11A.    Develop and implement procedures that establish internal controls over
                  the HUD-administered EHLP to ensure that HUD has adequate assurances
                  regarding the loan processing completed by the fiscal agent and other
                  servicers for the HUD-administered subcategory of the EHLP portfolio.

          11B.    Develop and implement procedures that establish internal controls over
                  the SSS EHLP to ensure compliance with program objectives through the
                  duration of the program.

          11C.    Review the HUD-administered assistance obligations with remaining
                  balances totaling $24.3 million and close out and deobligate amounts tied
                  to obligations that are no longer valid or needed.

          11D.    Review the SSS assistance obligations for each State and deobligate as
                  much as $47.9 million tied to obligations that are no longer valid or
                  needed.

          11E.    Develop and implement procedures to routinely evaluate the assistance
                  and administrative obligation balances for the HUD-administered and SSS
                  subcategories of EHLP to determine whether a valid need still exists and if
                  not, deobligate those balances.

          We recommend the Office of the Chief Financial Officer

          11F.    Ensure that an adequate subsidiary ledger is in place that supports the
                  loan-level detail of all HUD-administered direct loans and reconciles to
                  the EHLP loan receivable balance in the general ledger.

          11G.    Review the fiscal agent contract remaining obligation balance and
                  deobligate as much as $17.9 million tied to contract funds that are no
                  longer needed.




                                           80
Finding 12: HUD’s Computing Environment Controls Had Weaknesses
HUD’s computing environment, data centers, networks, and servers provide critical support to
all facets of its programs, mortgage insurance, financial management, and administrative
operations. In prior years, we reported on various weaknesses with general system controls and
controls over certain applications, as well as weak security management. These deficiencies
increase risks associated with safeguarding funds, property, and assets from waste, loss,
unauthorized use, or misappropriation.

We audited general and application controls over selected information systems that support the
preparation of HUD’s financial statements. We also followed up on the status of previously
reported application control weaknesses. Our review found information systems control
weaknesses that could negatively affect HUD’s ability to accomplish its assigned mission,
protect its data and IT assets, fulfill its legal responsibilities, and maintain its day-to-day
functions. Presented below is a summary of the control weaknesses found during the review.


 HUD’s Continuous Monitoring
 Program Had Deficiencies

               We reviewed policies and processes applicable to HUD’s continuous monitoring
               program. Continuous monitoring is maintaining ongoing awareness of
               information security, vulnerabilities, and threats to support organizational risk
               management decisions. It provides (1) ongoing assurance that planned and
               implemented security controls are aligned with organizational risk tolerance and
               (2) the information needed to respond to risk in a timely manner. We found that
               HUD’s continuous monitoring program needed improvements in its design to
               strengthen the collecting and reporting of information security data. The
               improvements would also increase assurance for the accuracy and reliability of
               the business and financial processes that the IT systems support. Specifically, we
               found that

                  1. Automated mechanisms were not in place to continuously detect hardware
                     at the data center or continuously block unapproved software; thus, OCIO
                     may have been unaware of hardware that was not securely configured and
                     patched on HUD’s network at the data center. If the hardware was
                     Internet accessible, it could be exploited from anywhere in the world.
                     Also, because unapproved software was not continuously blocked, HUD
                     systems could have run uniquely harmful software that threatened the
                     confidentiality, integrity, or availability of the business processes that the
                     IT systems support.

                  2. Web application vulnerability scans were not performed for more than 2
                     years on systems that support the financial statements, such as HUD’s

                                               81
                  Consolidated Financial Statement System (Hyperion) and the Financial
                  Data Mart. These systems continue to be given authorizations to operate
                  despite the lack of knowledge regarding what vulnerability risk they may
                  pose to the financial statements and HUD’s mission.

               3. Continuous monitoring policies were not clearly defined to reflect
                  reporting requirements and updated National Institute of Standards and
                  Technology guidance on frequencies for security status monitoring. As a
                  result, ongoing system security authorizations were maintained using
                  security-related information that was not collected frequently enough to
                  ensure that the reporting of the information was always accurate.

Weaknesses With Contingency
Planning Were Identified

           While observing the semiannual disaster recovery exercise in April 2013, we
           noticed that telecommunication links were not in place for transmitting data to
           Treasury from the recovery site. The OCIO has a Memorandum of
           Understanding (MOU) with Treasury to allow HUD applications to transfer
           business and budgetary information for action required by Treasury. The
           “Disasters and Other Contingencies” clause in the MOU requires the designated
           technical staff to immediately notify the designated counterpart in the event of a
           disaster or other contingency that disrupts the normal operation of the connected
           systems. The MOU does not contain any alternate provisions for the connection
           to be resumed at an alternate site. Upon further inquiry we determined there are
           no contingency plans in place for resuming operation of the telecommunication
           links to Treasury during a disaster recovery event.

Information System Control
Weaknesses Were Identified in
the Financial Systems

           We reviewed the effectiveness of the information system controls that can impact
           the security and reliability of the financial information maintained in LOCCS,
           Hyperion, and HUDCAPS. We found HUD did not ensure that the general and
           application controls over these systems fully complied with Federal requirements
           and its own security policies. These control weaknesses place HUD’s resources
           at risk of inadvertent or deliberate misuse, financial information at risk of
           unauthorized modification or destruction, sensitive information at risk of
           inappropriate disclosure, and critical operations at risk of disruption.




                                            82
     Information System Control
     Weaknesses Were Identified in
     LOCCS

                  The Line Of Credit Control System (LOCCS) is HUD’s primary system for
                  disbursement, cash management, and post-award of financial grants. It is a
                  mission critical system, with approximately 20,000 users. LOCCS is an integral
                  part of OCFO’s core financial management system. It manages disbursements for
                  the majority of HUD programs. LOCCS is available 7 days a week to service the
                  funding needs of HUD's grant, loan, and subsidy clients. Users typically access
                  LOCCS through Web enabled modules or by using the Voice Response System
                  (VRS). The VRS is a hardware component relied upon by approximately 5,000
                  users. It allows recipients to request payments via a question/answer session
                  using a touch-tone telephone.

                  We found 60 that (1) the LOCCS VRS was not covered by a hardware maintenance
                  agreement, (2) LOCCS disaster recovery testing did not include all of the
                  essential components, (3) LOCCS access controls needed updates, (4) some of the
                  LOCCS system documentation was outdated, and (5) the separation of duties
                  between the LOCCS voucher processing and banking groups was not fully
                  achieved.

     Information System Control
     Weaknesses Were Identified in
     Hyperion

                  The HUD Consolidated Financial Statement System (Hyperion) is a mission-
                  critical financial system for the consolidation of the general ledger activities from
                  HUD’s program offices and HUD’s financial statement reporting system for
                  reporting to the U.S. Department of the Treasury and the Office of Management
                  and Budget. Hyperion summarizes financial activity provided by the OCFO,
                  FHA, and Ginnie Mae. HUD uses Hyperion to report on more than $35 billion in
                  new authority each fiscal year and more than $100 billion in unexpended
                  balances.

                  We found 61 that OCFO did not (1) follow HUD’s access control policies; (2)
                  implement effective interface procedures to ensure that the FHA and Ginnie Mae
                  financial data were protected during transmission and access to these data were
                  restricted while stored; (3) modify the contract to ensure its support contractor
                  was required to update the interface procedures to reflect the current data fields
60
   2014-DP-0001, Information System Control Weaknesses Identified in the Line of Credit Control System, issued
November 7, 2013. This was a limited distribution report due to the sensitive nature of the information reported,
and was, therefore, not made available to the public.
61
   2013-DP-0007, Information System Control Weaknesses Identified in the Hyperion Application System, issued
September 30, 2013. This was a limited distribution report due to the sensitive nature of the information reported,
and was, therefore, not made available to the public.

                                                         83
           and reconciliation process being used for the interface financial data processing
           between Hyperion and Financial Data Mart; (4) assess the impact of system
           changes before implementation and did not ensure that Hyperion’s configuration
           was aligned with security controls and settings identified as being in place; and
           (5) take steps to ensure that Hyperion was considered for disaster recovery
           testing.

Information System Control
Weaknesses Were Identified in
HUDCAPS

           The HUD Central Accounting and Program System (HUDCAPS) is the
           Department's core accounting system. It controls the budget from appropriation
           through Allotment for over $35 billion in new program funds annually for over
           100 Treasury Appropriation Accounts. At any given time, HUDCAPS manages
           over $50 billion in HUD obligations via the budget execution process.

           We found that HUDCAPS was not compliant with core financial system
           requirements for the payment management function. The core financial system
           requirements state that the agency core financial system must contain automated
           processes to perform payment management functions. However, HUDCAPS did
           not import or update vendor data in accordance with requirements and did not
           meet all accounts payable, invoicing, disbursing and payment follow up
           requirements related to how payments were processed. For instance, HUDCAPS
           did not record full or partial receipt and acceptance of goods and services by
           document line item, perform matching options that match invoices to obligations,
           receiving reports and acceptance data, validate invoice period of performance and
           invoice delivery and performance dates, and was not being used to calculate the
           payment amount including discounts, interest, and penalties. Also, we found that
           documentation for application interfaces with HUDCAPS was not consistent, and
           technical details required to operate the interfaces were not included in the
           documentation as mandated by Federal requirements and HUD’s own internal
           policies.

Internal Controls Within
DRGR Remained Ineffective

           Operational since February 1999, the Disaster Recovery Grant Reporting (DRGR)
           was developed by HUD’s Office of Community Planning and Development
           (CPD) for the Disaster Recovery Community Development Block Grant program
           and other special appropriations. Data from the system are used by HUD staff to
           review activities funded under these programs and for required quarterly reports
           to Congress. The system was developed for grantees to identify activities funded
           under their action plans and amendments, to include budgets and performance
           goals for those activities.

                                           84
                  In an audit conducted in fiscal year 2011 62, we determined that CPD management
                  did not maintain effective internal controls over financial reporting within DRGR
                  system. Our review found that DRGR did not have a sufficient data modification
                  process in place to protect financial transaction data and audit trails from being
                  overwritten. Specifically, CPD allowed DRGR grantee users to modify voucher
                  transactions (financial events or transactions) to reflect changes to program cost
                  allocation information between activities (the allocation of funds drawn for
                  specific activities). As a result, reconciliation between DRGR and HUD’s core
                  financial applications was cumbersome and time consuming. The situation was
                  further aggravated because (1) DRGR did not maintain the full voucher number
                  for payment transactions recorded in LOCCS, (2) CPD allowed revision of all or
                  part of the original distribution, (3) CPD did not require grantees to record a
                  reason or justification for making the change within DRGR, (4) CPD allowed
                  voucher modifications to be made until the grant was closed out, and (5) CPD did
                  not require grantee users to obtain approval from HUD for each modification
                  transaction. Transaction-level data detailing how grantees use funding provided
                  by HUD is not transferred to HUD’s core financial applications. The detailed
                  financial transaction data is only maintained within DRGR; therefore, DRGR was
                  the financial management systems of record for these data, since only summary
                  information was transferred and maintained in the core financial systems.

                  We followed up on the status of these weaknesses during fiscal year 2013.
                  During fiscal year 2013 system modifications were implemented to develop
                  functionality within DRGR to make modifications to program-specific data
                  elements that do not overwrite financial transaction data and to develop
                  functionality within DRGR to require grantee users to justify or explain the need
                  for modifications. CPD is still working to complete actions to implement an
                  approval process to require HUD review of data modifications in the DRGR
                  voucher process.

     Conclusion

                  HUD’s computing environment provides critical support to all facets of its
                  programs, mortgage insurance, financial management, and administrative
                  operations. During fiscal year 2013, as in prior years, we continued to identify
                  information systems control weaknesses that could negatively affect HUD’s
                  ability to accomplish its assigned mission, protect its data and IT assets, fulfill its
                  legal responsibilities, and maintain its day-to-day functions. As a result, OIG
                  continues to report a significant deficiency for HUD’s computing environment.




62
 Audit Report 2012-DP-0001, Audit Report on the Fiscal Year 2011 Review of Information Systems Controls in
Support of the Financial Statements Audit

                                                     85
Recommendations

          Recommendations were included in separate OIG audit reports. Therefore, no
          recommendations are reported here.




                                        86
              COMPLIANCE WITH LAWS AND REGULATIONS

In fiscal year 2013, we found instances in which HUD did not ensure that transactions were
executed in accordance with laws governing the use of budget authority and with other laws and
regulations that could have a direct and material effect on the financial statements and any other
laws, regulations, and governmentwide policies identified in OMB audit guidance. Specifically, we
have identified noncompliance with the following:

   •   Federal Financial Management Improvement Act
   •   Anti-Deficiency Act
   •   Section 218 (g) of the HOME Statute
   •   Federal Information Security Management Act




                                                87
Finding 13: HUD Did Not Substantially Comply with the Federal
Financial Management Improvement Act
In fiscal year 2013, we determined that HUD’s financial management systems as a whole
continued to not substantially meet Federal Financial Management Improvement Act (FFMIA)
requirements. Due to shortcomings from its current information technology systems and lack of
systems capabilities, HUD lacked assurance that its systems can support management’s need for
reliable, useful and timely information for accountability and day-to-day decision making.


     OIG’S FFMIA Compliance
     Determination

                In fiscal year 2013 OIG determined 7 63 of 39 HUD financial management systems
                did not substantially comply with FFMIA because they failed to meet one or more
                of the required elements for compliance under FFMIA Section 803. HUD on an
                entitywide basis, made limited progress as it attempted to address its financial
                management deficiencies to bring the agency’s financial management systems
                into compliance with FFMIA. While efforts are underway in fiscal year 2013 to
                address some of these issues, systems weaknesses remained a serious problem.
                HUD’s financial management systems (1) continued to not meet current
                requirements, (2) were not operated in an integrated fashion, and (3) were not
                linked electronically to efficiently and effectively provide agencywide financial
                support necessary to carry out HUD’s mission and support financial management
                needs. These matters are further described as a material weakness in the Internal
                Control section of this report.

                According to Section 803 of FFMIA, HUD’s financial management systems are
                required to substantially comply with (1) Federal financial management systems
                requirements, (2) applicable Federal accounting standards, and (3) the U.S.
                Standard General Ledger at the transaction level. OIG used OMB’s
                Implementation Guidance for the Federal Financial Improvement Act, dated
                January 9, 2009, to determine compliance.

                In its fiscal year 2013 Agency Financial Report, HUD and OIG agreed on five of
                seven non-FFMIA compliant systems as noted above, but HUD took exceptions
                on the remaining two (HUDCAPS and HIAMS). Additionally, fiscal year 2013
                was the first year HUD reported IDIS as non-FFMIA compliant system although
                OIG had been reporting IDIS as non-FFMIA compliant since fiscal year 2010.




63
  Of the seven non-FFMIA-compliant systems, five mixed systems (FIRMS, HIAMS, SPS, HPS, and IDIS) were
reported in prior years, and two new non-FFMIA-compliant systems (HUDCAPS and GFAS), both of which core
systems were identified in fiscal year 2013.

                                                   88
HUD’s FFMIA Compliance
Determination

             In its fiscal year 2013 Agency Financial Report, HUD determined that the agency
             was not in compliance with FFMIA. Additionally, HUD reported that 5 of its 39
             financial management systems did not comply with the requirements of FFMIA
             and OMB Circular A-127. Although individual systems had been certified as
             compliant with FFMIA, HUD had not completed any A-127 reviews in the last 5
             years and relied upon the results of internal control reviews for the individual
             applications.

             We have included the specific nature of noncompliance issues, responsible
             program offices, and recommended remedial actions for the five noncompliant
             systems in appendix B of this report.

Conclusion

             OIG reviewed HUD’s compliance with Section 803 of FFMIA as of September
             30, 2012. In fiscal year 2013, HUD, on an entitywide basis, made limited
             progress as it attempted to address its financial management deficiencies to bring
             the agency’s financial management systems into compliance with FFMIA. In this
             regard, OIG continued to report that HUD’s financial management systems did
             not substantially comply with FFMIA as of September 30, 2013.




                                             89
Finding 14: HUD Did Not Substantially Comply with the AntiDeficiency
Act
In fiscal year 2013, HUD made demonstrable progress in moving along several of the old 64
Antideficiency Act (ADA) 65 cases out of HUD OCFO 66 to OMB for review and approval.
However, for the fifth consecutive year, no ADA violation was reported to the President,
Congress, and the Comptroller General at the end of fiscal year 2013 as required. HUD did not
make clearing of backlogged ADA cases a priority in fiscal year 2013. Untimely disposition of
the ADA cases could delay the implementation of corrective actions, including any needed
safeguards to strengthen HUD’s funds control system to prevent recurrence of the same ADA
violation.


     Progress Made But
     Improvements Needed

                  HUD’s performance in clearing a backlog of old ADA cases needs improvement.
                  Although considerable progress had been made, none of the old cases determined
                  to contain ADA violations was reported to the President, Congress, and the
                  Comptroller General at the end of fiscal year 2013. Since fiscal year 2009, 67 we
                  have reported HUD’s slow-moving process in conducting, completing, and
                  closing the investigation of potential ADA violations identified by HUD. As of
                  October 1, 2012, a total of 16 ADA cases were outstanding; nearly 63 percent of
                  them were 3 to 10 years old. The 16 cases were in various stages of review at the
                  beginning of fiscal year 2013.

                  During the audit, we noted that HUD had made some headway in reviewing old
                  ADA cases. As a result, as of September 30, 2013, HUD had found (1) four cases
                  without ADA violations and (2) four cases 68 with ADA violations, which were
                  sent to OMB for review and approval. HUD’s final review of the remaining
                  eight 69 cases had not been completed.

64
   As of September 30, 2013, a total of 16 cases were open and under review by HUD. The time elapsed since these
cases were opened ranged from more than a year to 10 years.
65
   31 U.SC. 1341, 342, 1350, 1517, and 1519.
66
   Public Law 108-7, Division K, Title II Department of Housing and Urban Development Appropriations, 2003,
granted HUD’s Chief Financial Officer, in consultation with the HUD budget officer, the “sole authority” to
investigate potential or actual violations under ADA and all other statutes and regulations related to the obligation
and expenditure of funds made available in any act. Further, the Appropriations Act provided that the Chief
Financial Officer must determine whether violations occurred and submit the final reports required by law.
67
   See OIG’s fiscal year 2009 audit report 2010-FO-0003 for details.
68
   Of the four cases, two (2004-008 and 2008-001) were sent to OMB on January 8, 2013, and another two (2012-
002 and 2012-003) on July 16, 2012.
69
   Five of eight ADA cases had been sent to OMB for review and approval as of November 12, 2013. Therefore, a
total of nine cases (two cases in fiscal year 2012, two cases in fiscal year 2013, and five cases in fiscal year 2014)
had been sent to OMB for its review as of November 12, 2013.


                                                         90
                  The status of 12 cases (4 cases 70 with ADA violations and 8 ongoing cases) as of
                  September 30, 2013, is provided in detail below:

                                                              Table 2.
                                                                                 With ADA
                                                                                 violation –
                                                                                   Sent to
                                                                  Age in          OMB for             ADA
                     Item           Case           Case         years as of      review and          review
                    number        number          opened          9/30/13         approval          ongoing
                       1          2003-004        09/10/03           10.06                             X*
                       2          2004-007        07/07/04            9.24                             X*
                       3          2004-008        09/07/04            9.07              X
                       4          2008-001        06/05/08            5.32              X
                       5          2010-002        01/29/10            3.67                              X
                       6          2010-004        08/17/10            3.12                              X*
                       7          2010-005        08/31/10            3.08                              X*
                       8          2012-001        11/09/11            1.89                              X
                       9          2011-002        01/21/11            2.69                              X
                      10          2012-002        12/11/11            1.81              X
                      11          2012-003        04/02/12            1.50              X
                      12          2012-004        07/01/12            1.25                              X*
                                   Count                                                4                8
                    Legend: * HUD sent another five cases to OMB for review and approval on October 30, 2013, and
                    November 12, 2013.



                  The condition described above occurred because HUD did not make the clearing
                  of backlogged ADA cases a priority in fiscal year 2013 by establishing a firm date
                  for the final disposition of these cases. Although HUD’s ADA case processing
                  timeframe policy calls for completion of HUD’s investigation of ADA cases
                  within 1 year of referral or notification, HUD failed significantly to implement its
                  policy on all of the cases as noted in the table above.

     Conclusion

                  HUD did not substantially comply with ADA. Although HUD had moved along a
                  considerable number of old ADA cases from prior years for final review by OMB,
                  it had not reported any ADA violations to the President, Congress, and the

70
 We did not review these four cases in fiscal year 2013. We reviewed only seven cases that were still open when
we began our review in early August 2013.

                                                         91
          Comptroller General at the end of fiscal year 2013 as required. HUD’s ADA case
          processing timeframe policy is to complete the end-to-end internal review within
          1 year of referral or notification. However, HUD had significantly exceeded the
          processing timeframe on virtually all of its ADA cases. Going forward, HUD
          needs to make this matter a priority by ensuring the timely review and disposition
          of all future ADA cases.

Recommendations

          We recommend that the Office of Chief Financial Officer

          14A.    Make the review of ADA cases a priority by enforcing HUD’s ADA case
                  processing timeframe policy going forward and commit to a firm deadline
                  for finalizing the review of the remaining old ADA cases.




                                          92
Finding 15: HUD Did Not Comply With the HOME Investment
Partnership Act
HUD did not comply with section 218(g) of the HOME Investment Partnership Act. HUD’s
misinterpretation of the plain language in the Act, the implementation of the cumulative method
and the first in, first-Out (FIFO) technique, as well as the current recapture policies have resulted
in HUD’s noncompliance with the HOME statute requirements. Consequently, HUD has
incorrectly permitted some jurisdictions to retain and commit HOME program grant funds
beyond the statutory deadline.


 HUD Policies Did Not Comply
 With the HOME Investment
 Partnership Act


               The HOME Investment Partnership Act required HUD to establish a HOME
               Investment Trust Fund for each participating jurisdiction (grantee), with a line of
               credit that included the grantee’s annual allocation. The Act also requires each
               grantee to place all of its annual allocation’s funds under a binding commitment
               within 24 months after it receives its line of credit. Failure to do so, would result
               in the grantee’s losing its right to draw any funds that were not placed under
               binding commitment within the 24 months and require HUD to make such
               reductions and reallocate the funds as soon as possible.

               HUD implemented a process, called the cumulative method, to determine a
               grantee’s compliance with the requirements of section 218(g) of the Act and
               determine the amount to be recaptured and reallocated in accordance with section
               217(d). HUD measured compliance with the 24-month commitment requirement
               cumulatively so that all funds committed as of the grantee’s deadline were
               counted toward the grantee’s commitment requirement regardless of the
               allocation year used to make the commitments.

               HUD also implemented the FIFO method for the HOME program funds having
               the same source of funds, recipient of funds, and type of funds, in which the grant
               year was used to order the funds from the oldest year to newest year. When a
               grantee committed funds to an activity (by funding an activity using the activity
               funding function), the funds were committed from the oldest funds having the
               same source of funds, recipient of funds, and type of funds. The grantee was
               unaware of the year from which the funds were committed. Since this FIFO
               technique was applied to the commitments within the IDIS Online, commitments
               were not separated or identified by the dates on which the commitments were
               made, making it difficult to determine what commitments were made during the
               24-month period by looking only at the year in question. HUD OIG had found
               this FIFO method to be a departure from Federal GAAP, as discussed in finding


                                                 93
             1: CPD’s Formula Grant Accounting Does Not Comply With GAAP, Resulting
             in Misstatements on the Financial Statements.

             OIG determined the commitment status, based upon a noncumulative approach,
             for 287 grantees for the 2011 annual allocation commitment requirement and
             noted that 132 grantees had met the commitment requirement based upon HUD’s
             cumulative method but did not meet the requirement based upon OIG’s
             noncumulative method and 36 grantees did not meet the requirement based upon
             either method, resulting in a total net difference of $54.86 million, which could
             possibly have been recaptured and reallocated if HUD had used the
             noncumulative calculation and grantees did not provide evidence to support
             commitments that were not entered in IDIS Online.

             In 2009, OIG questioned whether HUD’s cumulative method for determining
             grantee compliance with the Act’s 24-month commitment requirement complied
             with the provisions of section 218(g). Due to its difference of opinion with HUD,
             OIG contacted GAO in 2011 and requested a legal decision and opinion. On July
             17, 2013, GAO returned its opinion, reiterating OIG’s opinion that the language
             in the Act is clear and unambiguous regarding how HUD should determine
             compliance and make recaptures for noncompliant grantees. Therefore, HUD’s
             cumulative method did not comply with the Act. Accordingly, GAO advised
             HUD to stop using the cumulative method, take steps to identify and recapture
             funds that remained uncommitted after the statutory commitment deadline, and
             reallocate such funds in accordance with the Act.

             After consideration of the GAO’s opinion, OIG noted that for overlapping
             allocation years within a 24-month period, when recapture was necessary, the
             recapture could take place from another year’s annual allocation, as long as the
             recapture was from an annual allocation within the 24-month window, following
             the allocation year in question. HUD allowed reductions to grant allocations
             outside of the 24-month annual allocation window to resolve findings of
             noncompliance.

             CPD agreed to transition from the FIFO method in IDIS Online. After the
             changes to IDIS Online are made, CPD will implement steps to identify,
             recapture, and reallocate funds that remain uncommitted after the statutory
             commitment deadline and discontinue the use of the cumulative method.

Conclusion

             The system limitations within IDIS Online, due to the application of the FIFO
             method and the exclusion of some of the pertinent relevant information to
             determine when commitments are made and should be applied, along with HUD’s
             misinterpretation of the HOME Investment Partnership Act and implementation
             of the cumulative method and its recapture policy, have


                                             94
          •   Given participating jurisdictions credit for commitments made outside the 24-
              month statutory period;
          •   Prevented HUD from complying with the plain language within the HOME
              Investment Partnership Act, which describes how compliance should be
              determined and what funds the jurisdiction loses rights to;
          •   Resulted in $54.86 million not being questioned for evidence to show that
              commitments were made in an amount equal to the allocation amount within
              24 months, however, not recorded in IDIS Online, and permitted those
              unquestioned funds to be retained by the jurisdictions and committed after the
              statutory deadline; and
          •   Allowed grantees noncompliant with the 24-month commitment requirement
              to receive reductions from grant year allocations before and after the 24-
              month overlapping period.

Recommendations

          We recommend that the Office of Community Planning and Development

          15A.    Make changes to IDIS Online, which will require grantees to specifically
                  identify the grant allocation year to which the commitment should be
                  assigned and include the commitment dates. The system should also allow
                  HUD to ensure that commitments made during overlapping allocations
                  and periods are counted toward only 1 year’s compliance requirements.

          15B.    Stop using the cumulative method and the deadline compliance report for
                  determining compliance with the 24-month commitment requirement in
                  the HOME Investment Partnership Act and use only the commitments
                  made within the 24-month period to determine compliance.

          15C.    In accordance, with the GAO legal decision and opinion, take steps to
                  identify and recapture funds that remain uncommitted after the statutory
                  commitment deadline and reallocate such funds in accordance with the
                  Act.

          15D.    Recapture funds from allocations during the 24-month overlapping period
                  only for grantees that do not comply with the 24-month commitment
                  requirement.




                                          95
Finding 16: HUD Did Not Comply With the Federal Information Security
Management Act

The fiscal year 2013 independent evaluation of the HUD IT security program found significant
deficiencies in most of the practices and component parts of the program. We found that the
program did not comply with the Federal Information Security Management Act (FISMA) and
information assets were at risk.


     Weaknesses in HUD’s
     Information Security Program

                 We performed an independent evaluation 71 of HUD’s IT security program and
                 practices as required by FISMA. The review identified the following significant
                 deficiencies. HUD did not

                 •    Establish policies and procedures in accordance with the most recent OMB
                      and National Institute of Standards and Technology guidance for IT security
                      and privacy controls.

                 •    Conduct proper oversight to identify program deficiencies.

                 •    Consistently and fully document the information system inventory, leaving no
                      assurance that HUD accounted for all of its information systems.

                 •    Have proper authorities to operate on many of the HUD systems.

                 •    Have personnel with specialized training for their roles in the IT security
                      processes, leaving the agency ill-prepared to meet its responsibilities.

                 In summary, HUD had not developed, documented, or implemented a compliant
                 enterprisewide program. FISMA requires each agency to establish a risk-based
                 information security program that ensures that information security is practiced
                 throughout the life cycle of each agency system. Federal agencies and inspectors
                 general are required to report annually to OMB on the adequacy and effectiveness
                 of agency information security policies, procedures, practices and compliance




71
  HUD OIG’s Information Technology Division, an office within OIG separate from the Office of Audit, performed
the fiscal year 2013 FISMA evaluation and prepared the OIG FISMA responses to OMB. As the FISMA evaluation
was an assignment that was not required to follow auditing standards, the Office of Audit performed a review of the
Division’s evaluation work according to GAO audit guidance, Financial Audit Manual 650.


                                                        96
                 with FISMA. Specific details of the fiscal year 2013 FISMA evaluation were
                 published in a separate report. 72

 Conclusion

                 OIG determined that HUD had not complied with FISMA and Federal IT security
                 requirements as of September 30, 2013. Improving the overall management and
                 security of IT resources needs to be a top priority for HUD. HUD is at a critical
                 crossroad, as the HUD IT services contract expires in July 2014. HUD’s
                 information systems are paramount to its mission. Executive leadership must
                 establish a strategic approach and take corrective actions to ensure that future
                 technology investments consider security requirements. There is an abundance of
                 sensitive information in HUD information systems, and the protections in place
                 were not commensurate with the risk and magnitude of harm that may result from
                 unauthorized access, use, disclosure, disruption, modification, or destruction of
                 information and information systems.

 Recommendations

                 Because of recommendations made in our FISMA evaluation report, we are making
                 no further recommendations in this report.




72
     Evaluation Report Number 2013-ITED-0001, 2013 FISMA Evaluation, issued November 25, 2013

                                                    97
                              SCOPE AND METHODOLOGY

We considered internal controls over financial reporting by obtaining an understanding of the
design of HUD’s internal controls, determined whether these internal controls had been placed
into operation, assessed control risk, and performed tests of controls to determine our auditing
procedures for the purpose of expressing our opinion on the principal financial statements. We
also tested compliance with selected provisions of applicable laws, regulations, and government
policies that may materially affect the consolidated principal financial statements.

We considered HUD’s internal controls over required supplementary stewardship information
reported in HUD’s Fiscal Year 2013 Agency Financial Report by obtaining an understanding of
the design of HUD’s internal controls, determined whether these internal controls had been
placed into operation, assessed control risk, and performed limited testing procedures as required
by the American Institute of Certified Public Accountings, U.S. Auditing Standards AU-C
Section 730, Required Supplementary Information. The tests performed were not to provide
assurance on these internal controls, and, accordingly, we do not provide assurance or an opinion
on such controls.

With respect to internal controls related to performance measures to be reported in
Management’s Discussion and Analysis and HUD’s Fiscal Year 2013 Agency Financial Report,
we obtained an understanding of the design of significant internal controls relating to the
existence and completeness assertions as described in section 230.5 of OMB Circular A-11,
Preparation, Submission, and Execution of the Budget. We performed limited testing procedures
as required by AU-C Section 730, Required Supplementary Information, and OMB Bulletin 14-
02, Audit Requirements for Federal Financial Statements. Our procedures were not designed to
provide assurance on internal controls over reported performance measures, and, accordingly, we
do not provide an opinion on such controls.

To fulfill these responsibilities, we

•      Examined, on a test basis, evidence supporting the amounts and disclosures in the
       consolidated principal financial statements;
•      Assessed the accounting principles used and the significant estimates made by
       management;
•      Evaluated the overall presentation of the consolidated principal financial statements;
•      Obtained an understanding of internal controls over financial reporting (including
       safeguarding assets) and compliance with laws and regulations (including the execution
       of transactions in accordance with budget authority);
•      Tested and evaluated the design and operating effectiveness of relevant internal controls
       over significant cycles, classes of transactions, and account balances;
•      Tested HUD’s compliance with certain provisions of laws and regulations;
       governmentwide policies, noncompliance with which could have a direct and material
       effect on the determination of financial statement amounts; and certain other laws and
       regulations specified in OMB Bulletin 14-02, including the requirements referred to in
       FMFIA;

                                               98
•      Considered compliance with the process required by FMFIA for evaluating and reporting
       on internal controls and accounting systems; and
•      Performed other procedures we considered necessary in the circumstances.

We did not evaluate the internal controls relevant to operating objectives as broadly defined by
FMFIA. We limited our internal controls testing to those controls that are material in relation to
HUD’s financial statements. Because of inherent limitations in any internal control structure,
misstatements may occur and not be detected. We also caution that projection of any evaluation
of the structure to future periods is subject to the risk that controls may become inadequate
because of changes in conditions or that the effectiveness of the design and operation of policies
and procedures may deteriorate.

Our consideration of the internal controls over financial reporting would not necessarily disclose
all matters in the internal controls over financial reporting that might be significant deficiencies.
We noted certain matters in the internal control structure and its operation that we consider
significant deficiencies under OMB Bulletin 14-02.

Under standards issued by the American Institute of Certified Public Accountants, a significant
deficiency is a deficiency or a combination of deficiencies in internal control that is less severe
than a material weakness yet important enough to merit attention by those charged with
governance.

A material weakness is a deficiency or combination of deficiencies in internal controls, such that
there is a reasonable possibility that a material misstatement of the financial statements will not
be prevented or detected and corrected on a timely basis.

Our work was performed in accordance with generally accepted government auditing standards
and OMB Bulletin 14-02 as amended. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objective(s). We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objective.




                                                 99
                          FOLLOW-UP ON PRIOR AUDITS
Not included in the recommendations listed after each finding are recommendations from prior
years’ reports on HUD’s financial statements that have not been fully implemented based on the
status reported in the Audit Resolution and Corrective Action Tracking System (ARCATS).
HUD should continue to track these recommendations under the prior years’ report numbers in
accordance with departmental procedures. Each of these open recommendations and its status is
shown below. Where appropriate, we have updated the prior recommendations to reflect
changes in emphasis resulting from recent work or management decisions.

 Additional Details To
 Supplement Our Report on
 HUD’s Fiscal Years 2012 and
 2011 Financial Statements,
 2013-FO-0003


              With respect to the material weakness in achieving substantial compliance with
              FFMIA that continued to challenge HUD, we recommended that OCFO

              1.a. Ensure that Section 108 Loan Guarantee program financial management
                   system requirements are incorporated into HUD’s core financial system
                   improvement program to get more transparent and complete information for
                   financial and management reports. (Final action target date is December 31,
                   2014; reported in ARCATS as 1C.)

              With respect to the significant deficiency that there were weaknesses in the
              monitoring of PIH and the Office of Multifamily Housing’s program funds, we
              recommended that the Assistant Secretary of Public and Indian Housing

              2.a   Request that Congress include in the appropriations bill an offset of renewal
                    funding for the Housing Choice Voucher program of $628 million or the
                    amount of reserves in excess of 6 percent of the PHAs’ annual budgetary
                    authority as of December 31, 2012. (Final action target date is April 30,
                    2014; reported in ARCATS as 2A.)

              2.b   Develop, implement, and document methodologies to calculate and track
                    performance measures to enable comparability of data among MTW PHAs
                    and ensure the reliability of reported data. (Final action target date is April
                    30, 2014; reported in ARCATS as 2C.)

              2.c   Develop, implement, and document standardized reporting requirements for
                    the MTW data and results for all MTW PHAs. (Final action target date is
                    December 31, 2013; reported in ARCATS as 2D.)



                                               100
2.d Update the MTW plan and report review procedures to include steps to verify
     the reliability of presented data against HUD systems and retain all
     supporting documentation as evidence of controls performed. (Final action
     target date is December 31, 2013; reported in ARCATS as 2E.)

2.e   Ensure that the staffing and funding levels for the MTW program office are
      adequate to provide proper oversight of the program. (Final action target
      date is December 31, 2014; reported in ARCATS as 2F.)

With respect to the significant deficiency that HUD’s internal control over
financial reporting had serious weaknesses, we recommended that OCFO

3.a   Revise HUD’s Debt Collection Handbook 1900.25, REV-4, to include
      comprehensive procedures to ensure that amounts to be repaid from
      program monitoring findings, repayment agreements, and other binding
      documents are communicated to the accounting center for timely accrual of
      receivables. (Final action target date is November 29, 2013; reported in
      ARCATS as 3B.)

3.b   Develop and implement formal financial management policies and
      procedures to require an annual evaluation by OCFO and applicable
      program offices of all allowance for loss rates and other significant
      estimates currently in use to ensure appropriateness. (Final action target
      date is November 29, 2013; reported in ARCATS as 3C.)

With respect to the significant deficiency that CPD’s information and
communication systems had weaknesses, we recommended that CPD

4.a   Develop internal controls to review field office compliance more frequent
      than every 4 years, especially when findings have been identified in the past,
      and to ensure that action plans operate effectively and have addressed the
      deficiencies noted so that noncompliance is not repeated during the next
      quality management review. (Final action target date is January 31, 2014;
      reported in ARCATS as 4B.)

With respect to the significant deficiency that HUD’s oversight of the
administrative control of funds process had weaknesses, we recommended that
OCFO

5.a   In coordination with the Office of the Deputy Secretary, emphasize the
      importance of financial management for the administrative control of funds.
      (Final action target date is March 15, 2014; reported in ARCATS as 5A.)

5.b   Work with program offices to follow HUD’s Policies Handbook 1830.2
      procedures to ensure that funds control plans are complete, accurate, and



                                101
                        updated in a timely manner throughout the appropriation life cycle. (Final
                        action target date is March 15, 2014; reported in ARCATS as 5B.)

                  5.c   Perform compliance reviews of all approved funds control plans on a 5-year
                        cycle. (Final action target date is November 29, 2013; reported in ARCATS
                        as 5C.)

                  With respect to the significant deficiency that deficiencies existed in the
                  monitoring of HUD’s unliquidated obligations, we recommended that CPD

                  6.a   Review the status of these expired contracts, which make up the $50.6
                        million, and recapture excess funds for the contracts that have not been
                        granted extensions. (Final action target date is October 18, 2013; reported
                        in ARCATS as 6A.) 73

                  6.b   Review the 270 obligations with remaining balances totaling $432,147 and
                        close out and deobligate amounts tied to obligations that are no longer valid
                        or needed. (Final action target date is October 18, 2013; reported in
                        ARCATS as 6B.)73

                  With respect to the significant deficiency that deficiencies existed in the
                  monitoring of HUD’s unliquidated obligations, we recommended that OCHCO

                  6.c   Review the 714 obligations with remaining balances totaling $8,428,808 and
                        close out and deobligate amounts tied to obligations that are no longer valid
                        or needed. Additionally, the $448,022 in five obligations marked for
                        deobligation should be deobligated. (Final action target date is December
                        31, 2013; reported in ARCATS as 6E.)

                  With respect to the significant deficiency that deficiencies existed in the
                  monitoring of HUD’s unliquidated obligations, we recommended that OCIO

                  6.d   Review the 357 obligations with remaining balances totaling $6,832,833 and
                        close out and deobligate amounts tied to obligations that are no longer valid
                        or needed. Additionally, the $618,560 in 45 obligations marked for
                        deobligation should be deobligated. (Final action target date is December
                        12, 2013; reported in ARCATS as 6F.)


                  With respect to the significant deficiency that deficiencies existed in the
                  monitoring of HUD’s unliquidated obligations, we recommended that the Office
                  of Fair Housing and Equal Opportunity


73
  As of the date of this report, this unimplemented recommendation had a corrective action plan that was overdue
for completion. OIG has performed audit follow-up activities to determine the status of the corrective action plan
and is working with HUD to ensure that it is completed and the recommendation is addressed.

                                                        102
6.e   Review the 70 obligations with remaining balances totaling $117,227 and
      close out and deobligate amounts tied to obligations that are no longer valid
      or needed. Additionally, $95,857 in three program obligations marked for
      deobligation should be deobligated. (Final action target date is October 7,
      2013; reported in ARCATS as 6K.)73

With respect to the significant deficiency that deficiencies existed in the
monitoring of HUD’s unliquidated obligations, we recommended that the Office
of Housing

6.f   Review the 588 obligations with remaining balances totaling $1,912,078 and
      close out and deobligate amounts tied to obligations that are no longer valid
      or needed. Additionally, $10,565,965 in 209 administrative obligations and
      $145,006 in eight program obligations marked for deobligation should be
      deobligated. (Final action target date is July 31, 2013; reported in ARCATS
      as 6L.)75

6.g   Review the 69 inactive or expired obligations with $1,202,207 in remaining
      balances and coordinate with OCFO to deobligate any funds that are
      determined to be expired or inactive after review. (Final action target date is
      September 30, 2013; reported in ARCATS as 6O.)73

6.h   Deobligate the $2 million in remaining loan obligations for ineligible
      borrowers under the Emergency Homeowners’ Loan Program. (Final action
      target date is September 30, 2013; reported in ARCATS as 6P.)73

With respect to the significant deficiency that deficiencies existed in the
monitoring of HUD’s unliquidated obligations, we recommended that the Office
of Departmental Equal Employment Opportunity

6.i   Deobligate $54,982 in three administrative obligations marked for
      deobligation during the departmentwide open obligations review. (Final
      action target date is December 30, 2013; reported in ARCATS as 6Q.)73

With respect to HUD’s substantial noncompliance with the Antideficiency Act,
we recommend that the OCFO

7.a. Establish policies and procedures for ensuring that investigators and all
     individuals involved in the review or concurrence process do not have any
     personal or external impairment that would affect their independence and
     objectivity in conducting ADA reviews and investigations. (Final action
     target date is March 15, 2014; reported in ARCATS as 9A.)

7.b. For current and future investigations, determine the qualifications and
     independence of personnel used at each stage of the investigation. (Final
     action target date is March 15, 2014; reported in ARCATS as 9B.)

                                 103
           7.c.    Issue a legislative request for funding for additional staffing or to have
                  ADA investigations conducted by an independent external organization.
                  (Final action target date is November 29, 2013; reported in ARCATS as
                  9C.)

Additional Details To
Supplement Our Report on
HUD’s Fiscal Years 2011 and
2010 Financial Statements,
2012-FO-0003

           With respect to the significant deficiency that HUD needs to improve the process
           for reviewing obligation balances, we recommended that CPD

           8.a    Review the status of each of its homeless assistance contracts that make up
                  the $32 million OIG identified as excess funding and recapture excess funds
                  for expired contracts that have not been granted extension. (Final action
                  target date was February 6, 2013; reported in ARCATS as recommendation
                  2B.)73

           8.b    Fully implement the internal control procedures and control activities that
                  were drafted as a result of the fiscal year 2010 audit finding, which include
                  specific policies, procedures, and mechanisms, including appropriate
                  documentation of extensions granted and follow-up efforts with the grantees
                  to obtain the closeout documents, to ensure that grants are closed out within
                  the 90-day period after the contract expiration or after the extension period
                  so that remaining balances are periodically recaptured. (Final action target
                  date was February 6, 2013; reported in ARCATS as recommendation 2C.)73

           With respect to the significant deficiency that HUD needs to improve its
           administrative control of funds, we recommended that OCFO

           9.a    Establish and implement procedures to ensure that all program codes that
                  disburse HUD’s funds have complete and approved funds control plans
                  before the funds can be disbursed. (Final action target date was April 27,
                  2013; reported in ARCATS as recommendation 4A.)73

           9.b    Establish and implement procedures to ensure that the funds control plans
                  are updated to include the new program codes and new appropriation
                  requirements. (Final action target date was April 27, 2013; reported in
                  ARCATS as recommendation 4B.)73




                                             104
           9.c    Develop and implement a 3-year cycle of funds control compliance reviews
                  for all approved funds control plans by completing the assessments of one-
                  third of approved funds control plans each fiscal year. (Final action target
                  date was March 29, 2013; reported in ARCATS as recommendation 4C.)73

           With respect to the significant deficiency that HUD needs to continue improving
           its oversight and monitoring of subsidy calculations, intermediaries’ performance,
           and use of Housing Choice Voucher and operating subsidy program funds, we
           recommended that PIH’s

           10.a. Office of Housing report on income discrepancies at the 100 percent
                 threshold level as a supplemental measure; assign staff to review the
                 deceased single-member household and income discrepancy reports at least
                 quarterly and follow up with owners and management agents (O-A) listed
                 on these reports; and include in the contract between HUD and O-As a
                 provision for improper payments that requires to resolve in a timely manner
                 income discrepancies, failed identity verifications, and cases of deceased
                 single-member households. (Final action target date is April 1, 2014;
                 reported in ARCATS as recommendation 5B.)


Additional Details To
Supplement Our Report on
HUD’s Fiscal Years 2010 and
2009 Financial Statements,
2011-FO-0003

           With respect to the significant deficiency that HUD’s financial management
           systems need to comply with Federal financial management system requirements,
           we recommended that CPD

           11.a    Cease the changes being made to IDIS Online for the HOME program
                   related to the FIFO rules until the cumulative effect of using FIFO can be
                   quantified on the financial statements. (Final action target date is June 15,
                   2015; reported in ARCATS as recommendation 1A.)

           11.b    Change IDIS Online so that the budget fiscal year source is identified and
                   attached to each activity from the point of obligation to
                   disbursement. (Final action target date is June 15, 2015; reported in
                   ARCATS as recommendation 1B.)

           11.c    Cease the use of FIFO to allocate funds (fund activities) within IDIS
                   Online and disburse grant payments. Match outlays for activity
                   disbursements to the obligation and budget fiscal source year in which the
                   obligation was incurred and in addition, match the allocation of funds
                   (activity funding) to the budget fiscal year source of the obligation. (Final

                                            105
       action target date is June 15, 2015; reported in ARCATS as
       recommendation 1C.)

11.d   Include as part of the annual CAPER [consolidated annual performance
       and evaluation report] a reconciliation of HUD’s grant management
       system, IDIS Online, to grantee financial accounting records on an
       individual annual grant basis, not cumulatively, for each annual grant
       awarded to the grantee. (Final action target date is June 15, 2015; reported
       in ARCATS as recommendation 1D.)

With respect to the significant deficiency that HUD needs to improve the process
for reviewing obligation balances, we recommended that OCFO, in coordination
with the appropriate program offices,

12.a   Review the 510 obligations that were not distributed to the program
       offices during the open obligations review and deobligate amounts tied to
       closed or inactive projects, including the $27.5 million we identified
       during our review as expired or inactive. (Final action target date was
       October 31, 2011; reported in ARCATS as recommendation 2C.)73

With respect to the significant deficiency that HUD needs to improve the process
for reviewing obligation balances, we recommended that the OCFO, in
coordination with PIH,

12.b   Recapture the full amount of obligations from these 434 PIH low-rent
       grants totaling $174 million and return to the U.S. Treasury the total
       balance of budgetary resources from invalid grants. (Final action target
       date was June 30, 2012; reported in ARCATS as recommendation 2N.)73

With respect to the significant deficiency that CPD needs to improve its oversight
of grantees, we recommended that CPD

13.a. Review the status of each of its homeless assistance contracts that make up
      the $97.8 million OIG identified as excess funding and recapture excess
      funds for expired contracts that have not been granted extensions. (Final
      action target date was March 16, 2012; reported in ARCATS as
      recommendation 4A.) 73

With respect to the significant deficiency that HUD needs to improve its
administrative control of funds, we recommended that OCFO

14.a Establish and implement procedures to ensure accuracy and completeness of
     ARRA funds control plans. (Final action target date was December 30,
     2011; reported in ARCATS as recommendation 5B.)73




                                106
           14.b Conduct periodic reviews of the program offices’ compliance with
                requirements of the funds control plans. (Final action target date was
                December 30, 2011; reported in ARCATS as recommendation 5D.)73

           With respect to the significant deficiency that HUD needs to improve its
           administrative control of funds, we recommended that OCFO, in coordination
           with the appropriate program offices,

           15.a Develop and implement funds control plans for any program found to be
                without an up-to-date funds control plan. (Final action target date was
                December 30, 2011; reported in ARCATS as recommendation 5J.)73

           With respect to HUD’s substantial noncompliance with ADA, we recommended
           that OCFO, in coordination with the appropriate program offices,

           16.a Complete required steps on the six known potential ADA issues and report
                those determined to be violations immediately to the President, Congress,
                and GAO as required by 31 U.S.C. (United States Code) and OMB Circular
                A-11. (Final action target date was December 30, 2011; reported in
                ARCATS as recommendation 6A.)73

           16.b Investigate the potential ADA violation and other interagency agreements
                that were similarly executed. If the investigation determines that an ADA
                violation occurred, immediately report it to the President, Congress, and
                GAO as required by 31 U.S.C. and OMB Circular A-11. (Final action target
                date was December 30, 2011; reported in ARCATS as recommendation
                6B.)73

Additional Details To
Supplement Our Report on
HUD’s Fiscal Years 2009 and
2008 Financial Statements,
2010-FO-0003

           With respect to HUD’s substantial noncompliance with ADA, we recommended
           that OCFO, in coordination with the appropriate program offices,

           17.a Complete the investigations and determine whether ADA violations have
                occurred and if an ADA violation has occurred, immediately report to the
                President, Congress, and GAO. (Final action target date was March 11,
                2011; reported in ARCATS as recommendation 5A.)73




                                          107
17.b Report the six ADA violations immediately to the President, Congress, and
     GAO, as required by 31 U.S.C. and OMB Circular A-11, upon receiving
     OCFO legal staff concurrence with the investigation results. (Final action
     target date was March 16, 2011; reported in ARCATS as recommendation
     5B.)73




                               108
                                      APPENDIXES

Appendix A

      SCHEDULE OF FUNDS TO BE PUT TO BETTER USE

                          Recommendation        Funds to be put
                              number            to better use 1/
                                2A                 $643,600,000
                                8A                   50,900,000
                                8B                   14,742,564
                                8D                   21,255,197
                                8E                     9,300,000
                                8F                   26,000,000
                                8G                     1,337,015
                                8H                   11,000,000
                                 8J                  12,710,563
                                8K                     3,117,373
                                8N                     7,300,000
                                8O                     7,263,662
                                8P                        85,544
                                8Q                        71,274
                                8R                        88,604
                                8S                        10,684
                                8T                     3,488,009
                                8U                       145,060
                                8V                        26,829
                                8W                        11,420
                                8X                       166,083
                                8Y                       132,080
                                8Z                         7,391
                               11C                   24,300,000
                               11D                   47,900,000
                               11G                   17,900,000
                               Total               $902,859,352

1/   Recommendations that funds be put to better use are estimates of amounts that could be
     used more efficiently if an Office of Inspector General (OIG) recommendation is
     implemented. These amounts include reductions in outlays, deobligation of funds,
     withdrawal of interest, costs not incurred by implementing recommended improvements,
     avoidance of unnecessary expenditures noted in preaward reviews, and any other savings
     that are specifically identified.

                                          109
Appendix B

FEDERAL FINANCIAL MANAGEMENT IMPROVEMENT ACT
NONCOMPLIANCE, RESPONSIBLE PROGRAM OFFICES, AND
RECOMMENDED REMEDIAL ACTIONS

This appendix provides details required under FFMIA reporting requirements. To meet those
requirements, we performed tests of compliance using the implementation guidance for FFMIA
issued by OMB and GAO’s Financial Audit Manual. The results of our tests disclosed that
HUD’s systems did not substantially comply with requirements. OIG determined 7 74 of 39 HUD
financial management systems did not substantially comply with FFMIA because they failed to
meet one or more of the required elements for compliance under FFMIA Section 803. However,
HUD’s annual assurance statement reported five nonconforming systems because HUD took
exceptions to two non-FFMIA compliant systems, HUD Central Accounting and Program
System and HUD Integrated Acquisition Management System (HIAMS). The details about non-
FFMIA compliant systems, responsible parties, primary causes, and HUD’s intended remedial
actions are included in the following sections.

Federal Financial Management Systems Requirements

The organizations responsible for systems that were found not to comply with the requirements
of OMB Circular A-127 based on HUD’s assessments are as follows:

       Responsible office                                    Number of           Nonconforming
                                                          compliant systems         systems
       Office of Housing                                         16                    0
       Office of the Chief Financial Officer                     13                    1
       Office of Chief Human Capital Officer                      1                    1
       Office of the Chief Procurement Officer                    1                    3
       Office of Community Planning and Development               2                    1
       Office of Public and Indian Housing                        1                    0
       Government National Mortgage Association                   0                    1
       Totals                                                    34                    5

We have summarized HUD’s plan to correct noncompliance with OMB Circular A-127 as
submitted to us as of September 30, 2013.




74
  The seven non-FFMIA-compliant systems include are (1) A35-HUD Procurement System (HPS), (2) P035-Small
Purchase System (SPS), (3) D67A-Facilities Integrated Resources Management System (FIRMS), (4) C04 –
Integrated Disbursement and Information System Online (IDIS Online), (5) P237 – Ginnie Mae Financial
Accounting and Program System (GFAS), (6) A75 – HUD Central Accounting and Program System (HUDCAPS),
and (7) P273 – HUD Integrated Acquisition Management System (HIAMS).

                                                  110
Integrated Disbursement & Information System Online (IDIS Online) - Since fiscal year
2010, OIG reported that C04 –IDIS Online was noncompliant with the requirements of FFMIA,
as a result of its use of the First-In, First-Out (FIFO) method to account for and disburse formula
grant obligations. However, fiscal year 2013 is the first year that HUD’s annual assurance
statement, issued pursuant to Section 4 of the Financial Manager’s Integrity Act, reported IDIS
Online as noncompliant. HUD will therefore modify IDIS Online to eliminate the FIFO
accounting method. The Office of Community Planning and Development is responsible for
IDIS Online. CPD has begun efforts to eliminate FIFO within IDIS by drafting a FIFO
Elimination Plan dated September 20, 2013 and will provide a remediation plan to resolve the
FFMIA noncompliance issues.

Facilities Integrated Resources Management System (FIRMS) – In fiscal year 2009, OIG
identified weaknesses related to HUD’s control over acquisition of accountable equipment and
property management system and made four audit recommendations. The Office of Chief
Human Capital Officer (OCHCO) is responsible for FIRMS. One of the four audit
recommendations remains unimplemented as of September 30, 2013; recommendation 2A,
which deals with system interfaces with the core financial system and the acquisition system.
According to OCHCO, remediating FIRMS is progressing, by way of a short term maintenance
contract to correct and upgrade the FIRMS system. OCHCO anticipates being able to furnish a
complete accurate depreciation report once a nationwide inventory is completed and reconciled
by February 14, 2014.

HUD Procurement System (HPS) and Small Purchase System (SPS) - For several years,
HUD reported the HUD Procurement System (HPS) and Small Purchase System (SPS) as
substantially noncompliant systems. The Office of the Chief Procurement Officer (OCPO) is
responsible for HPS and SPS. In fiscal year 2012, OCPO began implementing a new
procurement system, the HUD Integrated Acquisition Management System (HIAMS), to replace
HPS and SPS. However, as of August 27, 2013; OCPO was still closing actions out in HPS and
SPS and de-activating users that are not needed for close out. Upon the completion of migrating
and validating data into HIAMs Enterprise Acquisition Reporting Tool Data warehouse,
HPS/SPS will begin decommissioning, with anticipated completion by end of fiscal year 2014.

Ginnie Mae Financial & Accounting System (GFAS) – In fiscal year 2013, the OIG
determined that GFAS was not substantially compliant with FFMIA due to the fact that GFAS
(as a core system) was not currently configured to support Ginnie Mae’s accounting and
reporting requirements for its budgetary resources. Government National Mortgage Association
is responsible for GFAS. To substantially comply with FFMIA, the financial management
system must comply with the US Standard General Ledger (USSGL) at the transaction level.
This means that each occurrence of a financial event affecting the budgetary resources should be
recorded in the system at the transaction level according to USSGL guidance. Ginnie Mae uses a
manual process to generate the Statement of Budgetary Resources (SBR). GNMA prepared a
remediation plan to bring GFAS into substantial compliance with FFMIA by June 30, 2014.




                                                111
Appendix C

         AUDITEE COMMENTS AND OIG’S EVALUATION


Ref to OIG Evaluation    Auditee Comments




Comment 1




Comment 2




                          112
Ref to OIG Evaluation   Auditee Comments




Comment 3




Comment 4




Comment 5




Comment 6



Comment 7




                         113
Ref to OIG Evaluation   Auditee Comments




                         114
                         OIG Evaluation of Auditee Comments

Comment 1   While HUD management did not provide formal and additional detailed
            comments to all reported control deficiencies and compliance with laws and
            regulations, they indicated agreement with most of OIG’s conclusions.
            Accordingly, OIG looks forward to reviewing HUD’s progress in establishing an
            effective financial management governance structure, timely and accurate
            recording of accounts receivables and accruals of expenses incurred for grants and
            administrative costs, improvement in HUD’s administrative control of funds over
            all obligations and disbursements, reductions in unliquidated obligations,
            improvement over monitoring of HUD’s RHAP and EHLP programs, as well as
            eliminating information security and business application control deficiencies.
            Additionally, we will again review HUD’s progress on improving its compliance
            with FFMIA, Antideficiency Act, HOME Investment Act, as well as FISMA.

Comment 2   Our office will review, evaluate, and report on CPD’s progress on implementing
            corrections to CPD’s system to provide for GAAP, budgetary, and statutory
            compliant transaction processing. OIG would like to emphasize that due to the
            cumulative method for determining program compliance and FIFO for
            disbursement of obligations, all of the current funded activities were subjected to
            processing which more likely than not did used the incorrect source of funds. As
            a result, HUD’s Statement of Budgetary Resources will be materially misstated
            until the current portfolio of activities no longer makes up a material amount of
            undisbursed obligations, unless HUD develops a methodology to reasonably
            estimate appropriate adjustments needed to correct the errors and completes a
            restatement related to this issue.

Comment 3   OIG appreciates HUD’s commitment to properly account for PIH’s Housing
            Choice Voucher Program (HCVP) Cash Management Process in accordance with
            Federal GAAP. If PIH is able to design and implement appropriate internal
            controls over financial reporting and appropriate Federal GAAP accounting; our
            concerns over the lack of detailed transaction level data, reliability of estimates,
            and improper classification/presentation and valuation of assets should be
            resolved in fiscal year 2014.

            In regards to our inability to apply necessary audit procedures over the accounting
            adjustments performed, HUD provided two methodologies for estimating NRA
            and VMS expenses. At the beginning of November, HUD provided the
            methodology for the NRA report. This is an old methodology we have reviewed
            in the past, where HUD estimates the amount of unused Section 8 NRA funds
            held by the PHAs. This methodology does not include the accounting policies for
            financial reporting. On November 19th, HUD provided an updated methodology
            which included considerations for the cash management, monitoring reviews, and
            accounting procedures. Compliance with our audit standards required OIG to
            evaluate and perform audit testing on the methodology’s assumptions. In the case
            of the mid November submission we needed to audit the estimate to validate that

                                            115
the $902 million and $534 in additional Advances and Program Cost recognized
for fiscal years 2012 and 2013, were accurate and complete and that these
expenses actually were paid by the PHAs from their NRA accounts. OIG cannot
validate that PHAs actually paid $1.5 billion in additional program expenses from
their NRA accounts by just comparing the change in the NRA balance estimated
in NRA reports at different points in time. OIG notified HUD about this issue in
August; however, it was late October when HUD discussed what type of
adjustments would be made and late November when OCFO recorded
adjustments to recognize this activity on the financial statements. Providing the
methodology at the beginning of November did not allow sufficient time to
complete the necessary audit procedures we deemed necessary to determine if the
estimates recorded were reasonable. Further, OCFO continued to make additional
adjustments to recognize the activity after the first set of adjustments were made
which required validation. This involves not only reading the journal entries and
methodologies, but it would also involve planning necessary audit steps, and
requesting, gathering, and evaluating the additional evidence.

In addition, OIG reviewed the OMB Circular A-133 Single Audit Act compliance
supplement for the Section 8 Program. We concluded that PIH reliance of IPA
audits is not substantiated by the suggested audit steps in the circular. The audit
steps did not specifically require IPAs to audit VMS submissions to ensure that
expenditures are reconciled with the check registers and PIC tenant data.

We agree that PIH performed a confirmation of PHAs NRA after OIG
recommended to improve the monitoring of PHAs VMS reporting. However, this
effort began in 2009 and ended in 2011. This effort should have been performed
annually. According to a REAC memorandum to the PIH, there are concerns that
many PHAs did not have the cash on hand or available to support the NRA
balance estimated by PIH. We concluded that this could be part of the reasons for
postponing the NRA Transition to HUD.

Since the implementation of the Section 8 Fixed-Budget methodology in 2005,
OIG has been providing recommendations to improve the utilization of funds
monitoring and enhance the safeguarding of the Program resources. OIG has
recommended more frequent reconciliation of PHAs accounts and perform
additional reviews of PHAs NRA accounts. We acknowledge HUD’s progress
for improving the monitoring activities in this area. However, the implementation
of Treasury rules for cash management required HUD to account and report for
PHAs NRA funds in HUD’s financial statements. This change elevates HUD’s
requirements for providing assurances of internal controls in financial reporting
from Program’s monitoring controls to compliance with the CFO Act, Federal
GAAP and OMB Circular A-123 compliance with financial reporting
requirements. Consequently, HUD’s monitoring based data is now subject to
auditing standards, which is different than in prior years. As a result, this year
OIG readjusted the audit and considered the current applicable laws and
regulations HUD needs to comply with.

                                116
Comment 4   During our review, we noted that QAD efforts were undermined by reduction in
            staff and travel resources. QAD indicates that they managed their limited staffing
            and resources by targeting the PHAs with the highest risk. We continue to
            question why PIH could not allocate $500 thousand to complete the travel funds
            requested to perform onsite reviews to improve the quality of data on which they
            are relying to operate a $16 billion program.

Comment 5   We acknowledge that HUD is developing new systems. However, this should not
            prevent PIH and OCFO to work together in finding a cost effective (temporary)
            solutions to properly account and report for the PHAs NRA balances. The
            implementation of the new systems does not address the need for additional
            resources required for maintaining adequate monitoring controls over the VMS
            data.

Comment 6   OIG will continue to monitor HUD’s progress in replacing its noncompliant core
            financial management system. With the decision to place the application at a
            shared service center starting in fiscal year 2015, OIG will monitor the planned
            changes in business processes and any impact on fiscal year 2014 accounting
            operations and financial reporting.

Comment 7   We plan to evaluate HUD’s implementation of the GFAS system’s budgetary
            accounting module in the fiscal year 2014 audit.

Comment 8   While we agree that HIAMS performs the reservation and obligation core
            functions, in general, we disagree with the comments from OCFO. HIAMS is the
            only application currently in use within HUD with the capability to record the
            acceptance and delivery data necessary to perform the core functional
            requirements related to the payment management function. The acquisition
            software in use by the department has the capability to record acceptance and
            delivery data but that functionality is not being used. HUDCAPS, the
            Department’s current core application, is capable of performing the core
            functions, but would require changes to its configuration, interfaces, business
            processes, and how users utilize the application. In addition, a coordinated effort
            between HUDCAPS and HIAMS is required in order for HUDCAPS to be able to
            perform the core functions as mandated. The OCPO comments point to the
            functionality in HIAMS as being a duplication of the functionality in the new core
            financial application. However, the Department does not yet have a new core
            financial application. The acquisition software that makes up HIAMS was
            designed to interface with the core financial system to allow utilization of this
            data by both applications. At this time, HUD is not collecting the data and it is
            therefore unable to be utilized by either application.

            While we agree that HIAMS does not perform the payment management
            functions cited, we do not agree that HIAMS is not required to perform the
            functions. Our audit found that HIAMS does not electronically send the

                                            117
necessary financial data to HUDCAPS to enable the OCFO to perform the
payment functions required by a core financial system because HIAMS does not
collect the data. HIAMS also does not interface with HUDCAPS for payment
related information, and therefore cannot leverage the information in the core
financial system related to invoices and payments by pulling the information
processed in HUDCAPS back into HIAMS. Instead, HIAMS obtains invoice and
payment information from the Financial DataMart.




                              118