OFFICE OF AUDIT FINANCIAL AUDITS DIVISION HEADQUARTERS OFFICE OF THE CHIEF FINANCIAL OFFICER WASHINGTON, DC ADDITIONAL DETAILS TO SUPPLEMENT OUR REPORT ON HUD’S FISCAL YEARS 2013 AND 2012 (RESTATED)FINANCIAL STATEMENTS 2014-FO-0003 DECEMBER 16, 2013 December 16, 2013 Audit Report Number: 2014-FO-0003 TO: David P. Sidari, Acting Chief Financial Officer, F \signed\ FROM: Thomas R. McEnanly, Director, Financial Audits Division, GAF SUBJECT: Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and 2012 (Restated) Financial Statements Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of HUD’s fiscal years 2013 and 2012 (restated) financial statements. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8N, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. December 16, 2013 Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and 2012 Financial Statements Highlights Audit Report 2014-FO-0003 What We Audited and Why What We Found We are required to annually audit the In our opinion, HUD’s fiscal years 2013 and 2012 consolidated financial statements of the (restated) financial statements were fairly presented U.S. Department of Housing and Urban except for the (1) statement of budgetary resources Development (HUD) in accordance lines impacted by the accounting for programs from with the Chief Financial Officers Act of the Office of Community Planning and Development 1990 as amended. This report (CPD) and Government National Mortgage supplements our report on the results of Association (Ginnie Mae) and (2) accounting and our audit of HUD’s principal financial presentation of balance sheet and statement of net cost statements for the fiscal years ending lines affected by HUD’s implementation of U.S. September 30, 2013 and 2012 Treasury cash management requirements in the Office (restated). Also provided are of Public and Indian Housing’s (PIH) Housing Choice assessments of HUD’s internal controls Voucher program. Our opinion is reported in HUD’s and our findings with respect to HUD’s Fiscal Year 2013 Agency Financial Report. The other compliance with applicable laws, auditors and our audit disclosed 4 material weaknesses, regulations, and governmentwide policy 11 significant deficiencies in internal controls, and 5 requirements and provisions of instances of noncompliance with applicable laws and contracts and grant agreements. In regulations, which are discussed further in this report addition, we plan to issue a letter to and the reports of the other auditors. 1 management describing other issues of concern that came to our attention Fiscal year 2013 is the 23rd year HUD has been during the audit. subjected to a financial statement audit. The basis for the qualified opinions, material weaknesses, and significant deficiencies reported this year have root What We Recommend causes first reported in previous years. This year’s material weaknesses are due in large part to HUD’s Current and prior-year longstanding weaknesses in internal controls over recommendations are after each finding financial reporting. These control deficiencies are due and in the Follow-up on Prior Audits to HUD’s inability to establish a compliant control section of this report. We identified environment, implement adequate systems, recognize $259 million in excess obligations and required changes, or identify appropriate accounting are recommending that HUD transfer at principles and policies. least $643.6 million in excess Section 8 funding held in public housing 1 2014-FO-0002, Audit Report of the Federal Housing agencies’ net restricted asset accounts. Administration’s Financial Statements, issued December 13, 2013 and 2014-FO-0001, Audit Report of the Government National Mortgage Association Financial Statements, issued December 6, 2013 TABLE OF CONTENTS Background and Objectives ..................................................................................................... 3 Material Weaknesses .............................................................................................................. 4 Finding 1: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements ............................................................................. 4 Finding 2: PIH’s Housing Choice Voucher Program Cash Management Process Departed From GAAP and Treasury Requirements ............................................................................... 9 Finding 3: Financial Management Systems Weaknesses Continued To Challenge HUD ... 17 Finding 4: There Were Weaknesses in HUD’s Consolidated Financial Statement Preparation and Reporting Processes .................................................................................... 28 Significant Deficiencies ........................................................................................................ 34 Finding 5: HUD Lacked GAAP-Compliant Policies for Accruals ...................................... 34 Finding 6: Weaknesses in the Reporting of HUD’s Accounts Receivable Continued......... 39 Finding 7: Weaknesses in HUD’s Administrative Control of Funds System Continued..... 44 Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations .......... 49 Finding 9: HUD’s Financial Management Governance Structure and Internal Controls Over Financial Reporting Were Ineffective ................................................................................... 62 Finding 10: Weaknesses in HUD’s Rental Housing Assistance Program Monitoring Continued .............................................................................................................................. 68 Finding 11: Financial and Program Management Controls Over the Emergency Homeowner’s Loan Program Were Weak ............................................................................ 76 Finding 12: HUD’s Computing Environment Controls Had Weaknesses ........................... 81 Compliance with Laws and Regulations ....................................................................... 87 Finding 13: HUD Did Not Substantially Comply with the Federal Financial Management Improvement Act ................................................................................................................... 88 Finding 14: HUD Did Not Substantially Comply with the AntiDeficiency Act .................. 90 Finding 15: HUD Did Not Comply With the HOME Investment Partnership Act.............. 93 Finding 16: HUD Did Not Comply With the Federal Information Security Management Act ............................................................................................................................................... 96 Scope and Methodology ....................................................................................................... 97 Follow-up on Prior Audits ................................................................................................ 100 Appendixes ............................................................................................................................. 109 A. Schedule of Questioned Costs and Funds To Be Put To Better Use ............................. 109 B. Federal Financial Management Improvement Act Noncompliance, Responsible Program Offices, and Recommended Remedial Actions ............................................................. 110 C. Auditee Comments and OIG’s Evaluation .................................................................... 112 2 BACKGROUND AND OBJECTIVE We are required by the Chief Financial Officers Act of 1990, as amended by the Government Management Reform Act of 1994 and implemented by Office of Management and Budget (OMB) Bulletin 14-02, Audit Requirements for Federal Financial Statements, to audit the U.S. Department of Housing and Urban Development’s (HUD) principal financial statements or select an independent auditor to do so. The objective of our audit was to express an opinion on the fair presentation of these principal financial statements. Management is responsible for • Preparing the financial statements in conformity with accounting principles generally accepted in the United States of America; • Establishing, maintaining, and evaluating internal controls and systems to provide reasonable assurance that the broad objectives of the Federal Financial Management Improvement Act of 1996 (FFMIA) are met; and • Complying with applicable laws and regulations. In auditing HUD’s principal financial statements, we were required by Government Auditing Standards to obtain reasonable assurance about whether HUD’s principal financial statements were presented fairly, in accordance with generally accepted accounting principles (GAAP), in all material respects. We believe that our audit provides a reasonable basis for our opinion. In planning our audit of HUD’s principal financial statements, we considered internal controls over financial reporting by obtaining an understanding of the design of HUD’s internal controls, determined whether these internal controls had been placed into operation, assessed control risk, and performed tests of controls to determine our auditing procedures for the purpose of expressing our opinion on the principal financial statements. We are not providing assurance on the internal controls over financial reporting. Consequently, we do not provide an opinion on internal controls. We also tested compliance with selected provisions of applicable laws, regulations, and government policies that may materially affect the consolidated principal financial statements. Providing an opinion on compliance with selected provisions of laws, regulations, and government policies was not an objective, and, accordingly, we do not express such an opinion. This report is intended solely for the use of HUD management, OMB, and Congress. However, this report is a matter of public record, and its distribution is not limited. 3 MATERIAL WEAKNESSES Finding 1: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements HUD’s Office of Community Planning and Development’s (CPD) formula grant program accounting departed from GAAP, due to its use of the first in, first out (FIFO) method to disburse obligations. The information system used, Integrated Disbursement Information System (IDIS) Online, a grants management system, was not designed to comply with Federal financial management system requirements. As a result of FIFO, budget year grant obligation balances were misstated, and disbursements were made using an incorrect general ledger attribute. Due to the inability of IDIS Online to provide an audit trail of all of the financial events affected by the FIFO method, the financial information within IDIS Online, which was affected by FIFO and transferred to HUD’s core financial system and used to prepare its consolidated financial statements, could not be quantified. Due to the magnitude and pervasiveness of the funds susceptible to the FIFO method and the noncompliant internal control structure in IDIS Online, the combined statement of budgetary resources and the consolidated balance sheet were not prevented from being materially misstated. IDIS Online’s Accounting for Transactions Was a Departure From GAAP Accounting Standards Due to inadequate budget controls and a disregard for the United States Standard General Ledger (USSGL) attributes at the transaction level when making disbursements for CPD’s formula grant disbursements, the use of the FIFO method was • A departure from Federal financial accounting standards and GAAP; • Noncompliant with budgetary internal control requirements; and • Noncompliant with the overall conceptual framework established by the Federal financial management laws and guidance issued by the standard setters. During fiscal years 2013 and 2012, $5.1 billion and $5.6 billion, respectively, in disbursements were susceptible to this FIFO method and will be reported in HUD’s consolidated financial statements. These material amounts on the combined statement of budgetary resources and consolidated balance sheet were not presented in conformity with generally accepted accounting principles. 4 HUD’s Office of Inspector General (OIG) researched accounting literature directly applicable to Federal agency accounting, such as Federal Financial Accounting Standards, Federal financial management statutes, authoritative literature from the U.S. Government Accountability Office (GAO), the U.S. Treasury’s Financial Management Division, and OMB. Based on this research, OIG determined that specific authoritative literature applicable to the use of the FIFO method for disbursing obligations for formula grant programs was absent. To that end, in accordance with the Federal Accounting Standards Advisory Board (FASAB) Handbook, OIG believes that HUD should report the disbursement of obligations for formula grant programs with expiring Treasury account fund symbols (TAFS) 2 by selecting the same established accounting principle for disbursing obligations for categorical grant programs and administrative obligations with expiring TAFS and, therefore, matching the disbursement to the underlying obligation. Through its careful study of the conceptual framework, OIG has determined that the use of the FIFO method was at odds with the concepts used to set the standards. In OMB’s role of ensuring that agency reports, rules, testimony, and proposed legislation are consistent with the President’s budget and with Administration policies and through its oversight and coordination of the Administration’s procurement, financial management, and information and regulatory policies, OMB notified HUD to discontinue the use of FIFO. The recording of financial events, as well as the preparation of standard external reports that HUD is required to submit to OMB and the U.S. Treasury, are reported for each TAFS through the USSGL. Based upon those requirements, OIG believes that the TAFS is an integral attribute, which must be included as part of each financial event, including disbursement of obligations. Therefore, the use of FIFO by IDIS Online, which disregards the appropriate TAFS when determining from which account to make a disbursement, was not properly recording the financial event at the transaction level as required by OMB and Treasury. The transactions were incorrectly reported from IDIS Online to the core financial systems used to prepare the combined statement of budgetary resources and consolidated balance sheet. CPD formula grants are mandated through Congress’s appropriation. Once the appropriation has been apportioned by OMB, in accordance with the program’s funds control regulations, as mandated by the Antideficiency Act, the funds are allotted and assigned. Based upon a formula calculation, the assignment is reserved to individual eligible grantees. These grantees then execute a grant award, or obligating agreement, which then obligates the funds. The grant 2 The Treasury appropriation fund symbol (TAFS) refers to the separate Treasury accounts for each appropriation title based on the availability of the resources in the account. The TAFS is a combination of Federal account symbol and availability code (for example, annual, multiyear, or no-year). 5 agreements identified the amounts and purposes of the grant, the obligations of the parties to the award, and other terms and served as the legal point of the obligation, requiring HUD to make disbursements within the agreement terms. In accordance with Federal budgetary accounting laws and accounting standards, the apportionments, allotments, assignments, reservations, and obligations require specific accounting entries to be recorded using the USSGL and require the use of the same TAFS attribute associated with the original appropriation law. That TAFS defined the source of funds and established the timeframes for when the funds are canceled and no longer available for obligation or expenditure for any purpose in accordance with the National Defense Authorization Act of 1991. OIG believes that the same source TAFS, which remained constant and was used to record the other financial transaction events related to the obligation, should also be used to record the disbursements against that obligation. The FIFO logic used by IDIS Online was implemented before the enactment of the public laws that affect Federal financial accounting standards and requirements. After the enactment of these public laws, the Chief Financial Officer did not ensure that CPD made all of the necessary changes to ensure that the system complied with these requirements. FIFO was implemented across almost all of the components and rules in the system when the funds were no-year money, while the system’s main purpose was for the program office’s administration of CPD grants. FIFO was embedded throughout IDIS Online and affected the events that led to financial transactions. When FIFO was used to disburse obligations, disbursements were not matched to obligations, and obligations were improperly liquidated. Arbitrarily liquidating the obligation funded from the oldest available budget fiscal year appropriation source or TAFS, rather than matching it to the correct obligation and corresponding TAFS, allows costs and disbursements to be recorded under obligations recorded under soon-to-be canceled TAFS. When TAFS are canceled, the unused funds are remitted to Treasury, and the fund balance with Treasury reported on the consolidated balance sheet is reduced. In addition, the unpaid obligations, end of year, which are later brought forward to the unpaid obligation, brought forward balances on the combined statement of budgetary resources in the next fiscal year, are misstated because the disbursements were recorded against the obligation under the incorrect TAFS. CPD was in the early stages of developing a plan to prospectively remove FIFO from IDIS Online. CPD evaluated the impact of removing FIFO on program regulations, grantees, and staff and estimated a cost and completion timeline of early fiscal year 2015. The current draft plan, however, did not specifically address in detail all of OIG’s previous recommendations that remain open, nor did it describe how the TAFS for each accounting transaction will be recorded, remain constant, and be maintained to ensure compliance and reporting according to GAAP. It also did not reference Federal system requirements or criteria that will be used to modify the system. Additionally, as the plan was prospective, it 6 did not address the $10.4 billion in undisbursed obligations as of September 30, 2013, already affected by FIFO in IDIS Online. To that end, until CPD fully implements its corrections to the system, OIG will annually review undisbursed obligations to determine whether material obligation balances in IDIS Online are affected by FIFO, are included in HUD’s core financial systems, and prevent the combined statement of budgetary resources and consolidated balance sheet from being presented in conformity with GAAP. Conclusion OIG determined that the use of the FIFO method is (1) a departure from Federal accounting standards and (2) noncompliant with budgetary internal control requirements and the overall conceptual framework established by the Federal financial management laws and guidance issued by the standard setters. Specifically, the use of FIFO by the information system, IDIS Online, made it noncompliant with OMB Circular A-127, Federal Financial Management Systems Requirements, due to the inadequate budget controls and misuse of USSGL attributes at the transaction level for CPD’s formula grant disbursements. During fiscal year 2013, $5.1 billion in disbursements was susceptible to this FIFO method, which is not in accordance with GAAP, and will be reported in HUD’s consolidated financial statements. It is due to this material amount that the combined statement of budgetary resources and consolidated balance sheet have been prevented from conforming with GAAP. Recommendations We recommend the Assistant Secretary for the Office of Community Planning and Development 1A. Develop and implement a detailed remediation action plan to ensure that grant management systems eliminate the FIFO methodology in its entirety. The plan should (1) explain how the budget fiscal year-TAFS for each accounting transaction (project and activity setup, commitment, disbursement, etc.) will be recorded, remain constant, and be maintained, (2) reference Federal system requirements and criteria, and (3) include resources, specific remedies, and intermediate target dates necessary to bring the financial management system into substantial compliance. 1B. Establish controls within the system, which provide an audit trail of the use of the funds by the budget fiscal year-TAFS. 7 We recommend that the Acting Chief Financial Officer 1C. Provide oversight of CPD’s system implementation or modification to ensure that Federal financial management accounting standards are embedded into the system so that the information transferred from grant management systems to HUD’s core financial systems comply with these standards, are recorded in HUD’s consolidated financial statements in accordance with Federal GAAP, and ensure that compliant administrative control of funds for its formula grant programs is established. 8 Finding 2: PIH’s Housing Choice Voucher Program Cash Management Process Departed From GAAP and Treasury Requirements HUD’s new cash management process for the Housing Choice Voucher program departed from Federal GAAP and treasury cash management requirements. When HUD implemented this process, management did not consider its impact on the financial reporting process. HUD also did not establish internal controls to ensure accurate and reliable financial reporting. Consequently, until OIG identified the issue, HUD omitted material transactions from significant financial events from the consolidated financial statements in fiscal years 2012 and 2013. Further, under HUD’s processes, public housing authorities (PHA) still held funds in excess of their immediate disbursing needs, which violated Treasury cash management regulations. HUD Did Not Transition PHA NRA Accounts or Recognize Its Intent To Collect the Funds in Its Financial Statements Before January 1, 2012, HUD disbursed 100 percent of its Section 8 renewal budget authority to PHAs in 12 monthly payments, and PHAs maintained any excess in a net restricted asset (NRA) account. Using this method, excessive funds accumulated in PHA accounts. Based on OIG recommendations and HUD’s requests for reallocation, Congress mandated two large budget offsets. 3 To eliminate these excessive accumulations, in fiscal year 2012, Congress, in a conference report, required that HUD follow Treasury regulations 4 on cash management for the Section 8 Housing Choice Voucher program. These regulations require HUD to monitor PHAs to ensure that Federal cash is not maintained in excess of immediate housing assistance payment disbursement needs. To comply with Treasury regulations, HUD planned to stop PHA NRA fund accumulation by December 31, 2011, and transition the existing excess balances to HUD’s reserve account by December 31, 2012. HUD established its intent to collect the PHA NRA reserves through the issuance of Office of Public and 3 Congress mandated rescission of $1.5 billion in 2008 and 2009 and $650 million in 2012. 4 Treasury Financial Manual, vol. 1, part 4A, section 2045.10 – It is the responsibility of grantor agencies to monitor the cash management practices of their recipient organizations to ensure that Federal cash is not maintained by them in excess of immediate disbursing needs. Agencies must establish systems and procedures to assure that balances are maintained commensurate with immediate disbursing needs, excess balances are promptly returned to the Treasury, and advance funding arrangements with recipient organizations unwilling or unable to comply are terminated. 9 Indian Housing (PIH) Notice 2011-67 5 and a formal letter to PHA executive directors stating that PHA NRA funds as of December 31, 2012, would be transitioned to HUD reserves and should be readily available. 6 The issuance of the notice established the accounting recognition point, at which the PHA NRA reserve balance should have been recognized as an asset on HUD’s financial statements in accordance with Statements of Federal Financial Accounting Standards 1, Accounting for Selected Assets and Liabilities. However, HUD failed to correctly account for these financial transactions during fiscal years 2012 and 2013, resulting in departures from Federal GAAP. OIG discussed this issue with PIH during fiscal years 2012 and 2013 and formally notified the Office of the Chief Financial Officer (OCFO) in early September 2013 of its concerns related to the incomplete transition of the PHA-held NRA balances to HUD and recognition of these balances as a HUD-held asset. Since HUD did not properly account for transactions as they occurred during the cash management process, in late October 2013, OCFO adjusted its fiscal year 2013 beginning advance balance by $986 million and its expenses by $534 million, resulting in an ending advance balance of $451 million for fiscal year 2013. Subsequently in November 2013, OCFO recognized a beginning advance balance of $1.8 billion and an expense of $902 million, resulting in an ending advance balance of $986 million for fiscal year 2012. However, OCFO did not inform the OIG about the adjustment until December 2013. These adjustments were made based on estimates provided by PIH management. OCFO indicated that these estimates were the only supportable transactions and proceeded with the adjustments, which were based on beginning and ending PHA NRA balance estimates. OIG could not determine the accuracy of these estimates due to several factors: (1) OCFO and PIH did not provide their methodology and assumptions used to support their estimate until mid-November 2013; (2) PIH could not provide proper accounting records to support the activity and expenses that occurred throughout the year; (3) the estimates were based on Voucher Management System (VMS) 7 data, which are PHA self-reported data and not adequately verified by HUD, in fiscal years 2012 or 2013; 8 and (4) the timing of the adjustment did not allow sufficient time for audit procedures that we deemed necessary to be completed. Since we could not determine the reasonableness of these estimates, we could not form an opinion on the reliability of the adjustments. 5 PIH Notice 2011-67, issued December 9, 2011, Implementation of New Cash Management Requirements for the Housing Choice Voucher Program, states that existing NRA balances held by PHAs will be transitioned to the cash management process and the program reserves. 6 On February 1, 2013, HUD issued a memorandum to PHA executive directors to prepare for the transition of the excess funds as of December 2012. NRA balances reported by December 31, 2012, were to be extracted from VMS and used as the basis for establishing HUD-held reserves. The amount reported would be reduced by subsequent legitimate housing assistance expenses. 7 VMS is a Web-based tool through which PHAs report monthly program data, including housing assistance expenditures, to HUD. 8 See finding 10 for further information on our concerns with VMS data. 10 In addition to HUD’s departures from Federal GAAP, as of September 30, 2013, HUD had not completed the transition of PHA NRA reserves to HUD-held reserves; therefore, HUD did not fully comply with Treasury’s cash management regulations. HUD intended to complete the transition; however, as of September 30, 2013, a final transition plan and timeline had not been approved. PIH management originally delayed the transition so that it would not complicate the 2012 offset for the rescission, which was congressionally mandated in the fiscal year 2012 HUD appropriations bill. 9 Then, PIH’s Assistant Secretary further delayed the transition because she assumed that in addition to the 2012 rescission, the across-the-board and sequestration rescissions ordered in March 2013 would sufficiently decrease the PHAs’ reserves. 10 HUD should have transitioned the excess NRA funds to HUD-held reserves to comply with Treasury cash management rules and safeguard its assets. Under HUD’s process, PHAs have immediate access to their excess NRA funds, and there are not sufficient controls in place to ensure that these funds are used only for eligible housing assistance expenses. When HUD performed the offset for the 2012 rescission, 71 PHAs reported having insufficient funds to cover the offset. HUD’s Quality Assurance Division reviewed 65 of these PHAs 11 and found several discrepancies between the NRA excess cash PHAs reported to HUD and the amount on hand. Of the 65 PHAs, the Division found that 45 PHAs underreported their cash by $19.2 million and 46 PHAs did not have $10.8 million (38 percent) of the NRA they reported to HUD. Further the Division’s review of 29 of the 65 PHAs revealed that 18 PHAs should have reported an additional $5.3 million in NRA and 10 PHAs overreported their NRA by $535,746. HUD’s Real Estate Assessment Center also reported that the Division’s review of 32 PHAs in fiscal year 2011 identified 19 PHAs that understated NRA by $13.6 million and 13 PHAs that overstated NRA by $2.7 million. These reviews showed that HUD did not have sufficient controls in place to ensure that NRA balances were properly valued or that NRA funds were spent properly. Since HUD had not transitioned these funds to HUD-held reserves and did not have sufficient controls in place to safeguard them at the PHA level, they were more susceptible to fraud, waste, and abuse. Additionally, since HUD had not transitioned these funds, PHAs that did not have the cash reserves as reported may not have been held accountable to repay the funds to HUD. 9 Consolidated and Further Continuing Appropriations Act, 2012, Public Law 112-55, issued November 18, 2011 10 Across-the-board rescission stated in Consolidated and Further Continuing Appropriations Act, 2013, Public Law 113-6, issued March 26, 2013. Sequestration cuts were ordered in an executive order, issued March 1, 2013. The across-the-board rescission treasury warrant date was May 29, 2013, and the sequestration rescission treasury warrant date was August 24, 2013. 11 The Quality Assurance Division could not review six of the PHAs because two did not respond to Division requests and four were transferred. 11 Cash Reconciliations Were Not Completed in a Timely Manner or Recognized in HUD’s Financial Statements Beginning in January 2012, to comply with Treasury requirements, HUD stopped disbursing 1/12 of the total renewal budget authority monthly and began disbursing only the amount HUD determined the PHA needed based on prior- quarter (VMS) data. Amounts that were not disbursed remained in HUD-held reserves for the PHA. HUD used cash reconciliations to determine the differences between HUD disbursements and PHA actual housing assistance expenses. Any shortages owed to the PHA were later disbursed by HUD, and any excesses were offset in a future disbursement. Although HUD performed quarterly cash reconciliations, its manual process did not allow for recognition of financial transactions or timely adjustments to PHA disbursements. Our review found that adjustments to future disbursements occurred 6-12 months after the quarter ended, allowing PHAs to hold additional excess funds for up to 12 months, which is contrary to the objectives of cash management and congressional intent. Further, the excesses or shortages that were identified in this process were not recognized in HUD’s financial systems or accounting record as required by Federal GAAP. Any excesses or shortages identified through the quarterly cash reconciliation process met the definition of an account receivable or account payable in accordance with Statement of Federal Financial Accounting Standards (SFFAS) 1 and should have been recognized at the time the amounts were identified. As of September 30, 2012, excesses and shortages identified should have resulted in receivables and payables amounting to $154 million and $19 million, respectively. As of June 30, 2013, excesses and shortages identified should have resulted in receivables and payables amounting to $29 million and $69.8 million, respectively. Due to the delays in preparing the cash reconciliations, the necessary information to estimate figures as of September 30, 2013, was not available and could not be estimated. Moving to Work PHAs Were Not Included in the Cash Management Process In addition to the issues noted above, we found that the cash management process did not include all PHAs. Specifically, quarterly cash reconciliations were not completed for 35 Moving to Work (MTW) PHAs, which HUD paid more than $3 billion during fiscal years 2012 and 2013. These payments to MTW PHAs represented approximately17.2 and 16.2 percent of fiscal year 2012 and 2013 Section 8 program funding, respectively. 12 PIH could not complete these reconciliations because PHAs are required to report only their housing assistance expenses in VMS; they are not required to report non-HAP expenses. Unlike other PHAs, MTW PHAs are allowed to combine operating funds, capital funds, and housing choice voucher funds. Since PHAs are not required to report expenses for all of these funds in VMS, PIH could not accurately perform its reconciliations. PIH indicated that it was in the process of updating VMS to allow for separate reporting. PIH also reported that it sent to OMB for approval a memorandum, which would require that MTW PHAs report non-housing assistance expenses. PIH reported that without OMB approval, PIH could not require MTW PHAs to report non-housing assistance expenses under the Paper Reduction Act. Since PIH could not perform reconciliations for MTW PHAs, these PHAs may have been holding funds in excess of their immediate disbursing needs. Additionally, PIH could not determine any excesses (accounts receivable) or shortages (accounts payable) that should have been recognized in HUD’s accounting records and financial statements. Internal Controls Over the Cash Management Process Were Weak HUD failed to implement adequate internal controls over the cash management process to ensure complete, accurate, and reliable financial reporting as required by OMB Circular A-123. 12 First, PIH’s cash management process lacked an automated process. The cash reconciliation master file used to determine appropriate adjustments was manual, maintained on an Excel spreadsheet by one individual, and the integrity of the data was not properly protected or secured. Additionally, the process to perform adjustments to future disbursements in HUD’s Centralized Accounting and Program System (HUDCAPS) was also manual. Due to HUDCAPS’ functional limitations, HUD could not capture and recognize transactions resulting from the quarterly reconciliations because HUDCAPS operates only on a fiscal year basis and the Section 8 Housing Choice Voucher program funding is on a calendar year basis. 12 Section II, part A, states, “Reliability of financial reporting means that management can reasonably make the following assertions: • All assets, liabilities, and transactions that should be reported have been included and no unauthorized transactions or balances are included (completeness); • The financial report is presented in the proper form and any required disclosures are present (presentation and disclosure); • All assets have been safeguarded against fraud and abuse; and • Documentation for internal control, all transactions, and other significant events is readily available for examination.” 13 With more than 2,200 PHAs that require a quarterly reconciliation and potential adjustment, the amount of resources available was limited compared to the vastness of the task. Lack of an automated process substantially increased the risk for human error. Further, a lengthy manual reconciliation process prevented recognition of accounting transactions from financial events from being reflected accurately and in a timely manner in the core financial system as required by OMB Circular A-127 and FFMIA. This manual process also did not provide an appropriate accounting and audit trail or provide the data integrity to ensure the accuracy of transactions as required by OMB Circular A-123. 13 The insufficient audit trail hampered our ability to trace and validate adjustments as part of our audit work. Secondly, PIH failed to develop detailed operating procedures to govern the cash management process in time for our consideration. PIH developed a general plan; however, it did not include important factors such as yearend cutoff procedures and steps to verify the cash reconciliations or posting of transactions to HUDCAPS. Due to the manual nature of the process, procedures and internal controls are essential in ensuring the cash management process is implemented accurately and consistently. HUD’s Yearend Accounting Adjustments Failed to Mitigate Impact of Inadequate Accounting on Financial Statements As previously discussed, HUD did not appropriately recognize its intent to collect PHA NRA reserves or record excesses and shortages from the cash reconciliation process in its accounting records or financial statements during the fiscal year. This condition was due primarily to the lack of OCFO oversight, planning, communication, and coordination in implementing this significant program change. OCFO appeared to first become aware of the problem when OIG raised this as an audit issue in August 2013. The Chief Financial Officers Act of 1990 (CFO Act) specifically states that it is the responsibility of the Chief Financial Officer to direct, manage, and provide policy guidance and oversight of all agency financial management personnel, activities, and operations. However, since OCFO did not oversee this process, it could not adequately consider financial accounting and reporting requirements. Additionally, PIH did not complete a required front-end risk assessment, 14 which could have highlighted the need for financial statement recognition. 13 OMB Circular A-123, section I, part A: “management should have a clear, organized strategy with well-defined documentation processes that contain an audit trail, verifiable results, and specify document retention periods so that someone not connected with the procedures can understand the assessment process.” 14 HUD Handbook 1840.1, chapter 8, states that a front-end risk assessment is a formal, documented review by management to determine the susceptibility of a new or substantially revised program or administrative function to waste, fraud, abuse, and mismanagement. Its purpose is to detect conditions that may adversely affect the 14 Since HUD failed to properly account for cash management financial transactions at the start of this process, HUD misstated its balance sheet and statement of net cost of operations in fiscal years 2012 and 2013. Although HUD eventually estimated an advance adjustment, the issues identified during the 2012 offset, other Quality Assurance Division reviews, 15 and Real Estate Assessment Center studies indicate that the advance recorded could have been inaccurate. Due to the timing of the accounting adjustments performed by OCFO and the lack of accounting records to support the activity, we could not determine the reasonableness of the estimates made by management. However; we believe these amounts to be material to the financial statements. Conclusion When PIH implemented its new cash management process, it did not establish adequate internal controls or consider its impact on financial reporting. In addition, cash management was not fully implemented as of September 30, 2013. Consequently, accounting transactions resulting from significant financial events were not recognized in the core financial system or consolidated financial statements, MTW PHAs were not included in the process, and PHAs had access to funds in excess of their immediate disbursing need. In efforts to address the need to properly account for the activity, OCFO performed material accounting adjustments, which could not be sufficiently evaluated by OIG in time for the issuance of the financial statements. As a result, OIG could not determine the reasonableness of these material adjustments. PIH needs to fully implement Treasury’s cash management regulations by immediately transferring PHA NRA excess funds and work with OCFO to ensure accurate and timely financial reporting of all financial events resulting from the process. Recommendations We recommend that the Assistant Secretary for Public Housing, in coordination with the Acting Chief Financial Officer, 2A. Transition the PHA NRA excess funds, which are as much as $643.6 million as of June 30, 2013, to HUD’s control as soon as possible to safeguard the program resources. 2B. Identify PHAs with insufficient cash to cover their NRA and order the repayment of funds. achievement of program objectives and to provide reasonable assurance that the following goals will be met: safeguarding of assets, effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. A front-end risk assessment must be conducted for programs with significant changes in the way program funds are delivered to participants. 15 See finding 10 for further information on other Quality Assurance Division VMS reviews. 15 2C. Implement a cost-effective method for automating the cash management process to include an electronic interface of transactions to the standard general ledger. We recommend that the Acting Chief Financial Officer 2D. Review and validate the fiscal years 2012 and 2013 data that support the estimated adjustments recorded in the accounting records from the cash management process to ensure that all factors and assumptions are adequately supported and comply with GAAP. 2E. Review the cash management process to identify all financial events to be recognized in accordance with GAAP. Establish procedures to account for the cash management activity in a timely manner in compliance with GAAP. 2F. Require PIH to perform a front-end risk assessment on the the Housing Choice Voucher program due to the significant change to the program to ensure that the program meets cash management requirements. 2G. Ensure that PIH’s automation of its cash management process complies with Federal financial management requirements. 16 Finding 3: Financial Management Systems Weaknesses Continued To Challenge HUD Although HUD had taken steps and efforts were underway in fiscal year 2013 to address some of the OIG’s concerns, weaknesses in HUD’s financial management systems remained a serious problem. HUD continued to face these challenges due to shortcomings in its financial management systems and the lack of system capabilities and automation. As a result of HUD’s inherent system limitations and weaknesses, HUD’s financial management systems could not be readily accessed and used by financial and program managers without extensive manipulation and excessive manual processing. This situation negatively impacted management’s ability to perform required financial management functions and efficiently manage financial operations of the agency, which translated to lost opportunities for achieving mission goals and improving mission performance. Impediments to HUD’s Substantial Noncompliance With FFMIA Continued As reported in previous audits of HUD’s financial statements and in fiscal year 2013, weaknesses in HUD’s financial management systems continued to affect HUD’s substantial compliance with FFMIA (see OIG’s assessment of HUD’s compliance with laws and regulations related to FFMIA 16). One of the stated goals of FFMIA is for the agency to have a system that can generate reliable, useful, and timely information, including cost data, with which to make informed decisions and helps ensure accountability on an ongoing basis. • HUD lacked an integrated core financial system. Since fiscal year 1991, OIG has reported on the lack of an integrated core financial system, which impeded HUD’s ability to generate and report information needed to both prepare financial statements and manage operations accurately and in a timely manner on an ongoing basis. Due to a lack of system functionality in HUD’s general ledger, HUDCAPS, HUD had to extract data from HUDCAPS into the Financial Datamart and then use a financial tool, Hyperion, to manipulate HUDCAPS accounting data from the Financial Datamart to produce the agencywide financial statements. This process required extensive and time- consuming manual reconciliation procedures of three disparate systems (HUDCAPS, Financial Datamart, and Hyperion) and expended major effort and resources to develop information that a core financial system should be able to provide on a daily or recurring basis. Additionally, to prepare and consolidate component entities’ financial statements and notes, HUD required the Federal Housing Administration 16 Public Law 104-28, dated September 30, 1996 17 (FHA) and the Government National Mortgage Association (Ginnie Mae) to submit financial statement information on spreadsheet templates, which were loaded into a software application. Also, all consolidating notes and supporting schedules had to be manually posted, verified, reconciled, and traced. To overcome these system deficiencies with respect to the preparation of its annual financial statements, HUD again relied on extensive compensating procedures that were costly, labor intensive, and not always efficient. Because of HUD’s nonintegrated systems, errors in the consolidation process occurred, and HUD’s core financial systems did not support management’s need for timely and accurate information for day-to-day decision making. • HUD’s financial systems could not provide managerial cost data. In fiscal year 2006, GAO reported 17 that HUD’s financial systems did not have the functionality to provide managerial cost accounting across its programs and activities. This lack of functionality resulted in the lack of reliable and comprehensive managerial cost information on its activities and outputs. HUD lacked an effective cost accounting system that was capable of tracking and reporting the costs of HUD’s programs in a timely manner to assist in managing its daily operations. This condition rendered HUD unable to produce reliable, cost-based performance information. We noted no improvement in this area during the fiscal year 2013 audit. • HUD’s core financial system did not meet FFMIA’s system requirements. HUDCAPS was not compliant with core financial system requirements for the payment management function. The core financial system requirements state that the agency core financial system must contain automated processes to perform payment management functions. We found that HUDCAPS did not import or update vendor data in accordance with requirements and did not meet all accounts payable, invoicing, disbursing, and payment follow-up requirements related to how payments were processed. For instance, HUDCAPS did not record full or partial receipt and acceptance of goods and services by document line item; perform matching options that matched invoices to obligations, receiving reports, and acceptance data; and validate invoice period of performance and invoice delivery and performance dates and was not used to calculate the payment amount, including discounts, interest, and penalties. To be FFMIA compliant, a core financial application or an application performing core financial functions must comply with core financial system requirements. Therefore, HUDCAPS was noncompliant with FFMIA because it did not meet core financial system requirements for payment processing. • HUD’s procurement applications did not meet FFMIA’s system requirements. In fiscal year 2006, 18 we audited the HUD Procurement System (HPS) and the Small Procurement System (SPS) and determined them to be noncompliant 17 GAO-06-1002R, Managerial Cost Accounting Practices, dated September 21, 2006 18 Audit Report No. 2007-DP-0003: Review of HUD’s Procurement Systems, issued January 25, 2007 18 with Federal financial management requirements. We determined that HUD’s use of HPS and SPS as part of its integrated financial management system did not adequately manage and monitor procurement transactions. One of the issues specifically cited was that there was no payment information within either system or their interfaces with HUDCAPS. The Office of the Chief Procurement Officer (OCPO) worked to improve those applications and to implement the HUD Integrated Acquisition Management System (HIAMS) as a replacement application between fiscal years 2007 and 2011. OCPO began a phased implementation of HIAMS in October of 2011. The implementation was completed in January 2012. OMB Circular A-127’s definition of a financial management system includes the core financial systems and the financial portions of mixed systems necessary to support financial management. It also defines a mixed system as an information system that can support both financial and nonfinancial functions. Procurement applications, such as HIAMS, are defined as mixed financial systems. Agencies are required to adopt the standard government business processes included in the core financial system requirements documentation. The core system requirements do not apply to mixed systems unless the systems perform the core system function. Acquisition systems are specifically cited within the Framework for Federal Financial Management Systems model. These systems must be able to provide consistent, standardized information for program managers, financial managers, agency executives, and oversight organizations, and they must meet Federal statutes, regulations, and standards. Core functional requirements require data from both the financial and acquisition systems to perform edits and validations in support of the payment process. • HIAMS did not interface with HUDCAPS to perform payment management function. As part of the review we performed on HUDCAPS, we determined that HIAMS did not send acquisition data required to perform core financial system payment management functions to HUDCAPS. While Federal requirements allow for automated and manual processes, both core financial system and Joint Financial Management Improvement Program (JFMIP) 19 acquisition interface requirements mandate that the payment management functions be performed through an automated process. There was no interface between HIAMS and HUDCAPS that would allow the applications to perform the following core financial functions: define duplicate vendor invoice edit criteria and validate for duplicate invoices; validate payments to Central 19 JFMIP is a joint undertaking of Treasury, GAO, OMB, and the Office of Personnel Management, working in cooperation with one another, with other agencies, and with the private sector to improve financial management in the Federal Government. Acquisition/Financial Systems Interface Requirements is one of a series of functional systems requirements documents published by JFMIP dealing with Federal financial management systems. It addresses the shared information requirements between Federal financial and acquisition management systems. Specifically, it identifies existing governmentwide statutory and regulatory requirements associated with the mutual functional interfaces between finance and acquisition. 19 Contractor Registry20 vendors; perform matching options that match invoices to obligation, receiving reports, and acceptance data; and validate invoice period of performance and invoice delivery and performance dates. In addition, HIAMS did not interface with HUDCAPS for payment (that is, acceptance and delivery) data; therefore, the required payment processing core financial functions were not completed through an automated process as mandated. Data within both applications (HIAMS and HUDCAPS) are required to meet the core financial system requirements for payment processing. HUD’s use of the HIAMS application as part of its integrated financial management system did not adequately manage and monitor procurement transactions. HUD’s implementation of HIAMS did not provide the agency with the data necessary to automate the performance of the payment management core financial functions. Instead, the process was performed manually. HUD invested more than $10 million to implement the HIAMS application between fiscal years 2011and 2013. However, the implementation of the HIAMS application did not improve HUD’s financial processing of payments. o HUDCAPS obligation balances could not be traced to HIAMS. OIG performed a limited review of the implementation of HIAMS in fiscal year 2012 21 and determined that the OCPO did not establish adequate data validation procedures or perform adequate testing of data manually entered into the new application. This deficiency resulted in inaccuracies in the obligation balances recorded in HIAMS and discrepancies between the obligation balances in HIAMS and the balances in HUDCAPS. Because HUD’s former procurement applications, HPS and SPS, did not contain the same level of contract data as was recorded in HIAMS, OCPO developed a data cleanup and transfer process that used a combination of electronic and manual migration of data from the legacy systems to HIAMS. Due to the legacy systems’ limitations in capturing subaccount line data, the contracting officials used hardcopy award documents to manually enter the appropriate subaccount line data into the HIAMS application. OCPO declared the reconciliation process complete and the obligation balances between HIAMS and HUDCAPS to be the same on September 23, 2013. However, documentation provided by OCPO to provide evidence for the closure was not conclusive. Additional information requested by OIG was not provided in time to be reviewed for this audit. 20 The Central Contractor Registry (CCR) database is the common source of vendor data for the Federal Government. Both current and potential Government vendors are required to register in CCR to be awarded contracts by the Government. CCR validates the vendors’ information and electronically shares the data with the Federal agencies’ finance offices to facilitate paperless payments through electronic funds transfer. 21 Audit Report No. 2013-DP-0005: Fiscal Year 2012 Review of Information Systems Controls in Support of the Financial Statements Audit 20 HUD Initiated New Plans To Implement a Departmentwide Core Financial System HUD uses five separate financial management systems to accomplish the core financial system functions. HUD had been working to replace its core financial management system since fiscal year 2003. The previous project, the HUD Integrated Financial Management Improvement Project (HIFMIP), was based on plans to implement a solution that would replace two of the applications it uses for core processing, HUDCAPS and HUD’s Program Accounting System (PAS). In October 2011, the Financial Services Advisory Board 22 determined that HIFMIP was at risk of missing project milestones and the May 2012 “go live” date. In February 2012, HUD’s Chief Information Officer, with support from OMB, sponsored an operational assessment of HIFMIP. HUD convened an independent government assessment team composed of subject-matter experts from multiple government agencies to rapidly evaluate the status of HIFMIP and provide recommendations for a “go forward” strategy. The government assessment team agreed that the mid-May 2012 go-live date was at high risk. In March 2012, work on HIFMIP was stopped. Project sponsorship was transferred from OCFO to the Deputy Secretary. The Deputy Secretary and a working group comprised of OCFO, Office of the Chief Information Officer (OCIO), and OCPO reassessed HUD’s options and determined that a course correction for the PeopleSoft implementation was not a viable option. As a result, the HIFMIP effort was canceled. HUD spent more than $35 million on the failed HIFMIP project. In the fall of 2012, HUD determined that it would reevaluate alternatives for meeting HUD’s original program objectives. As a result of that decision, the New Core Project was created to move HUD forward to implement a new core financial system. The New Core Project has the same scope as HIFMIP, to replace at a minimum, the functionality required to decommission HUDCAPS and PAS during the initial phase of the project. This would be considered the first release, but HUD expected to use a phased approach to modernize all of its financial systems and processes to achieve the targeted state. In July 2013, the project management team issued an alternative analysis that assessed the benefits and risks of using a Federal shared service provider (full and partial service options) and HUD’s taking on a new system modernization effort with a commercial integrator (as was done in HIFMIP), as well as remaining with the HUDCAPS-PAS applications. The New Core Project management team 22 The Financial Services Advisory Board is a board established by OMB under the Chief Financial Officer Council to review financial systems information technology (IT) projects in accordance with OMB Memorandum M-10-26. 21 recommended a migration to a full-service Federal shared service provider, concluding that this option provided the most value to HUD by leveraging modern technologies in cloud computing and by reducing implementation risks. On July 30, 2013, HUD signed an interagency agreement with the Bureau of Public Debt (BPD) to obtain full Federal shared services. Full service leverages BPD’s financial management, procurement, human resources, and travel applications. BPD will support full transaction processing to operate these systems. In September 2013, HUD began the definition stage of the project to determine what business process changes would be required as a result of the transition. HUD planned a phased implementation with an initial go live date of October 1, 2014. An Annual Cyclical Review of Financial Management Systems Was Not Implemented In fiscal year 2007, HUD made a strategic decision to conduct its annual financial management systems review (A-127 review) internally instead of contracting it out. Since bringing the A-127 review process in-house, HUD had reduced the number of reviews completed from three in fiscal year 2009 to none in each of the next 4 fiscal years. In response to an OIG audit recommendation, in fiscal year 2010, HUD had planned to conduct an A-127 review of one core financial system and five financial management systems each year. However, during our review in fiscal year 2013, we determined, for the third consecutive year, that HUD had not made significant progress in implementing its annual scheduled A-127 reviews. For example, the Federal Housing Administration- Subsidiary Ledger (FHA-SL) core system review, which began in 2010, had been in draft form since 2011 and was not complete as of September 30, 2013. In addition, the Ginnie Mae Financial System (GFAS) core system review began in 2012 and was still in process at the end of fiscal year 2013. HUD had neither initiated any new reviews in fiscal year 2013 nor completed any of its prior years’ pending systems reviews. To support HUD’s annual assurance statement, HUD officials said they leveraged the results of the A-123 and Federal Information Security Management Act (FISMA) reviews. In OIG’s view, the results of the A-123 and FISMA reviews can be leveraged to support HUD’s annual assurance statement on financial management systems but cannot be used to substitute for the A-127 reviews because of the limited nature of those reviews. Additionally, OIG’s fiscal year 2013 assessment of HUD’s compliance with FISMA noted significant deficiencies in HUD’s departmentwide information security program (see compliance with laws and regulations related to FISMA). 22 There Were Weaknesses in CPD’s Grants Management Systems As reported in prior years, weaknesses in CPD’s IDIS Online continued to impede HUD’s financial management accountability on its formula grant programs. Specifically, CPD’s IDIS Online system did not account for its formula grant transactions using the specific identification method in accordance with the conceptual framework within Federal accounting standards. Rather, the system used the first in, first out (FIFO) method to account for and disburse formula grant obligations. The system’s processing deficiencies impeded HUD’s ability to accurately capture, track, and report the budgetary obligations and costs of the formula grant recipients at a granular level required by the Federal accounting standards conceptual framework. The IDIS Online system is a mixed system used by CPD for the management of CPD’s formula grant programs. A mixed system is an information system that can support both financial and nonfinancial functions. Section 803(a) of FFMIA, through the implementation of OMB Circular A-127, required maintenance of the agency’s core systems to comply substantially with Federal accounting standards and the United States Standard General Ledger (USSGL) at the transaction level. Although IDIS Online, as a mixed system, was not required to record transactions using the USSGL account, data coming from the mixed system (grantee disbursement requests serve as the financial portion of IDIS Online) must be posted to HUD’s core financial system using proper USSGL accounts and accounting standards. The recording of financial events as well as the preparation of standard external reports that HUD is required to submit to OMB and Treasury are reported for each TAFS through the USSGL. Based on those requirements, OIG believes that the TAFS is an integral attribute, which must be included as part of each financial event, including disbursement of obligations. Therefore, the system, through use of FIFO, which did not specifically identify the appropriate TAFS when making a disbursement, was not properly recording the financial event at the transaction level using the USSGL attribute for disbursement transactions. Based upon this interpretation, those transactions were incorrectly reported from IDIS Online to the core financial systems used to prepare the combined statement of budgetary resources and consolidated balance sheet. This matter is discussed further in finding 1: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements. Since fiscal year 2009, OIG has reported the processing deficiencies of the IDIS Online system. Initially, HUD disagreed, and after 2 years at an impasse, HUD deferred further action on this matter without third-party intervention. Therefore, OIG brought the matter, along with other related appropriations law issues, forward to GAO in May 2011. HUD brought the matter forward to OMB later. 23 In the fourth quarter of 2013, GAO and OMB rendered their opinions on the issue in favor of OIG. As of the date of this report, HUD was in the early planning stages of developing a plan to address IDIS Online’s processing deficiencies. Processing of Accounting Transactions and Events Was Not Automated HUD has several material programs in which the processing of accounting transactions and events was not automated in accordance with FFMIA. • Section 108 and Section 184 loan guarantee programs did not have automated financial systems. HUD did not adequately design or implement financial management requirements for the Section 108 and Section 184 loan guarantee programs in its departmentwide financial management system. CPD’s Section 108 loan guarantee program, in addition to PIH’s Section 184 loan guarantee program, did not have computerized systems to perform their respective financial management processes in accordance with FFMIA, which requires the agency to implement and maintain financial management systems that comply substantially with the USSGL at the transaction level. Further, JFMIP-SR-00- 01, Guaranteed Loan System Requirements, requires guaranteed loan systems to interface with other financial management systems, including the core financial system, and perform fund control checks, initiate or record payments, record the results of other guarantee loan-related financial transactions, acknowledge receipt of financial information exchange, perform automatic system balancing, support managerial cost accounting, and support credit subsidy reestimates. These programs were not maintained in PAS, the Line of Credit Control System (LOCCS), or HUDCAPS, which constitute HUD’s core financial system. Instead, the program offices relied on Excel spreadsheets and Access databases to account for more than $1.989 billion in CPD loan guarantees and $3.525 billion in PIH loan guarantees. With specific regard to CPD, there was no automated input interface to obtain associated grant data from IDIS Online. Additionally, when a CPD grantee did not make a payment on the loan, CPD instructed OCFO’s accounting staff to make a manual deduction of funds available in the line of credit for the CDBG grant. In the case of PIH, the loan guarantee program office used a system of four separate Access database tables to process and maintain data on loan guarantees, defaults, and lender claims. The program office noted that the risk of duplications across these four databases existed and that overpayments on claims due to the duplication of payments had occurred. The program did not use HUDCAPS to perform required funds control checks, and when data were 24 submitted monthly to OCFO accounting staff, the staff had no access to the program’s project-level detail to substantiate summarized amounts to be booked to the general ledger. Without an integrated automated financial system to record detailed program transactions, HUD’s loan guarantee programs were unable to appropriately monitor loan commitments, note issuances, and repayment amounts, which could result in unreliable data affecting the financial statements. • Accounting and reporting of Ginnie Mae’s budgetary resources were not automated. Ginnie Mae did not have an automated budgetary accounting system in place to fully and accurately account for and report on its more than $13 billion in budgetary resources in accordance with FFMIA and OMB Circular A-11. FFMIA requires the agency to implement and maintain financial management systems that comply substantially with the USSGL at the transaction level. This means that each time a transaction or event is approved, it should generate an appropriate general ledger account for posting the transaction according to the rules defined in the USSGL. Additionally, OMB Circular A-11 states that the agency’s financial management systems must support the preparation and execution of the agency’s budget. To support Ginnie Mae’s accounting and external reporting requirements under FFMIA and OMB Circular A-11, the automated system would be essential in ensuring that Ginnie Mae has the capability to (1) monitor and track its budgetary activities for funds control and decision making and (2) produce reliable and timely financial information for external financial reporting. The condition above occurred because Ginnie Mae was not performing budgetary accounting. Historically, the primary user of Ginnie Mae’s stand-alone financial statements was the private sector. Therefore, Ginnie Mae’s core financial management system had been designed to support the accounting and reporting requirements of its commercial but not budgetary activities. However, Ginnie Mae is required to report on its budgetary resources and prepare Federal GAAP basis financial information for consolidation with HUD and FHA in HUD’s financial statements. Due to a lack of system functionality for budgetary accounting, certain obligated balances were inadvertently omitted, such as the undelivered orders, and the unobligated balance and unpaid obligations brought forward had inaccurate opening balances. This condition resulted in material misstatements in the balances reported by Ginnie Mae in sections 1 (budgetary resources), 2 (status of budgetary resources), and 3 (change in obligated balance) of HUD’s combined statement of budgetary resources. 25 HUD Did Not Have a Functional Automated Property Management System HUD did not have a functional, automated property management system during the majority of fiscal year 2013 as required by Title 40 of the United States Code (U.S.C.), which sets forth executive agencies’ responsibilities to maintain adequate inventory controls and accountability systems. Further, FFMIA mandates that the agency head establish administrative and internal accounting controls that reasonably ensure that funds, property, and other assets are safeguarded against waste, loss, unauthorized use, or misappropriation. FIRMS (Facilities Integrated Resource Management System 23) was under a maintenance contract until August 8, 2011, when it was not renewed. The Office of Facilities Management Service (OFMS) learned of the contract lapse in October 2011 when FIRMS system problems with data transfer and upkeep of the system were identified. During fiscal year 2012, FIRMS encountered many problems and became nonfunctional. On May 23, 2013, a short-term maintenance contract for FIRMS was executed, and depreciation reports were generated and sent to OCFO for review in June 2013. However, HUD was in the process of performing a HUD-wide inventory to ensure that all personal property data were captured in the system, were accurate, and were reconciled appropriately. Therefore, the depreciation reports generated and provided to OCFO before completion of the HUD-wide inventory may not have been accurate due to the acquisition of new personal property during the time FIRMS was nonfunctional. Inventory items acquired during that period would not be included in the system until the inventory was completed. OFMS estimated that the inventory process would take approximately 6 months to complete. As a result of the lack of functionality, FIRMS did not meet the Office of the Chief Human Capital Officer’s (OCHCO) needs. Specifically, the system did not • Produce depreciation reports, • Maintain historical data, • Provide an audit trail, • Properly upload items scanned with the inventory bar code scanners, • Reconcile items entered into the system, and • Integrate with HUD’s financial and procurement systems. Further, since FIRMS was not functional for a significant period and did not integrate with other systems, OFMS, which oversees HUD’s personal property management policy development, implementation, and administration, had to rely 23 FIRMS was used by HUD staff to consolidate, automate, and provide reports on furniture, equipment, personal property, and space and lease life-cycle processes. 26 on OCPO, OCIO, and purchase card holders for necessary acquisition and disposal information. HUD’s financial management systems plan had deemed FIRMS as noncompliant since fiscal years 2010, and remediation plans have been developed by the Human Capital Office and progress in resolving the noncompliance has been monitored by the OCFO. However, as of the end of our review, FIRMS remained noncompliant. Conclusion Complete and reliable financial information is critical to HUD’s ability to accurately report on the results of its operations to both internal and external stakeholders. During fiscal year 2013, as in prior years, HUD made limited progress in bringing the financial management systems into compliance with FFMIA. The FFMIA requires HUD to develop and maintain financial management systems that can generate reliable, useful and timely information for managing current operations to make fully informed decisions and to ensure accountability on an ongoing basis. Until these weaknesses are fully remediated, HUD’s ability to produce reliable, useful and timely financial information needed for accountability, performance reporting, and decision making will remain a serious problem. As such, we will continue to monitor HUD’s progress in addressing our concerns in this area. Recommendations We recommend HUD’s Chief Financial Officer, in coordination with the Assistant Secretary for Public and Indian Housing 3A. Design and Implement a loan guarantee system that complies with the Guaranteed Loan System Requirements. Ensure that the implemented loan guarantee system should be integrated with HUD’s financial management systems and be included in its financial management system plans. We recommend HUD’s Chief Financial Officer, in coordination with Ginnie Mae’s Chief Financial Officer, 3B. Develop and implement plans to ensure that Ginnie Mae’s core financial system is updated to include functionality in the system to perform budgetary accounting at a transaction level using the USSGL to comply with FFMIA requirements. 27 Finding 4: There Were Weaknesses in HUD’s Consolidated Financial Statement Preparation and Reporting Processes In fiscal year 2013, our audit work identified weaknesses in HUD’s financial statement consolidation, preparation, and reporting related to Ginnie Mae. Specifically, we noted the (1) improper valuation and presentation of certain line items related to Ginnie Mae and FHA in HUD’s consolidated balance sheet, (2) failure to make the appropriate conversion adjustments to account for the differences in the accounting standards applicable to Ginnie Mae’s stand-alone financial statements and HUD’s consolidated financial statements, and (3) inaccurate accounting and reporting of Ginnie Mae’s budgetary resources. We attributed these financial reporting deficiencies to weaknesses in HUD’s Federal GAAP basis financial reporting environment and the inadequate oversight of component entities’ financial statement preparation and reporting processes. As a result, HUD’s previously issued financial statements had to be restated to correct material errors. Asset Related to Ginnie Mae’s Defaulted Loans Receivable Had Improper Valuation HUD did not properly account for and value Ginnie Mae’s defaulted loans receivable in HUD’s consolidated balance sheet in accordance with GAAP, causing that balance to be materially misstated. The defaulted loans receivable balance related to Ginnie Mae and reported in HUD’s consolidated balance sheet represented seriously delinquent loans (mortgage loans over 120 days delinquent) that were bought out of a defaulted mortgage issuer’s mortgage-backed securities pools. Because the majority of these loans were insured by FHA, they were recognized at 100 percent of the loans’ unpaid principal balance in Ginnie Mae’s books as loans receivable until the proceeds of an insurance claim were received. Since fiscal year 2010, HUD’s consolidated balance sheet had reported Ginnie Mae’s defaulted loans receivable account at 100 percent of the loans’ unpaid principal balance. However, this was not the appropriate valuation of the asset to HUD since these were considered severely impaired loans, 24 and the 100 percent insurance from FHA should not have been considered in the valuation of this asset at HUD’s consolidated financial statement level because HUD cannot file an insurance claim against itself. In accordance with Accounting Standards 24 ASC (Accounting Standards Codification) 310-10-35-16 states that a loan is impaired, when based on current information and events, it is probable that a creditor will be unable to collect all amounts due according to the contractual terms of the loan agreement. 28 Certification (ASC) 35-10-35-22, 25 when a loan is impaired, the impairment amount should be based on the present value of expected future cash flows discounted at the effective interest rate, except that as a practical expedient, a creditor may measure impairment based on a loan’s observable market price or the fair value of the collateral if the loan is a collateral-dependent loan. As of September 30, 2012, the unpaid principal balance of the defaulted loans receivable account related to Ginnie Mae was $7.6 billion, and its net carrying value was approximately $3.4 billion (assuming 45 percent recovery rate on fair value of the collateral). Therefore, HUD’s loans receivable account balance related to Ginnie Mae in the consolidated balance sheet as of September 30, 2012, was misstated by $4.2 billion. We brought this matter to the attention of Ginnie Mae, FHA, and HUD during the fiscal year 2013 audit, and HUD agreed to restate the 2012 consolidated balance sheet to correct the material accounting error in the valuation of the asset. The Balance Sheet Presentation Was Not in Accordance With USSGL Requirements In addition to the improper asset valuation as noted above, HUD’s presentation of Ginnie Mae’s loans receivable account as “other assets” in the consolidated balance sheet, instead of a separate line item, was a deviation from USSGL requirements. In accordance with the USSGL, Section V, USSGL Crosswalks to External Reports, loans receivable account balances (that is, the 1300 USSGL account series) are crosswalked to a separate line item in the balance sheet. HUD’s presentation of Ginnie Mae’s loans receivable as “other assets” was not in accordance with USSGL requirements (considered GAAP in the Federal Government), and, therefore, we deemed this issue a presentation error. The USSGL provides a uniform chart of accounts and technical guidance to be used in standardizing Federal agency accounting. Using the USSGL promotes consistency in financial transaction processing and reporting. The defined accounts and pro forma presentation standardize the accumulation of agency financial information as well as enhancing financial control and supporting financial statement preparation and other external reporting. Ginnie Mae used a manual crosswalk in Excel format to prepare its general purpose financial statements. Ginnie Mae’s manual crosswalk was not prepared in accordance with USSGL requirements. A deviation from the standardized Federal agency accounting and reporting, as defined in the USSGL, could provide misleading information to the users of the financial statements. The dollar 25 It is HUD’s position that Ginnie Mae is not a Credit Reform agency. Therefore, the accounting for Ginnie Mae’s defaulted loans receivable under SSFAS No 2, Accounting for Direct Loan and Loan Guarantees, does not apply to Ginnie Mae. 29 amount of adjustments needed to reclassify the defaulted loans receivable balances from the “other assets” account to a separate line item in fiscal year 2012 was $7.6 billion (net). We brought this matter to the attention of HUD during the fiscal year 2013 audit, and HUD agreed to report Ginnie Mae’s defaulted loans receivable as a separate line item in the consolidated balance sheet in fiscal year 2013 and also made adjustments to reclassify the loans receivable from “other assets” to a separate line item in the 2012 consolidated balance sheet. The reclassification adjustment had no effect on the total assets, but the adjustments were necessary to ensure that HUD’s presentation conformed to USSGL requirements. FASB-FASAB Conversion Adjustments Were Not Properly Considered Before Consolidation During the fiscal year 2013 audit of HUD’s consolidated financial statements, we noted a GAAP departure in HUD’s consolidation process related to certain Ginnie Mae assets. Ginnie Mae’s stand-alone financial statements are prepared in accordance with accounting standards promulgated by the Financial Accounting Standards Board (FASB) (commercial GAAP) and are correctly presented as a stand-alone entity. However, HUD’s consolidated financial statements need to comply with Federal Accounting Standards Advisory Board (FASAB) accounting standards (Federal GAAP). To consolidate Ginnie Mae accounting information, a conversion process is needed, and we determined that the adjustments being made were inadequate and misstated the value of the Ginnie Mae on HUD’s consolidated financial statements. The accounting for certain Ginnie Mae transactions under commercial GAAP vary in certain significant respects from Federal GAAP, and adjustments are necessary so that Ginnie Mae accounting information can be consolidated properly. We brought this matter to the attention of HUD and Ginnie Mae in June 2013 and requested that they perform an FASB-FASAB GAAP reconciliation analysis and make the appropriate adjustments based on the results of that analysis. In August 2013, HUD completed its GAAP reconciliation analysis and identified two key significant differences in the accounting for certain Ginnie Mae transactions under commercial GAAP and Federal GAAP as follows: • Mortgage servicing rights. Under the commercial GAAP, Ginnie Mae recognizes the fair value of the mortgage servicing rights at the end of each quarter. The mortgage servicing rights represent the fair value of servicing assets and servicing liabilities that arise from situations in which Ginnie Mae assumes the servicing rights on the pooled loan portfolio as a result of issuer default. However, there is no servicing rights concept under Federal GAAP. Therefore, Ginnie Mae’s accounting treatment for the mortgage servicing 30 rights would be to remove this line item from its Federal GAAP basis financial statements. Additionally, a prior period adjustment would be needed in its fiscal year 2012 consolidated balance sheet and consolidated statement of changes in net position to remove the effect of the mortgage servicing rights fair values in the cumulative results of operations. • Guarantee asset-guarantee obligation. Under commercial GAAP, Ginnie Mae recognizes a guarantee asset (GA) and guarantee obligation (GO) for the issuance of a guarantee under its Mortgage-Backed Securities program. The GA represents a receivable (at net present value) for the guarantee fees that Ginnie Mae expects to collect for the period during which the guarantee is provided (typically 30 years of cash flows over the life of the loan). The GO represents what Ginnie Mae expects to owe over the term of the guarantee in the event that specified events or conditions occur. However, FASAB does not have a requirement that specifically allows for the recognition of an asset or a liability as it relates to future collection of fees and future occurrence of cash outflows, respectively. Therefore, Ginnie Mae’s accounting treatment for the GA-GO would be to remove them from its Federal GAAP basis financial statements. In summary, the conclusion drawn from the above FASB-FASAB reconciliation is that HUD needs to restate its fiscal year 2012 consolidated financial statements in fiscal year 2013. The impact of the restatement is (1) the removal of the mortgage servicing rights, GA, and GO line items in HUD’s consolidated balance sheet and (2) to make prior-period adjustments in its fiscal year 2012 consolidated balance sheet and consolidated statement of changes in net position. Ginnie Mae Inaccurately Accounted for and Reported on Budgetary Resources Ginnie Mae did not completely and accurately account for and report on the activities and changes related to its budget authority in accordance with OMB Circular A-11. Since Ginnie Mae operates more like a financial services company than a government agency, it prepares commercial basis financial statements but does not perform budgetary accounting. Accordingly, its core financial system was not configured to perform Federal GAAP budgetary accounting. As a result, Ginnie Mae did not have the capability to completely and accurately account for its budgetary resources at a level needed to adequately support budget execution and funds control processes. To generate its statement of budgetary resources, Ginnie Mae used a manual process by pulling the information from other Treasury reports and Ginnie Mae’s proprietary accounting data. However, the information gathered from this manual process was incomplete because it did not capture all of the budgetary activities, such as the undelivered orders. Additionally, because transactions were not 31 recorded in the accounting system in real time, Ginnie Mae’s ability to monitor and track the balance of its budgetary resources (obligated and unobligated balances) and any changes during the life cycle of the funds on an ongoing basis for funds control and decision making was impeded. Ginnie Mae is responsible for managing a substantial amount of budgetary resources. The balance of Ginnie Mae’s budgetary resources as of October 1, 2012, was $13 billion, representing 8 percent of HUD’s total budgetary resources, including approximately $4 billion in spending authority from offsetting collections received each year. Given the materiality of the Ginnie Mae’s budgetary resources to HUD and the significance of the impact of the GAAP departure on the reported balances due to weaknesses in the preparation of Ginnie Mae’s statement of budgetary resources, we could not rely on the balances reported by Ginnie Mae to HUD. We brought this matter to the attention of Ginnie Mae and HUD during the fiscal year 2013 audit and HUD agreed to restate the affected SBR line items in the Combined Statement of Budgetary Resources in fiscal year 2012 to correct the material errors in the accounting and reporting of the SBR balances and also took actions to report the appropriate SBR balances going forward as of the end of fiscal year 2013. However, due to timing of the completion of the SBR restatement analysis we were unable to perform all the appropriate audit procedures that we deem necessary to form an opinion on the reliability of the restated SBR balances as determined by HUD/Ginnie Mae at year-end. Conclusion HUD management’s responsibilities for the consolidated financial statements include, among other things, preparing the financial statements in conformity with Federal GAAP and establishing and maintaining internal controls over financial reporting. Accurate reporting in the agency’s financial reports and other management of reports used to guide managerial decision making is essential for successful financial management. However, weaknesses in Ginnie Mae’s financial reporting environment and OCFO’s inadequate oversight of component entities’ financial preparation and reporting processes allowed material misstatements to HUD’s consolidated financial statements to occur without being detected or prevented in the normal course of its activities by either Ginnie Mae or HUD. This material weakness in the internal controls over financial reporting resulted in the restatement of HUD’s fiscal year 2012 consolidated financial statements in fiscal year 2013. The restatement necessitated adjustments to HUD’s fiscal year 2012 consolidated balance sheet and consolidated statement of changes in net position to correct material errors. 32 Recommendations We recommend that HUD’s Acting Chief Financial Officer, in coordination with Ginnie Mae’s Chief Financial Officer, 4A. Restate HUD’s fiscal year 2012 consolidated balance sheet to correct material errors resulting from improper valuation of defaulted loans receivable related to Ginnie Mae. 4B. Restate HUD’s fiscal year 2012 consolidated balance sheet to ensure that Ginnie Mae’s defaulted loans receivable is presented as a separate line item instead of other assets in accordance with USSGL requirements. 4C. Review and update Ginnie Mae’s manual USSGL crosswalk to ensure that it conforms to Treasury’s USSGL requirements. 4D. Restate HUD’s fiscal year 2012 consolidate balance sheet to account for the differences in the accounting for certain Ginnie Mae transactions under FASB and FASAB. 4E. Determine the amount of adjustments needed to correct the accounting and reporting errors identified in Ginnie Mae’s Statement of Budgetary Resources for fiscal years 2012 and 2013 and provide its analysis and support for its determination. We recommend that HUD’s Acting Chief Financial Officer 4F. Establish and implement policies, procedures, and practices to strengthen the oversight of its component entities’ financial preparation and reporting processes. 4G. Establish an appropriate accounting and financial reporting governance structure within OCFO with the appropriate level of accounting, experience, and training to support the size and complexity of HUD’s and its component entities’ financial reporting requirements. 4H. Provide instructions to the component entities, such as the applicable GAAP and accounting policies to be applied for external reporting. 33 SIGNIFICANT DEFICIENCIES Finding 5: HUD Lacked GAAP-Compliant Policies for Accruals HUD’s accounting policies and procedures related to accrual of expenses did not recognize liabilities in accordance with Federal GAAP. Our concern on this departure is that liabilities arising from exchange and nonexchange transactions were not recognized on the financial statements relating to (1) unpaid amounts due from grant and entitlement programs but not reported, (2) goods and services received but not invoiced, and (3) charge card purchases incurred but not billed. The absence of recognition of these financial events existed because OCFO did not allocate resources to ensure that research and identification of new or changed accounting standards and their applicability to HUD were performed. This deficiency resulted in a lack of policies and procedures to require the preparation and implementation of appropriate methodologies for an accrual estimate for liabilities as of the reporting date. The absence of an accrual estimate for these significant transactions would result in misstatements on HUD’s consolidated financial statements due to underreporting of liabilities, expenses, and obligations. Liabilities Were Not Recognized for the Accrual of Grant Expenses Incurred but Not Reported HUD’s lack of accounting policies related to grant accruals resulted in misstatements in its balance sheet due to OCFO’s not appropriately recognizing liabilities arising from unpaid amounts owed by grant and entitlement programs. The applicable Federal GAAP requirements for accruals of such expenses are included in SFFAS 5: Accounting for Liabilities of the Federal Government, and FASAB Accounting Technical Release 12 (FASAB TR 12), Accrual Estimates for Grant Programs. We sampled from HUD’s major grant programs 26 20 grant disbursements totaling $39.6 million made in fiscal year 2013, specifically October 2012, and reviewed supporting documentation to determine when the related expense was incurred by the grantee. Approximately $980 million was disbursed from the major grant programs from which we selected our sample, 90 percent of which was in amounts between $15,000 and $6 million. Seventeen of our twenty sample disbursements fell within that range and totaled almost $13 million, $11 million (85 percent) of which represented expenses incurred by the grantee in fiscal year 2012. Of our entire sample, we found that more than $33.1 million of approximately $39.6 million, or 84 percent, represented expenses incurred by the grantee in fiscal year 2012 but not reported to HUD for payment until fiscal year 26 The grant programs included in OIG’s analysis were (1) Community Development Block Grant, (2) Neighborhood Stabilization Program, (3) Homeless Assistance Grants, (4) Emergency Solution Grants, (4) HOME, (5) Native American Housing Block Grant, (6) PIH Capital Fund Modernization Grant, and (7) Hope VI. 34 2013. These disbursements included expenses incurred for mixed-use development projects, payroll, transportation services, and miscellaneous maintenance and repairs. These liabilities, although incurred, had been omitted from the general ledger and financial statements as of September 30, 2012. Likewise, the financial statements as of September 30, 2013, were understated by relative amounts due to the lack of an accrual policy, resulting in an omission of an estimate of accrued expenses. SFFAS 5 requires that Federal entities recognize a liability27 arising from nonexchange transactions be recognized for any unpaid amounts due as of the reporting date. Over the years, FASAB had received complaints regarding the costs associated with performing accruals, particularly grant accruals. A task force was convened, consisting of representatives from Federal agencies and independent accounting and consulting firms, that collaborated on the need for additional guidance in this area. The work of the task force resulted in FASAB’s releasing FASAB TR 12, which provides guidance to agencies to develop reasonable estimates of accrued grant expenses, including acceptable procedures for estimating accruals for grant programs, particularly procedures that are acceptable until sufficient relevant and reliable historical data become available. The absence of an accrual estimate for transactions executed by States, entitlements, or grantees but not yet reported to HUD for reimbursement results in incomplete and misstated financial statements. This error would be reflected as an underreporting of liabilities on the balance sheet and a program operating expense on the statement of net cost, in addition to obligations on the statement of budgetary resources as of the reporting date. Liabilities Were Not Recognized for the Accrual of Goods and Services Received but Not Invoiced We tested October 2012 disbursements made for goods and services received in accordance with contractual agreements made by HUD and outside vendors to determine whether these disbursements represented expenses incurred by HUD in the prior fiscal year. In addition, we reviewed charge card master invoices to determine whether the related purchase card activity was incurred during fiscal year 2012 but paid in fiscal year 2013. If so, we wanted to determine whether an appropriate accrual estimate of the expense was recognized in the accounting records to reflect these transactions in accordance with SFFAS 5, which states that a liability arising from reciprocal or “exchange” transactions should be recognized when one party receives goods or services in return for a promise to 27 The liability includes amounts due from the Federal entity to pay for benefits, goods, or services provided under the terms of the program, as of the Federal entity’s reporting date, whether or not such amounts have been reported to the Federal entity. 35 provide money or other resources in the future. Further, general purpose Federal financial reports should recognize probable and measurable future outflows or other sacrifices of resources arising from past exchange transactions that are unpaid amounts due as of the reporting date. We reviewed all contract disbursements made in October 2012 and found that OCFO did not recognize an accrual for these expenses in the general ledger and financial statements for goods and services that had been received under contract terms but not invoiced as of the reporting date. More than $13.1 million in disbursements was made in October 2012 for goods and services received but not invoiced before September 30, 2012. We also reviewed the October 2012 charge card master invoice and found that approximately $644,522 represented fiscal year 2012 purchase activity that was paid for in fiscal year 2013. These expenses, although incurred, had not been included in the general ledger and financial statements as of September 30, 2012. The absence of an accrual estimate for expenses related to goods and services received but not invoiced and charge card purchases incurred but not billed resulted in misstated financial statements due to incomplete and underreported liabilities on the balance sheet and a program operating expense on the statement of net cost, in addition to obligations on the statement of budgetary resources. There Was No Formal Financial Management Policy on Expense Accruals Complying with SFFAS 5 requires the agency to recognize liabilities from (1) transactions when one party receives goods or services in return for a promise to provide money or other resources in the future and (2) for grants in which expenses have been incurred by the grantee but not yet reported as of the reporting date. However, there was no group within OCFO charged with the responsibility of researching Accounting Standards, new and revised; determining their applicability to the Agency; and formulating and implementing the related internal policies and operating procedures that would ensure that these Accounting Standards are reflected within the financial statements, thereby making them consistent with Federal GAAP and governmentwide financial reporting. As a result, there had been no formal policies and procedures developed, which required the preparation of an appropriate methodology for an accrual estimate of liabilities related to grant expenses incurred but not reported, goods and services received but not invoiced, or charge card purchases incurred but not billed as of the reporting date. HUD’s basis of accounting as reported in note 2 of the HUD’s consolidated financial statements states that the financial statements are presented on the accrual basis of accounting, which requires HUD to recognize an expense when a liability is incurred, without regard to receipt or payment of cash. It goes on to state that “the Department’s disbursement policy permits grantees to request funds 36 to meet immediate cash needs to reimburse themselves for eligible incurred expenses…” Therefore, the need to have an adequate accrual policy for estimating liabilities related to grant expenses, contract and vendor expenses, and credit card expenses incurred but not yet billed is essential to comply with HUD’s basis of accounting and Federal GAAP. Conclusion OCFO did not recognize liabilities arising from exchange and nonexchange transactions in accordance with Federal GAAP. This lack of recognition of financial events occurred because OCFO did not have a function in place to research and identify accounting standards and their applicability to HUD, resulting in its lack of a development of policy and procedures that would require the preparation and implementation of an appropriate methodology for an accrual estimate of liabilities as of the reporting date. This departure from Federal GAAP and resulting absence of accrual estimates caused misstatements on HUD’s consolidated financial statements due to incomplete reporting and underreporting of liabilities, expenses, and obligations on HUD’s consolidated financial statements. OCFO needs to develop and implement policies to ensure that appropriate estimates are performed and recognized in the consolidated financial statements. Recommendations We recommend that the Acting Chief Financial Officer, in conjunction with each of the program offices, 5A. Evaluate all HUD grant programs in accordance with FASAB TR 12 requirements for materiality and risk of material misstatement on the financial statements. If indicated, based on this evaluation, OCFO should develop a methodology to prepare reliable and timely accrual estimates for all of HUD’s grant programs in accordance with FASAB TR 12. 5B. Develop policies and procedures that require the development of grant accrual estimates for existing and new grant programs and the implementation of internal control procedures to ensure that these estimates are consistently based on relevant and reliable data. 5C. Ensure that the policies and procedures developed under 5B above are communicated to pertinent HUD management officials and employees who may have a hand in providing the data needed to prepare the estimates. We recommend that the Acting Chief Financial Officer, in conjunction with each of the program offices, 37 5D. Develop GAAP-compliant policies and procedures that require the development and recordation of an accrual estimate for goods and services received and charge card purchases incurred but not yet billed to ensure that HUD’s financial statements are complete and properly stated in accordance with GAAP. 5E. Implement the GAAP-compliant policies and procedures developed under 5D above and develop a methodology that accurately estimates accrual of expenses incurred by HUD for goods and services received and charge card purchases incurred but not yet billed. 38 Finding 6: Weaknesses in the Reporting of HUD’s Accounts Receivable Continued Weaknesses identified in fiscal year 2012 28 regarding recognition of and proper accounting for accounts receivable remained. Specifically, we found (1) that HUD did not always record or estimate receivables in the accounting records when a determination was made that funds were owed to HUD and required repayment, and (2) weak oversight of the accounting for accounts receivable derived from Section 8 financing adjustment factor (FAF) bond refunding. This condition occurred because of a weak financial management governance structure and poor accounting monitoring controls. As a result, we identified $1.7 million in accounts receivable not included in HUD’s consolidated financial statements, resulting from program monitoring findings and repayment agreements. Additionally, an estimated $57.3 million in receivables from OIG audit recommendations was not included in HUD’s consolidated financial statements as of September 30, 2013. Lastly, the total receivable balance for FAF bond refunding totaling $17.1 million was at risk for misstatement due to the lack of oversight of the accounting for the portfolio. Recognition of Accounts Receivable Was Not Always Timely As reported in fiscal year 2012, HUD did not always record a receivable when sustained OIG audit recommendations, final program monitoring letters, repayment agreements, or demand letters required funds to be repaid. A majority of repayments were recorded as receivables on the date the funds were collected. In accordance with Federal GAAP, receivables should be recognized on the date the funds are determined to be owed to HUD or a reasonable estimate should be made. Specifically, SFFAS 1 states that a receivable should be recognized when a Federal entity establishes a claim to cash against other entities, such as a payment due date. If the exact amount is unknown, a reasonable estimate should be made. Additionally, HUD’s Debt Collection Handbook 1900.25, REV-4, specifics that funds are often determined to be owed to HUD during routine monitoring and accounting activities, sustained audit findings, and investigations. The funds are recognized as a receivable, and the monitor or other person discovering the funds owed is required to notify the action official for the program activity. Further, HUD’s Audit Management System Handbook 2000.06, REV-4, states that the action official should notify the accounting office of any audit reports with disallowed costs due HUD and any modifications to costs and monitor the costs. 28 Audit Report 2013-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and 2011 Financial Statements, issued November 15, 2012 39 We sampled 48 receivables, worth $8.6 million, collected during fiscal year 2013. We identified 12 receivable collections totaling $1.2 million, which originated from program monitoring findings, demand letters, or other binding documents. We also found three receivable collections totaling $0.6 million, which were in accordance with established repayment agreements. Collections for all 15 transactions occurred between 51 and 634 days after the receivable event occurred. However, HUD did not accrue any of the receivables until the payment collection date. For those that had repayment agreements in place, we determined that there had been no accruals for the outstanding balance recorded in the accounting records as of March 31, 2013, and August 31, 2013. In addition, our review found that adequate controls were not in place to ensure that the accounting center was notified of the funds to be repaid at the time repayment was recognized, either through a final program monitoring letter, repayment agreement, or other binding document. We determined that in 12 of 15 instances, OCFO was not notified about the anticipated collection. HUD’s program offices did not have adequate procedures or were not aware of the requirements to report these owed funds to the accounting center for proper accrual. We also noted as of September 30, 2013, CPD’s Grants Management Process (GMP) system reported significant amounts identified as a result of program monitoring findings that are to be repaid to the grantee’s local program account or to the agency either through (1) offsets of future grant disbursements or (2) repayment to the grantee’s line of credit held by HUD. A portion of these amounts, however, may eventually be supported as eligible costs based on grantee submitted documents, and therefore will not be required to be repaid. We confirmed with the OCFO that they were unaware of these potential receivables, and that there exists no procedures or methodology in place to record an appropriate estimate to recognize these amounts so that they can be reflected in the financial statements. An Estimate of Accounts Receivable From OIG Audit Recommendations With Costs That Had Not Been Finalized Was Developed, but More Work Is Needed Follow-up of prior-year audit recommendations determined that HUD had made great strides in developing an appropriate estimate to recognize receivables from OIG audit recommendations with costs that had not been finalized by the management decision date. A methodology was developed to estimate accounts receivable resulting from OIG audit recommendations with disallowed costs that would be recovered. Under this methodology, the anticipated amount owed to HUD was determined to ensure that an appropriate accounts receivable amount was accrued. However, because OCFO did not have any historical information on HUD’s sustained audit receivables, the baseline anticipated recovery rate used in 40 the methodology was based on actual receivables reversed as of August 31, 2013. As of September 30, 2013, OCFO estimated a 64.7 percent anticipated recovery rate, resulting in $57.3 million in estimated accounts receivable. Since the financial statements are presented on a comparative basis, OCFO could not prepare a reasonable estimate for September 30, 2012, in time for inclusion in the fiscal year 2013 financial statements due to the lack of historical information and manual process involved. Consequently, the estimate developed as of September 30, 2013, was omitted from the fiscal year 2013 financial statements. Section 8 Financing Adjustment Factor Receivables Had Errors HUD failed to effectively monitor and account for receivables that were incurred from the FAF-McKinney bond refunding project. This portfolio of receivables was maintained outside of PAS, LOCCS, and HUDCAPS and relied heavily on the use of manual entries to Excel spreadsheets and the general ledger. Our review of this portfolio resulted in the observation of incorrect application of collections received to outstanding FAF receivables or the incorrect classification of collections as overpayments. Our review also noted one FAF receivable that was prepaid in 2010 but HUD failed to liquidate the related FAF receivable from the Excel subledger spreadsheet, reflecting this financial event. GAO Standards for Internal Control in the Federal Government, November 1999, GAO-AIMD-00-21.3.1, states that internal controls and all transactions and other significant events need to be clearly documented and the documentation should be readily available for examination. All documentation and records should be properly managed and maintained. In addition, this standard conveys that internal controls should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations and that it is performed continually and is ingrained in the agency’s operations. It includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. OCFO did not ensure that established internal controls in place were implemented to ensure that the FAF accounts receivable were effectively monitored and thereby accurately and properly presented on the agency’s financial statements. Our audit detected OFCO’s failure to reconcile the amounts due and paid in accordance with the sweeps savings schedule, its reliance on negative confirmations of the FAF receivable balances with the trustees instead of positive confirmations, a lack of monitoring by supervisory personnel, and a lack of segregation of duties, all of which are required and outlined in internal accounting policies. Weaknesses in internal controls, specifically monitoring, allowed for pervasive errors and inconsistencies in accounting treatment to go undetected within the FAF portfolio of receivables, due to a communicated shortfall of resources. Our 41 audit work reflects results as of August 31, 2013 only, as HUD was unable to deliver yearend data to us either not at all – as of this report issuance; or within a timeframe that would allow for a proper assessment of yearend results. We therefore, could not assess the yearend balances reported for the FAF receivables as of September 30, 2013. However, based on deficiencies found during interim internal control and substantive testing, HUD had only limited assurance that the FAF receivables balance of $17.1 million as of September 30, 2013, was accurate and properly presented in the financial statements. As of August 31, 2013, the outstanding balance for FAF receivables was potentially misstated by at least $1.9 million. Conclusion Work is needed to (1) ensure that amounts due from program monitoring findings, sustained audit findings, and repayment agreements are communicated to the accounting center in a timely manner to ensure inclusion in the accounting records and (2) prepare a reasonable estimate of accounts receivable from program monitoring findings with costs to be repaid to HUD and OIG audit recommendations with costs that have not been finalized. To ensure that HUD’s financial statements present accurate accounts receivable balances, OCFO needs to fully implement prior-year recommendations 29 requiring the development of comprehensive procedures to ensure that amounts from program monitoring findings, repayment agreements, and other binding documents are communicated to the accounting center. Additionally, OCFO needs to continue collecting data necessary to perform an estimate of accounts receivable from OIG audit recommendations with costs not finalized and ensure that this data is recognized on the financial statements comparatively. Lastly, OCFO needs to enforce already existing internal control procedures in place for the FAF receivable portfolio to ensure proper and accurate accounting. Recommendations We recommend that the Acting Chief Financial Officer 6A. Collect all data necessary to perform an estimate of accounts receivable from OIG audit recommendations with costs not finalized by the management decision date and ensure that the data are recognized on HUD’s financial statements comparatively going forward. 6B. Develop and implement a methodology for identifying and estimating potential account receivables due to HUD arising from program monitoring findings and ensure they are recognized on the financial statements. 29 See the Follow-up of Prior Year Audits section of this report. 42 6C. Enforce already existing internal control procedures to ensure proper supervision over accounting for Section 8 FAF receivables. We recommend that the Acting Chief Financial Officer, in conjunction with the Assistant Secretary for the Office of Housing, 6D. Perform a thorough analysis of outstanding FAF receivables and fiscal year 2013 collections to ensure that the receivables accurately represent the amounts owed to HUD, including but not limited to positive confirmations of outstanding receivable balances with the trustees. 43 Finding 7: Weaknesses in HUD’s Administrative Control of Funds System Continued HUD did not have a fully implemented and complete administrative control of funds system that provided oversight of both obligations and disbursements. Our review noted instances where disbursements were made before the point of obligation documented in the funds control plan, program codes that were not included in funds control plans, and funds control plans that were out of date or did not reflect the controls and procedures in place. These conditions existed because of decisions made by HUD OCFO, failures by HUD’s allotment holders to update their funds control plans, a lack of compliance reviews in prior years, and timing issues related to the issuance of obligating documents. As a result, HUD could not ensure that its obligations and disbursements were within authorized budget limits and complied with the Antideficiency Act (ADA). We have reported on HUD’s administrative control of funds in our audit reports and management letters since fiscal year 2005, and several prior-year recommendations remained unimplemented. Disbursements Were Made Before the Documented Point of Obligation To determine the effectiveness of HUD’s administrative control of funds system we reviewed a statistically selected sample of HUD’s obligations incurred and disbursements. Our review of disbursements at HUD’s Financial Management Center noted 70 disbursements, totaling $570 million, that occurred before the legal point of obligation documented in the applicable funds control plan. The disbursements were made for payments under HUD’s Section 8 tenant-based programs. Statistically projecting these sample results to the fiscal year 2013 disbursements for these programs, we can be 95 percent confident that at least $5.6 billion in disbursements were processed prior to the point of obligation. According to the approved funds control plans for the Section 8 programs the point of legal obligation is the generation and signing of the Public Housing Authority (PHA) Notification Letter. However, obligations are recorded in HUDCAPS before the Notification Letters are generated, and once obligations are recorded in HUDCAPS disbursements can be made. Financial Management Center staff informed us that the disbursements were made before the point of obligation because of delays in approving either the allotments or the distributions to the PHAs. Due to the delays, the Financial Management Center did not have time to generate and mail the PHA notification letters before the disbursement due dates. Rather than delay the payments to the PHA’s, the Financial Management Center processed the disbursements before generating the PHA Notification Letters. 44 There were controls in place to ensure that disbursements were not made before funds were available. Specifically, HUDCAPS verified the availability of funds when the funds were both initially committed and again when they were obligated. Additionally, HUDCAPS does not allow a disbursement to be processed unless funds had been obligated in the system. As a result of the controls and processes in place, there was no risk of an Anti-Defiency Act violation, however, to ensure proper internal controls, obligations should not be recorded in HUD’s financial systems prior to the point of legal obligation. All HUD Programs Were Not Included in a Funds Control Plan HUD uses funds control plans to describe and document its administrative control of funds. Our review of HUD’s funds control plans found that all of HUD’s activities and program codes were not included in a plan. Specifically, we identified 139 program codes that were not documented in a funds control plan. HUD’s program codes are used to identify funds obligated and expended for specific programs and activities in its financial systems. During fiscal year 2013, expenditures of $3.2 billion were made from these program codes. This condition existed as a result of several factors. First, in the past, HUD decided not to create funds control plans for programs or accounts that were only expending funds and not incurring new obligations. However, OMB Circular A- 11, Section 150, Administrative Control of Funds, states that the purpose of an agency’s funds control system is to restrict both obligations and expenditures from each appropriation of fund account to the lower of the amount apportioned by OMB or the amount available for obligation or expenditure in the appropriation or fund account. Additionally, HUD Handbook 1830.2, REV-5, Administrative Control of Funds: Policies and Procedures, states that proper execution of a funds control plan should provide reasonable assurance that obligations and expenditures will not exceed the authorized limits of the allotted funds. Second, staff in HUD OCFO stated that the funds control plans were at the TAFS level and that they would not contain all program codes. However, HUD Handbook 1830.2, REV-5, Appendix 9, Form and Content of Funds Control Plans, states that funds control plans must contain detailed information for the program line item or other activity included in the allotment, broken down to the lowest level of any corresponding assignment of funds, and list the hierarchy of accounting codes associated with each funded activity covered in the allotment to show how funded activities are controlled and rolled up to the allotment level as a required element of a funds control plan. The Federal Managers’ Financial Integrity Act of 1982 (FMFIA) states that internal accounting and administrative controls of each executive agency must be established in accordance with standards prescribed by the Comptroller General 45 and must provide assurance that obligations and costs comply with applicable law. As a result of the lack of funds control plans for all activities and program codes, HUD did not have documented internal controls over the obligation and disbursement of all of its funds and, thus, could not monitor the internal controls to ensure that they functioned effectively. Funds Control Plans Were Not Kept Up to Date All of HUD’s funds control plans were not updated in a timely manner. Specifically, we noted the following: • 30 of 33 salaries and expenses funds control plans were not updated to reflect the implementation of the HUD Integrated Acquisition Management System (HIAMS) that occurred during fiscal year 2012. • The salaries and expenses funds control plans did not reflect the December 2012 rescission of forms HUD-718, Funds Reservation and Contract Authority, and HUD-720, Requests for Contract Services, formerly used to request contract actions through HUD’s Office of the Chief Procurement Officer. • The funds control plan for OCHCO had not been updated since its reorganization and renaming from the Office of Administration in 2009, thus the plan referenced divisions and offices no longer in existence. As of the end of fiscal year 2013, OCHCO was in the process of revising their funds control plan. • 78 of 187 funds control plans were not recertified for fiscal year 2013. 70 of the 78 plans were not recertified for fiscal year 2013 because they were under revision. • One funds control plan had an out-of-date allotment holder. These conditions existed because HUD’s allotment holders did not update their funds control plans or notify the Chief Financial Officer in a timely manner after changes occurred. HUD Handbook 1820.2, REV-5, states that an allotment holder must immediately advise the Chief Financial Officer of any changes to its funds control plan during the fiscal year. Administrative changes to the funds control plans must be communicated in writing, including the precise timing of any changes to the persons or positions authorized to initiate, approve, and process actions that commit, obligate, or expend funds. Another factor leading to the out-of-date funds control plans was OCFO’s lack of oversight and monitoring of the program offices’ compliance with their funds control plans in prior years. The CFO Act of 1990 states that the responsibilities of an agency Chief Financial Officer include directing, managing, and providing policy guidance and oversight of all agency financial management personnel, activities, and operations. Because of the lack of oversight and monitoring, OCFO was not aware that changes within the program offices were going 46 unreported and, thus, could not correct the behavior. During fiscal year 2013, OCFO’s Funds Control Assurance Division began performing reviews of program office compliance with the funds control plans. The reviews will be performed over a 5-year cycle, meaning that 20 percent of the funds control plans will be reviewed each year. The Section 184 Funds Control Plans Did Not Reflect the Actual Controls and Procedures in Use Under the Credit Reform Act of 1990, the Section 184 Indian Home Loan Guarantee Program is accounted for using both a program account and financing account. The funds control plans for both accounts were inconsistent with the actual procedures in use. Specifically, form HUD-53037, Section 184 Loan Guarantee Firm Commitment Form, was no longer in use. The funds control plan for the Section 184 program account cited the point of commitment and obligation as the signing and dating of the HUD-53037 by the program director. Instead of the HUD-53037, the program office provided lenders with an unofficial firm commitment form produced by the Computerized Homes Underwriting Management System. The funds control plan for the financing account cites the point of commitment as the “fully signed execution and recording of the obligated HUD-53037.” Instead, funds were committed in the financing account when a lender’s claim was received by the program office. This condition existed because the funds control plans were not updated by the allotment holder when new procedures were developed as required by HUD Handbook 1830.2. The new procedures were developed and implemented in response to an increase in the volume of loan guarantees issued under the Section 184 program. In the last 10 years, $3.5 billion in loan guarantees were issued, compared with $190 million during the first 10 years of the program. As a result of having funds control plans that were inconsistent with their procedures, HUD could not effectively monitor the controls in place and ensure that obligations and expenditures did not exceed authorized limits. In addition to the inconsistencies related to form HUD-53037, our review identified inconsistencies related to the verification of the availability of funds. The funds control plans for both the program and financing accounts stated that the availability of funds would be verified with OCFO before funds were obligated. However, our review noted that the availability of funds was not verified either with OCFO or within the accounting system, HUDCAPS, before obligations were executed by program staff. This condition occurred because PIH’s budget office did not ensure that program staff was properly trained and made aware of its responsibilities for verifying that funds were available before executing obligations. Verifying the availability of funds is an internal control designed to ensure that obligations and expenditures do not exceed authorized 47 limits. When the verification is not performed, the risk of incurring obligations greater than authorized limits and violating ADA requirements increases. Conclusion HUD did not have a fully implemented and complete administrative control of funds system during fiscal year 2013. As a result, it did not have adequate assurance that its obligations and disbursements complied with applicable laws and limitations. HUD’s ability to determine the responsible parties in the event of an ADA violation was also hindered as a result of its incomplete funds control system. In addition, processing disbursements before the documented point of legal obligation may lead to ADA violations. Recommendations We recommend that the Assistant Secretary for the Office of Public and Indian Housing 7A. Review the funds approval and obligation processes for the Section 8 tenant-based programs to identify and correct any delays, to allow adequate time for the processing of PHA notification letters before payment due dates. 7B. Work with the Office of the Chief Financial Officer to review the Section 8 tenant-based programs’ funds control plans and ensure that the proper point of obligation is documented. 7C. Review the procedures in use for the Section 184 Indian Housing Loan Guarantee Program to ensure that they provide assurance that obligations and expenditures do not exceed limitations and update the funds control plans accordingly. 48 Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations Deficiencies in HUD’s processes for monitoring its unliquidated obligations and deobligating balances tied to invalid obligations continued to exist. Specifically, we identified $125.9 million in invalid obligations previously not identified by HUD and $43 million in obligations that HUD determined needed to be closed out and deobligated during the fiscal year that remained on the books as of September 30, 2013. These deficiencies were attributed to ineffective monitoring efforts and the inability to promptly process contract closeouts. As a result, HUD’s unpaid obligation balances were potentially overstated by $168.9 million. Additionally, HUD lacked an established process to reconcile the subsidiary and general ledger obligation controlling accounts, causing differences to not be identified on a timely basis or at all, resulting in balances within the general ledger that were at risk of being unsupported or incomplete. Homeless Obligations Were Not Closed in Accordance With Funds Control Plans Expired Shelter Plus Care and Supportive Housing Program grants were not closed within the 90-day period after the expiration date as required by the programs’ funds control plans. The Office of Special Needs Assistance Programs (SNAPS) was occupied with implementing a new program, running two competitions, and deobligating contracts that expired before June 30, 2012. Therefore, SNAPS did not finalize or implement policies and procedures to ensure that expiring contracts were closed within the 90-day period. The expired grants with an available balance report as of September 30, 2013, showed that approximately 1,855 contracts, which expired between July 1, 2012, and June 30, 2013, were not closed within the 90-day period and the remaining undisbursed obligation balances of approximately $50.9 million were not recaptured. The expired grants with an available balance report also showed that approximately 3,400 expired contracts and $97.8 million in unexpended balances reported during the fiscal year 2010 audit 30 had decreased to 31 contracts and $1.5 million, the 1,400 expired contracts with $32 million in unexpended balances reported during the fiscal year 2011 audit 31 had decreased to 293 contracts and $7.3 million, and the 1,800 expired contracts with $50.6 million in unexpended balances reported during the fiscal year 2012 32 had decreased to 860 contracts and 30 Audit report number 2011-FO-0003, “Additional Details To Supplement Our Report on HUD’s Fiscal Years 2010 and 2009 Financial Statements,” issued November 15, 2010 31 Audit report number 2012-FO-0003, “Additional Details To Supplement Our Report on HUD’s Fiscal Years 2011 and 2010 Financial Statements,” issued November 15, 2011 32 Audit report number 2013-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and 2011 Financial Statements, issued November 15, 2012 49 $22.4 million. These decreases reflect the phases 1 and 2 efforts of a Closeout Taskforce established during fiscal year 2013 to assist with closing expired grants and resolving outstanding OIG audit findings. However, the approximately 1,855 contracts with undisbursed obligation balances of approximately $50.9 million that expired during fiscal year 2013 were not closed, and the funds were not recaptured. In response to OIG findings from the fiscal year 2010 audit, internal control policies to review and close out expired contracts and monitor expiring contracts were drafted; however, they were not finalized or implemented 33 due to competing priorities, such as the implementation of a new program authorized by the Homeless Emergency Assistance and Rapid Transition to Housing Act of 2009. When SNAPS implemented the new program, it also updated and published the Homeless Emergency Assistance and Rapid Transition to Housing: Continuum of Care Program Interim Rule. In an effort to expedite the closeout process and assist HUD in obtaining the information needed to complete the closeout process, the Interim Rule specifies that for grantees seeking renewal, the failure of grantees to submit final performance reports or other required reports to HUD within 90 days may cause the grantee’s renewal funds to be withdrawn and repayment of grant funds expended on the renewal grant. Receipt of these reports is necessary for HUD to complete the grant closeout process so it can recapture the unused grant funds. While these stipulations are effective going forward, beginning with the second competition that SNAPS ran during fiscal year 2013, they do not apply to the 1,855 contracts with undisbursed obligation balances of approximately $50.9 million that expired between July 1, 2012, and June 30, 2013, and were not closed within the 90-day period. Invalid Obligations Were Not Deobligated by September 30 Each year, OCFO coordinates a review of HUD’s unliquidated obligations. For this review, OCFO establishes thresholds to ensure that at least 95 percent of HUD’s obligations are reviewed. For fiscal year 2013, program obligations exceeding $243,000 and administrative obligations exceeding $23,000 were required to be reviewed. During the fiscal year 2013 review, 1,938 obligations with remaining balances totaling $77 million were marked for deobligation. By September 30, 2013, HUD had deobligated 1,238 of these obligations, leaving 700 invalid obligations on HUD’s books with remaining balances totaling $43 million. While the deobligated actions accounted for 64 percent of the invalid obligations. HUD’s inability to process all of the closeouts and deobligations by the end of the fiscal 33 See the Follow-up of Prior Year Audits section of this report, item 8.b (2012-FO-0003-002-C). 50 year can be attributed to the following factors. First, HUD did not effectively review and close out contracts throughout the year; therefore, the program offices marked a large number of obligations for deobligation during the annual review. Second, HUD placed a higher priority on processing new awards and obligations than processing closeouts and deobligations. Therefore, HUD was unable to process all of the necessary contract closeouts and deobligations before the end of the fiscal year on top of its regular workload. All 700 obligations remaining on HUD’s books at yearend had not been forwarded from the program offices to the appropriate office, either to OCPO for administrative obligations or OCFO for program obligations, for closeout and deobligation. As a result, HUD’s unliquidated obligation balances were overstated by $43 million. HUD had initiated the process of closing these obligations, and the associated funding should be recaptured during fiscal year 2014. HUD’s Administrative Obligations Were Not Effectively Monitored HUD’s administrative obligations are a result of contracts entered into for the goods and services necessary to operate, such as employee training, printing services, subscriptions, information technology (IT) support, and other service contracts. HUD did not effectively monitor these obligations to determine that a bona fide need still existed and the obligations were still valid. Our review identified 2,103 administrative obligations with remaining balances totaling $22.4 million with no activity since fiscal year 2011. Of these, 302 with remaining balances totaling $1.0 million were tied to funds that were canceled on September 30, 2013. Through a review of HUD’s funds control plans, we noted that several of HUD’s program offices relied on the OCFO-coordinated unliquidated obligations review to monitor their administrative obligations. Administrative obligations that fell under $23,000 were not required to be reviewed during the fiscal year 2013 review. Of the obligations we identified as inactive, 1,384 were under the $23,000 threshold and not reviewed. Additionally, since the OCFO-coordinated review was performed annually, any obligations that become invalid during the period between the end of the review and the end of the fiscal year would not be identified until the following fiscal year. As a result, HUD’s September 30, 2013, obligation balances were potentially overstated by $21.4 million. Additionally, because most of HUD’s administrative obligations are made using annual appropriations, by not periodically reviewing their validity throughout the fiscal year, HUD may lose the opportunity to use funds tied to obligations that become invalid during the year. 51 Inactive and Expired Section 202 and 811 Obligations Were Not Identified HUD’s Sections 202 and 811 programs provide affordable housing and supportive services for the elderly and persons with disabilities. Generally, funds appropriated for Section 202 and 811 programs are available for obligation for 3 years. After 3 years, the funds expire and are not available for obligation, necessitating the need to track funds obligated under these programs. During fiscal year 2013, HUD did not adequately monitor and deobligate unliquidated balances from expired and inactive Section 202 and 811 obligations. We reviewed the subsidiary ledger supporting the unliquidated obligations to determine whether the reported obligations were valid and whether any invalid obligations had been canceled and deobligated. Our review identified $9.3 million tied to 115 obligations that had either expired or were no longer needed. HUD initiated the closeout of these obligations, and the associated balances should be recaptured during fiscal year 2014. Other Inactive Housing Program Obligations Were Identified We reviewed the subsidiary ledgers supporting the obligation balances in TAFS 0303 and 0319 to determine whether the reported balances were valid. These TAFS mainly contained funds used for Section 8 project-based obligations; however, they also contained funds for several small grant and other assistance programs. Within these small programs, our review identified 215 expired or inactive obligations with remaining balances totaling $26 million. This condition can be attributed to a lack of effective monitoring due to these small programs’ no longer receiving appropriations and HUD’s focus on its larger obligation balances. As a result, HUD’s unliquidated obligation balances were potentially overstated by $26 million. Remaining Operating Subsidy Funds Were Not Deobligated or Recaptured in a Timely Manner HUD’s operating subsidy funds are appropriated for payments to PHAs for the operation and management of public housing in the year in which they are appropriated. Operating subsidy funding is allocated using a preliminary determination of eligibility before the start of the funding year. The preliminary determination uses a formula and information from the prior year to determine funding levels; however, HUD also performs a final allocation, which includes changes to the initial estimates that occurred during the year. When actual 52 eligibility is determined, PHAs are no longer eligible for preliminary amounts above the final allocation, however; HUD did not recapture this difference in a timely manner. We identified $11 million, tied to 212 operating subsidy funding lines in fund 0163, that had been inactive for more than 1 year. After contacting field offices responsible for a sample of these obligations, we believe these amounts represented the differences between the estimated and actual amounts and were, therefore, invalid obligations. Instead of immediately recapturing funds from PHAs that were overfunded, HUD offsets future funding and notes that a recapture is required when PHA funding is insufficient to cover the offset. However, HUD’s Financial Management Division did not recapture the funding noted for recapture until the 5-year obligation period ended. As an alternative, the Division notified the responsible field offices and asked them to place the funds into a locked line item in LOCCS so that they could not be drawn down. These funds would sit in LOCCS and on the unpaid obligation balance until the end of the 5-year obligation period, when they would be deobligated by the Division. GAO guidance and OCFO Handbook 1830.2 dictate that when using an estimate, appropriate adjustments must be made when events permit a more accurate estimate. GAO guidance also states that to be a valid obligation, the funds must be “legally available for a given expenditure.” When actual eligibility is determined, HUD should immediately recapture the funds, which would properly adjust the unpaid obligation balance to include only funds that are available to PHAs. Operating subsidy funds are subject to the annual open obligation review coordinated by OCFO. Regarding the annual review of unliquidated obligations, OCFO Handbook 1830.2 states, “Particular attention must be given to unliquidated obligations whose status has not changed for six months or more, to ensure that they are still valid outstanding obligations.” However, during the annual departmentwide unliquidated obligations review, field offices were instructed to look only at obligations that were nearing their expiration date, not obligations that had no recent activity or that were unavailable to the PHA. Consequently, field offices may be aware that these funds are no longer available to the PHA but do not report them for recapture. Since these obligations were no longer available to PHAs, HUD’s unliquidated obligation balance on the consolidated financial statements was potentially overstated by $11 million. In addition to the overstated balance, when funds sit around, they become susceptible to fraud, waste, and abuse. While field offices were instructed to lock these funds in LOCCS, there was no assurance that field offices locked the funds so they could not be drawn down. 53 Unavailable Balances on CPD ARRA Grants Were Not Recaptured As of September 30, 2013, $4.7 million in CPD’s American Recovery and Reinvestment Act (ARRA) grant program Community Development Block Grant- Recovery (CDBG-R) and $2.6 million in unspent funds for the Homelessness Prevention and Rapid Re-Housing Program (HPRP) grant program were not reclaimed by HUD in accordance with Memorandum M-11-43 and returned to Treasury in accordance with the Dodd-Frank Wall Street Reform and Consumer Protection Act. These unspent funds are no longer available to the program grantees. Contracts for all of the grants were not closed out, and the necessary deobligation forms were not sent to OCFO to process the recapture. In addition, OCFO’s manual process to ensure that ARRA funds that were unspent as of September 30, 2013, were recaptured and returned to Treasury was not fully implemented. In accordance with ARRA, HUD imposed an expenditure deadline for CDBG-R grantees of September 30, 2012. ARRA required HPRP grantees to expend 100 percent of their grant funds within 3 years after the date HUD signed the grant agreement. HPRP’s last grant was obligated on September 29, 2009, making September 28, 2012, the latest date for grantee expenditure. However, HPRP grantees had up to 90 days after the 3-year expenditure deadline to draw down funds to pay eligible HPRP costs incurred during the 3-year grant period, or December 28, 2012. After the 90-day period, no further funds could be drawn down. Approximately 1 year after the expenditure deadlines, $4.7 million in unspent funds for CDBG-R and $2.6 million for HPRP remained. CPD established grant closeout procedures for the CDBG-R and HPRP programs. The procedures generally required the grantee to complete some administrative actions and submit a grant closeout agreement certification with the final unspent grant fund balance. Upon CPD’s receipt, review, and signature, the grant closeout agreement certification was to be forwarded to OCFO to process the recapture. Not all ARRA grants had completed this closeout process; therefore, the grant closeout agreement certifications were not obtained or submitted to OCFO. While the grant closeout procedures established by CPD would have led to each individual grant’s unspent funds being recaptured, OCFO also determined a mechanism to recapture any remaining unspent balances for the ARRA grants, as of September 30, 2013, regardless of the status of the grant closeout procedures by the program office. However, the manual process identified was not completed, leaving the approximately $7.3 million in unspent funds for CDBG-R and HPRP programs not reclaimed by HUD and returned to Treasury. 54 The Subsidiary Ledgers Were Not Reconciled to the Obligation Balances in the General Ledger for all of HUD’s Open Appropriation Accounts HUD’s obligation controlling accounts were not reconciled to the supporting records for HUD’s open appropriation accounts. This condition was due to management lacking a process to ensure that a periodic reconciliation between the subsidiary ledgers and the general ledger took place. Reconciliations were performed only when requested by OIG during routine audit procedures. As a result, differences that existed between the two ledgers were not identified and resolved in a timely manner. Further, incorrect or unsupported balances were at risk of being transferred to the new accounting system. 34 The Accounting Monitoring and Analysis Division within OCFO did not have a reconciliation process that included verifying that HUD’s monthly, quarterly, and annual obligation reports to Treasury and OMB agreed with HUD’s obligation control accounts for each open appropriation account as required by GAO Title 7, chapter 3.7. Reconciliations were performed only for certain appropriation accounts when requested by OIG for review. However, OIG’s review of those reconciliations noted several deficiencies: (1) reconciliations were performed inconsistently; (2) all appropriate general ledger accounts were not always included in the reconciliation; (3) supporting files did not agree with the reconciliation; (4) the review process was inadequate, at times lacking evidence; (5) reconciliations were not completed in a timely manner, requiring extensive research and data manipulation to complete the task; and (6) millions of dollars in differences among the systems were identified, which could not be explained or reconciled or required extensive research to determine the cause of the difference. Our review of the reconciliations performed identified the following differences as of September 30, 2013: Table 1 Program Appropriation Differences Housing Choice Voucher 0302 $73.8 million Program Homeless Assistance 0192 29.2 million CDBG 0162 $2.8 million Total $105.8 million 34 See further discussion regarding the interagency agreement with BPD to obtain full Federal shared services, including a financial management application in Finding 3: Weaknesses in Financial Management Systems Continued To Challenge HUD. 55 Policies and procedures were not in place to ensure that all undelivered orders were periodically reconciled between the subsidiary ledgers and the general ledger for each open appropriation account and that the reconciliations were formally reviewed. In addition, subsidiary and general ledger system reports were not available as of the period end dates and, therefore, required substantial data manipulation to arrive at the balance as of the period end date. In response to a similar finding reported in a prior year management letter, the Accounting Monitoring and Analysis Division planned to hire a contractor and work with the OCFO Systems Division to determine the appropriate system reports needed to complete the reconciliations and create and document reconciliation policies and procedures. However, due to budget and staffing limitations, no action was taken. Additionally, management decided that since HUD was planning to implement a new accounting system, it would be in its best interest to wait until after the implementation of the new accounting system to create the procedures. Without formal procedures to require the completion of periodic reconciliations, the differences between the subsidiary and general ledger systems may not have been identified. When differences are not identified in a timely manner, the number of transactions and time and research needed to reconcile the differences increases. Conclusion HUD’s processes for (1) monitoring the validity and need for its unliquidated obligations and (2) timely closeout of expired grants, continued to not be fully effective during fiscal year 2013. As a result, we identified $125.9 million tied to expired or inactive obligations, or grants that had not completed the closeout process. Additionally, HUD did not close out all of the obligations identified as invalid by the end of the fiscal year, resulting in $43 million in invalid obligations remaining on HUD’s books at yearend. . In total, HUD’s unliquidated obligation balance on the statement of budgetary resources was potentially overstated by $168.9 million. HUD’s lack of an established process in place to reconcile the subsidiary and general ledger systems caused differences between obligations controlling accounts and supporting records to not be identified on a timely basis if at all, leaving unsupported or incomplete balances in the general ledger, which were at risk of being transferred to the new accounting system. 56 Recommendations We recommend that the Assistant Secretary for the Office of Community Planning and Development 8A. Review the status of these 1,855 expired contracts, which make up the $50.9 million; close out the contracts; and recapture the excess funds. 8B. Complete the closeout of any remaining CDBG-R and HPRP grants and forward all grant closeout agreement certifications to OCFO for recapture. 8C. Deobligate $14,425,629 tied to 238 program obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, OCFO should review the 93 obligations with remaining balances totaling $316,935 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Assistant Secretary for the Office of Housing 8D. Deobligate $12,755,325 tied to 165 administrative obligations and $2,734,967 tied to 25 program obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, the Office of Housing should review the 429 obligations with remaining balances totaling $5,764,905 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. 8E. Research and deobligate at least $9.3 million tied to the 115 inactive and/or expired Section 202/811 funding lines. 8F. Review and deobligate at least $26 million tied to 215 inactive and/or expired Section 8 obligations. We recommend that the Assistant Secretary for the Office of Public and Indian Housing 8G. Deobligate $5,555 tied to 17 administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, the Office of Public Housing should review the 299 obligations with remaining balances totaling $1,331,460 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. 57 8H. Review and, if necessary, recapture all 212 operating subsidy (0163) funding lines with remaining balances totaling $11 million. 8I. Develop formal procedures to annually determine which PHAs require a recapture based on operating subsidy actual allocation figures and recapture the funds immediately. We recommend that the Chief Human Capital Officer 8J. Deobligate the $2,483,254 tied to 12 administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, OCHCO should review the 730 obligations with remaining balances totaling $10,227,309 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Acting Chief Financial Officer 8K. Deobligate the $1,419 tied to three administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, OCFO should review the 42 obligations with remaining balances totaling $3,115,954 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501 8L. Issue a memorandum to the program offices, instructing them to actively monitor their administrative funds and deobligate funds tied to unneeded or inactive obligations, or obligations for which performance is complete (goods or services have been delivered). 8M. Design and implement a policy to ensure that reconciliations between the subsidiary ledgers (supporting records) and the obligation balances in the general ledger (controlling accounts) are periodically performed for all HUD appropriations. The policy should also address the follow-up and clearance of identified differences and the responsibilities for the preparers and reviewers. 8N. Work with the program offices to determine the ARRA funds that were not spent by September 30, 2013; implement the manual process identified; and recapture, to the extent permitted by law, the unspent ARRA funds and return them to Treasury, including at least $4.7 million and $2.6 million in unspent grant funds for the CDBG-R and HPRP programs, respectively 58 We recommend that the Chief Information Officer 8O. Deobligate $7,263,662 tied to 178 administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. We recommend that the Director of the Office of Departmental Equal Employment Opportunity 8P. Deobligate $2,244 tied to 10 administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, the Office should review the 10 obligations with remaining balances totaling $83,300 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that HUD’s General Counsel 8Q. Deobligate $71,274 tied to five administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. We recommend that the Office of Departmental Operations and Coordination 8R. Deobligate $12,277 tied to 19 administrative obligations marked for deobligation during the departmentwide unliquidated obligations review. Additionally, the Office should review the seven obligations with remaining balances totaling $76,327 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. § 1501. We recommend that the Acting Director for the Office of Sustainable Housing and Communities 8S. Deobligate $6,220 tied to 4 administrative obligations marked for deobligation during the Department wide Unliquidated Obligations Review. Additionally, review the 3 obligations with remaining balances totaling $4,464 and close-out and deobligate amounts tied to obligations that are no longer valid either based on the criteria defining the availability of appropriations at 31 U.S.C § 1301 or the criteria for recording obligations at 31 U.S.C § 1501. We recommend that the Director of the Office of Healthy Homes and Lead Hazard Control 59 8T. Deobligate $3,488,009 tied to 23 program obligations marked for deobligation during the Department wide Unliquidated Obligations Review. We recommend that the Assistant Secretary of the Office of Fair Housing and Equal Opportunity 8U. Review the 52 obligations with remaining balances totaling $145,060 and closeout and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Chief Procurement Officer 8V. Review the 14 obligations with remaining balances totaling $26,829 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Assistant Secretary for the Office of Field Policy and Management 8W. Review the 30 obligations with remaining balances totaling $11,420 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Assistant Secretary for the Office of Policy Development and Research 8X. Review the 44 obligations with remaining balances totaling $166,083 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. We recommend that the Office of the Secretary 8Y. Review the 41 obligations with remaining balances totaling $132,080 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. 60 We recommend that the Director of the Office of Strategic Planning and Management 8Z. Review the seven obligations with remaining balances totaling $7,391 and close out and deobligate amounts tied to obligations that are no longer valid, either based on the criteria defining the availability of appropriations at 31 U.S.C. 1301 or the criteria for recording obligations at 31 U.S.C. 1501. 61 Finding 9: HUD’s Financial Management Governance Structure and Internal Controls Over Financial Reporting Were Ineffective HUD did not have a fully implemented and effective financial management governance structure or system of internal controls over financial reporting. This condition stemmed from HUD’s inadequate implementation of the CFO Act of 1990. Specifically, HUD’s financial management structure did not have permanent staff in critical financial management positions and relied on the delegation of key financial management functions without providing adequate policy and oversight. Additionally, as we have reported in prior-year audits, HUD did not have reliable financial information for reporting, did not have integrated financial management systems, and had not implemented a compliant core financial system. As a result, multiple deficiencies existed in HUD’s internal controls over financial reporting, resulting in misstatements and instances of noncompliance with laws and regulations. HUD Lacked an Adequate Tone at the Top for Financial Management The effectiveness of HUD’s financial management governance structure, which was responsible for administering $57.6 billion in appropriations for fiscal year 2013, was compromised by long-term vacancies in key executive positions. Specifically, HUD had not had an appointed Chief Financial Officer since August 2011. The CFO Act states that the responsibilities of a Chief Financial Officer include • Developing and maintaining integrated accounting and financial management systems; • Directing, managing, and providing policy guidance and oversight of all agency financial management personnel, activities, and operations; • Approving and managing financial management systems design and enhancement projects; • Developing budgets for financial management operations and improvements; • Overseeing the recruitment, selection, and training of personnel to carry out agency financial management functions; • Implementing agency asset management systems, including systems for cash management, debt collection, and property inventory management and control; and • Monitoring the financial execution of the agency budget in relation to actual expenditures. 62 In addition, during fiscal year 2013, HUD experienced turnover and vacancies in its Assistant Chief Financial Officer positions in all four divisions within OCFO. As of the date of this report, three of the four positions had not been permanently filled. In addition to the vacancies within OCFO, HUD lacked a Senior Management Council and Senior Assessment Team or equivalent committees responsible for (1) assessing and monitoring deficiencies in internal control resulting from the FMFIA assessment process, (2) advising the HUD Secretary of the status of corrections to existing material weaknesses, and (3) apprising the Secretary of any new material weaknesses that may need to be reported to the President and Congress through the Annual Financial Report. While establishment of a Senior Management Council and Senior Assessment Team is not required by OMB Circular A-123, Management’s Responsibility for Internal Control, it is recommended. According to OMB Circular A-123, the Chief Financial Officer should be a member of the Senior Management Council, and the Senior Assessment Team should report to the Chief Financial Officer. The Senior Assessment Team provides oversight and accountability for the agency’s internal controls over financial reporting and should include executives from areas responsible for maintaining controls over key processes and systems. Without permanent executive leadership within OCFO and an appropriate focus on internal controls, HUD had difficulties fully implementing the CFO Act and creating an effective financial management governance structure and system of internal controls over financial reporting. While these vacancies were not the sole cause of the deficiencies in the structure of HUD’s OCFO and financial management systems, HUD’s ability to identify and make significant changes was impaired. In turn, the governance structure and application-based deficiencies led to four material weaknesses and eight significant deficiencies, including three departures from GAAP that are reported in this report. 35 Stronger Direction and Involvement With Program Accounting Is Needed From OCFO HUD’s Chief Financial Officer did not always provide policy guidance and oversight for all agency financial management personnel, activities, and operations as required by the CFO Act. OCFO lacked dedicated positions or divisions to (1) monitor the issuance of accounting standards and guidance from entities such as the Federal Accounting Standards Advisory Board (FASAB), OMB, and Treasury; (2) determine their impact on HUD and prepare and issue new or updated accounting and financial management policies if necessary; and (3) interpret and oversee the program offices’ accounting and financial management policies and determine whether they comply with GAAP and other 35 See findings 1, 2, and 5 in this report. 63 accounting and financial reporting requirements. As a result, HUD did not develop or update its policies and procedures when new or updated accounting standards and guidance were issued and was unaware that it was not compliant with the new and updated standards. Additionally, the lack of Chief Financial Officer oversight of the program offices’ accounting and financial management policies and procedures led to an environment in which program-related needs and concerns were assigned a higher priority than financial management and reporting requirements. Specifically, the lack of a position or division responsible for monitoring the issuance of accounting standards and preparing and issuing new or updated accounting and financial management policies, if necessary, resulted in a material weakness and a significant deficiency, both leading to departures from GAAP. First, OCFO did not identify the need for and develop policies to account for transactions and assets resulting from a congressional requirement 36 to implement Treasury regulations on cash management for the Section 8 Housing Choice Voucher program. As a result, HUD failed to properly account for these transactions, which led to a departure from GAAP. Second, HUD did not have policies and procedures in place to recognize expenses when incurred and accrue related liabilities. As a result, HUD failed to comply with Statement of Federal Financial Accounting Standard (SFFAS) 5: Accounting for Liabilities of the Federal Government, which led to a departure from GAAP. These deficiencies are discussed in detail within this report. 37 Due to the size and nature of HUD, its Chief Financial Officer delegated and relied on the program offices for several core financial management functions, including determining disbursement methodology for CPD’s formula grants; the administrative control of funds; and in the case of Ginnie Mae, financial reporting. The lack of adequate Chief Financial Officer oversight of these and other delegated functions led to two material weaknesses and three significant deficiencies identified in our audit. The lack of oversight was the result of the OCFO’s not having a position or division with the responsibility for overseeing and coordinating financial management functions handled by the program offices. As a result, program-related needs and concerns were assigned a higher priority than financial management and reporting requirements, such as compliance with GAAP. Specifically, CPD was using the first in, first out (FIFO) method to obligate and disburse funds for its formula grants program. This method disregarded United States Standard General Ledger (USSGL) attributes at the transaction level when making disbursements and created a departure from GAAP. The Chief Financial Officer also failed to adequately oversee the conversion of Ginnie Mae’s financial 36 In the Conference Report on H.R 2112, Consolidated and Further Continuing Appropriations Act, 2012, when addressing the PIH tenant-based rental assistance program, Congress stated, “The conferees expect HUD to follow Treasury’s rules on cash management in this account.” 37 See findings 2 and 5 in this report. 64 statements from commercial GAAP to Federal GAAP when consolidating the financial statements for HUD. Deficiencies in the conversion process led to a material weakness. Inadequate oversight and monitoring of agency financial management functions also led to significant deficiencies in HUD’s reporting of accounts receivable, its administrative control of funds system, and processes for reviewing obligations and deobligating funds that were no longer needed. These deficiencies are discussed in detail elsewhere within this report. 38 Integrated Accounting and Financial Management Systems Were Not Implemented and Maintained The CFO Act states that the responsibilities of an agency Chief Financial Officer include developing and maintaining integrated accounting and financial management systems and implementing agency asset management systems, including systems for cash management, debt collection, and property inventory management and control. Ideally, financial management systems should provide complete, reliable, timely, and useful financial management information efficiently and automatically. HUD was not able to develop newer, more efficient systems to replace the multiple legacy financial management systems required to perform core financial system functions. Consequently, the Chief Financial Officer did not maintain integrated accounting and financial management systems or implement agency asset management systems as required by the CFO Act. Specifically, we noted the following: • In fiscal year 2012, OCFO’s efforts to replace its noncompliant core financial management system failed due to poor planning and lack of consideration of components’ functional needs; • OCFO did not ensure that program office feeder systems, such as HIAMS and IDIS Online, were designed to provide compliant financial information; • OCFO did not ensure that adequate systems were in place for credit- granting programs • A cash management system that properly recognized accounts receivable or payable or ensure that assets were properly protected was not implemented; • HUD’s property inventory management and control system support contract lapsed during August 2011, and HUD operated without a functioning inventory management system. Contrary to CFO Act requirements, OCFO did not ensure property management control over accountable assets and was not able to produce auditable depreciation schedules. 38 See findings 1, 4, 6, 7, and 8 in this report. 65 HUD’s inability to complete its core financial system implementation project; implement asset management, cash management, and credit management systems; and ensure feeder system compliance resulted in HUD’s inability to routinely provide reliable financial information consistently, accurately, and uniformly. Conclusion In fiscal year 2013, HUD did not have permanent leadership within OCFO, an effective financial management governance structure within OCFO, adequate policy and guidance over financial management and reporting, compliant information systems, or effective monitoring of financial management activities and operations. The absence of a Chief Financial Officer, permanent Assistant Chief Financial Officers, and a Senior Management Council limited the ability of OCFO to facilitate and stress the importance of financial management and internal controls over financial reporting throughout HUD. Deficiencies in HUD’s implementation of the CFO Act also contributed to this condition. Specifically, OCFO did not provide policy guidance on and oversight of all agency financial management activities and operations, nor did it see to proper implementation of financial and asset management systems. This deficiency created an environment in which program office operational objectives received precedence over financial management and reporting requirements. As a result, we identified multiple significant deficiencies in HUD’s internal controls and a material weakness, including departures from GAAP. Recommendations We recommend that the Deputy Secretary for HUD 9A. Conduct a study on what improvements could be made in HUD OCFO to increase compliance with the CFO Act agency requirements. 9B. After conclusion of the study, issue a directive or memorandum to HUD, reemphasizing the Chief Financial Officer’s authority and responsibility for departmentwide financial management and internal controls over financial reporting and changes in any financial management governance. 9C. Create and chair a Senior Management Council or equivalent to ensure that HUD remains committed to implementing and operating the recommendations made in the study and ensure that an appropriate system of internal controls is in place. We recommend that the Acting Chief Financial Officer 9D. Initiate and complete the selection process to fill vacant Assistant Chief Financial Officer positions. 66 9E. Implement a function to monitor issuances of accounting standards and other related guidance, determine the issuances’ impact on HUD, and develop and issue new or updated policies and procedures as needed. 9F. Ensure that documented policies and procedures are in place for all of HUD’s accounting processes and that they are periodically evaluated for necessary updates. 67 Finding 10: Weaknesses in HUD’s Rental Housing Assistance Program Monitoring Continued HUD needs to improve the monitoring of its more than 2,200 PHAs to ensure that they (1) report accurate financial, compliance, and performance data; (2) comply with statutory objectives; (3) utilize their funds and leasing capacity; and (4) verify tenant data to reasonably ensure correct housing subsidy payments. Although HUD had improved some aspects of its internal controls from previous years, more improvements are needed to ensure that these objectives are met. Consequently, the accuracy of Voucher Management System (VMS) self-reported data was questionable, compliance with Moving To Work program (MTW) statutory requirements could not be determined, PHAs did not fully utilize their funding, and PHAs continued to make significant amounts of improper payments. Financial Data Reported in VMS Were Not Sufficiently Verified To Reasonably Ensure Accuracy VMS collects PHA data that enable HUD to fund, obligate, and disburse voucher funding to PHAs in the Section 8 Housing Choice Voucher program. Since HUD uses VMS data to determine annual funding allocations, calculate quarterly PHA disbursements under the new cash management process, and determine PHA net restricted asset (NRA) excess funds, it is critical that the data it contains be reliable. The 2012 appropriations law also requires VMS data validation; 39 however, we found that the majority of the monitoring reviews and analytical procedures that HUD performed were not adequate to ensure the accuracy of the data. The Financial Management Division and the Financial Management Center performed analytical testing on the VMS data; however, this testing was designed only to identify significant inconsistencies in PHA-reported data. 40 This method did not ensure that PHAs accurately calculated and reported their expenditures; therefore, HUD could not rely on this method to reasonably ensure the validity of VMS data. 39 Public Law 112-55, Division C, Title II, states that the HUD Secretary, for the calendar year 2012 funding cycle, must provide renewal funding for each PHA based on validated VMS leasing and cost data for the prior calendar year. 40 The Financial Management Center and Financial Management Division compare a PHA’s lowest and highest monthly leasing rate and housing assistance expenses during a given period. If the range is greater than a certain threshold, a financial analyst follows up with the PHA. 68 HUD primarily uses Quality Assurance Division reviews to validate VMS data. However; in fiscal year 2013, the Division did not conduct sufficient onsite or remote VMS validation and financial management reviews to adequately achieve this objective. In fiscal year 2013, it reviewed only source documentation to validate VMS data for 59 PHAs, or 2.5 percent of the PHA population, onsite and 170, or 7.3 percent of the PHA population, remotely. The results of these reviews 41 indicate that they directly enhanced the quality of VMS data because they resulted in the identification of large discrepancies that led to significant changes to VMS data. For fiscal year 2013, the Quality Assurance Division found that 25 of 29 PHAs reviewed during onsite VMS validation had housing assistance payment discrepancies that required VMS adjustments of $2.9 million. Further, the Division found that 27 of 30 PHAs reviewed during onsite financial management reviews misreported NRA by a total of $47.6 million and unrestricted net assets by a total of $16.4 million. Finally, of the 170 remote VMS and financial management reviews, The Division found 55 PHAs with discrepancies that required VMS adjustments of $3.6 million. The high number of errors identified through the limited number of reviews completed indicated that VMS data contained a significant number of errors and additional validation is needed. This is essential because VMS is used for several significant funding calculations, such as annual funding allocations, quarterly PHA disbursements, and PHA NRA excess funds. Since VMS data is not adequately validated, PHAs could be holding significant amounts of funds in excess of their immediate disbursing needs and utilizing funds for ineligible expenses, exposing HUD to increased risk of improper payments in addition to making the Section 8 program more susceptible to fraud, waste, and abuse. The Quality Assurance Division Monitoring Reviews Were Not Sufficient To provide timely validation of PHA program and financial information and ensure compliance with voucher program requirements, in 2003, a congressional committee recommended that HUD establish a Quality Assurance Division for the Section 8 Housing Choice Voucher program. Congress believed that by verifying PHA monthly leasing rates and costs, HUD and Congress could improve the monitoring of Section 8 spending and project future budget requirements. However, in fiscal years 2012 and 2013 Quality Assurance Division staff was given only 53 (71 percent) and 47 (63 percent) of the 75 personnel recommended 41 Reviews are considered complete when the corrections have been made in VMS and the review results are uploaded to SharePoint. After the Quality Assurance Division finalizes the review, PHAs are given 30 days to respond to its findings before the results are finalized. Once this process is complete, the Division uploads VMS corrections to SharePoint. For our review, we used VMS correction results posted on the Division’s Web site as of November 6, 2013, for all reviews except financial management reviews, which the Division provided on November 12, 2013. 69 by Congress. 42 Further, the Division was allocated only $455,000 for travel and given only $251,178, which forced it to stop onsite reviews. Additionally, the Division was told to limit its contact with PHAs due to the proration of PHA administrative fees. Consequently, it could review only source documentation to validate VMS financial data for 2.5 percent of the PHA population onsite and 7.3 percent remotely through VMS and financial management reviews. Further, the Division reviewed less than 1 percent of PHAs comprehensively to determine rent reasonableness. Without reviewing source documentation, the reviews provided little assurance that PHAs submitted accurate financial information and complied with Section 8 requirements. The majority (90 percent) of Quality Assurance Division reviews were “RATS” and “Portfolio Rent” reviews, 43 which are conducted remotely and use fewer resources. However, these reviews do not review source documentation and are primarily used to plan further reviews. “RATS” reviews compare only PHA- reported information entered into VMS and FASS-PH. While some of the data in FASS-PH are audited, RATS procedures instruct staff to review the most recent yearend financial statements, regardless of whether they are audited. Since PHAs have 9 months to submit audited statements, it is likely that the Division staff compared VMS PHA submissions to unaudited FASS-PH data, which lacked the independent auditor assurance. Consequently, RATS reviews provided only assurance that PHAs submitted matching data and no assurance that the data were correctly reported in either system. Similarly, rent reasonableness portfolio reviews require the use of fewer resources; however, if the Division identified a possible problem with a PHA’s rent during a portfolio review, the problem may not have been corrected until a future review was conducted, thereby greatly reducing its ability to ensure PHA compliance with Section 8 requirements. More importantly, the Quality Assurance Division did not have a central database for tracking PHA corrective actions and ensuring that its findings were resolved. When QAD reports a finding, other than a VMS correction, the PHA is required to develop a corrective action plan which is reviewed by the Division, but the field office was ultimately responsible for ensuring that findings are resolved. However, field offices were not responsible for reporting the resolution process to the Division; therefore, the Division could not ensure that its findings had been resolved. Since the majority of the Quality Assurance Division’s reviews did not review supporting documentation, the Section 8 Housing Choice Voucher program relied 42 On July 24, 2003, the House of Representatives Congressional Appropriations Committee recommended that HUD establish a Quality Assurance Division with 75 full-time employees for the Section 8 Housing Choice Voucher program to provide more timely validation of PHA program and financial information and ensure compliance with program requirements. The Division had 53 and 47 employees in fiscal years 2012 and 2013, respectively. 43 VMS FASS-PH remote data analysis protocol reviews are referred to as RATS reviews. These reviews accounted for 75 percent of Quality Assurance Division reviews from October 1 to August 15, 2013. Portfolio rent reasonableness remote reviews accounted for 15 percent of the reviews from October 1 to August 15, 2013. 70 heavily on PHA self-reported information. The Division’s impact was further hampered by decreased communication with PHAs and its lack of a central tracking database. This situation was especially problematic because as noted in the sections above, HUD did not have sufficient internal monitoring controls in place to ensure validation of PHA program and financial information. This deficiency further increased HUD’s risk of improper payments and made the Section 8 program more susceptible to fraud, waste, and abuse. Opportunities Exist To Improve the Use of Housing Choice Voucher Program Funds In previous years, we reported that PHAs had not maximized leasing rates or used all of their available resources, which caused excessive accumulations in PHA NRA accounts. However, two rescissions corrected this problem in fiscal year 2013. In March 2013, Congress approved two funding reductions amounting to $975 million for the Housing Choice Voucher program. 44 With less funding, PHAs used up their resources and drew funds from their NRA accounts to cover their costs. Therefore, the NRA balance decreased significantly during fiscal year 2013. 45 Before the effects of the rescissions, PIH implemented the Housing Choice Voucher program Info Path system and 2-year forecasting tool to improve the utilization of program funds and decrease shortfalls. The InfoPath system flags PHAs with potential shortfalls to alert field offices and ensure that they work with the PHA to avoid shortfalls. The 2-year forecasting tool projects program leasing, 46 spending, and funding over a 2-year period to allow field offices to monitor unit and fund utilization. Since funding levels impacted unit utilization, it was difficult to determine the effectiveness of these tools; however, they appeared to increase the communication between the field offices and PHAs, which is essential in reducing shortfalls and increasing utilization. Although HUD was using these new tools, PIH data indicated that as of June 30, 2013, 447 PHAs, or 19 percent of the 2,200 PHAs, had the resources to lease additional units but did not reach their 95 percent utilization goal. Further, as of June 30, 2013, the PIH data showed 457 PHAs, or 19.6 percent, with potential shortfalls with a cash shortage of $96 million. These results are in line with a 44 The fiscal year 2013 third quarter consolidated financial statements listed an across-the-board rescission and sequestration recession totaling $975,528,215. The across-the-board rescission was stated in the Consolidated and Further Continuing Appropriations Act, 2013, Public Law 113-6, issued March 26, 2013. Sequestration cuts were ordered in a presidential order, issued March 1, 2013. The across-the-board rescission Treasury warrant date was May 29, 13, and sequestration rescission Treasury warrant date was August 24, 2013. 45 During fiscal year 2013, the NRA balance decreased by $342,730,540. The estimated NRA ending balances as of September 30, 2012, and June 30, 2013, were $986,303,505 and $643,572,965, respectively. 46 Leasing is considered maximized at 95 percent. 71 recent OIG audit report on the Housing Choice Voucher program, 47 which stated that HUD had generally implemented the guidance for optimizing and stabilizing housing choice voucher utilization through HUD’s utilization protocol; however, opportunities existed to strengthen controls to ensure stable optimal utilization. In the report, OIG recommended that HUD implement all utilization protocols and improve controls. MTW Program Statutory Objectives Were Not Measured In prior years, OIG and GAO 48 reported that HUD’s internal controls were not sufficient to capture and evaluate MTW PHAs’ performance and use of funds to determine HUD’s compliance with the program statutory objectives. 49 To address this concern, in fiscal year 2013, HUD revised its standardized reporting framework and data collection process; however, HUD had not determined how it would use this information to measure PHA compliance with statutory objectives. Therefore, this underlying problem continued to exist. Consequently, a recent OIG audit report on the MTW program 50 reported that HUD’s program oversight was inadequate because HUD still had not (1) implemented programwide performance indicators, (2) evaluated agencies’ programs according to its policy, (3) evaluated agencies’ compliance with key statutory requirements, (4) verified agencies’ self-reported performance data, and (5) performed required annual program risk assessments. HUD revised its standard reporting framework in its annual MTW plan and report to include standard metrics for each of the statutory objectives. Starting in June 2013, HUD required MTW PHAs to use the revised format for any new proposed activities. HUD expected all MTW PHAs to use the new MTW plan and report format for all MTW activities by March and April of 2014, respectively. 51 In addition to revised reporting documents, HUD was simplifying its process for data collection. Previously, HUD required MTW PHAs to submit program data in both the annual MTW report and HUD systems, resulting in the submission of duplicative or conflicting information. To simplify this process and eliminate confusion, HUD now requires MTW PHAs to submit only audited program data in FASS. With the new reporting requirement, PHAs will report the program 47 Audit Report 2013-NY-0002, HUD Can Improve Public Housing Agencies Use of Housing Choice Vouchers by Consistently Implementing All Utilization Protocols and Improving Controls, issued July 18, 2013 48 GAO-12-490, Opportunities Exist to Improve Information & Monitoring, issued April 19, 2012 49 OMB Circular A-123, section I, states, “The proper stewardship of Federal resources is an essential responsibility of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources are used efficiently and effectively to achieve desired objectives.” 50 Audit Report 2013-PH-0004, HUD’s Oversight of Its Moving to Work Demonstration Program Needs Improvement, issued September 27, 2013 51 HUD’s MTW office provided MTW PHAs with a 120-day transition timeframe to submit the annual MTW plans and reports in the new format. Each MTW PHA’s submission due date depended on the fiscal year start date. 72 results in a simplified format that will permit cost and production comparisons over time. While HUD had implemented a new framework for collecting information, it needs to determine how it will evaluate and use the data it collects. HUD had been meeting with representatives of MTW agencies to develop an agreement on a methodology that will be used to evaluate the basic performance of agencies against the statutory objectives. HUD planned to finalize the methodology for assessing performance by April 2014. Tracking the performance of MTW PHAs is necessary to ensure that physical conditions for public housing residents are suitable, public housing units are appropriately utilized, and agencies maintain a satisfactory financial condition within available resources. Without performance tracking, more than $3 billion in funding for the MTW program would be susceptible to fraud, waste, and abuse. In fiscal year 2012, OIG recommended 52 that HUD establish and implement policies and maintain adequate staffing levels to ensure proper oversight of the MTW program. The final action target dates for the recommendations were between December 2013 and December 2014. Significant Improper Payments in Rental Housing Programs Continued in Fiscal Year 2012 HUD’s rental housing assistance programs had previously been assessed as being at high risk of significant improper payments. These programs constituted over 30 billion, or 30 percent, of HUD’s total payments in fiscal year 2012. HUD’s RHAP are administered by Public Housing Agencies (PHAs) and multifamily housing owners or management agents on HUD’s behalf. In general, beneficiaries pay up to 30 percent of their adjusted income as rent, and HUD payments cover the remainder of the rental cost (or the operating cost, in the case of public housing). From fiscal year 2000 through 2011, HUD reduced the gross improper payments for from $3.22 billion to $1.12 billion, a reduction of 65 percent. However, the total error still significantly higher than the threshold established by the Improper Payment Elimination and Reduction Act of 2010 53. 52 HUD OIG’s fiscal year 2012 Consolidated Financial Statement Audit report 2013-FO-0003 53 Improper Payment Elimination and Reduction Act of 2010 requires that Agencies to perform statistical study to determine the level of error in their program. If the gross error is higher than 1.5 percent for 2013, then the program is considered susceptible to significant improper payments. Therefore, HUD is required to perform a quality control study on the RHAP to estimate the level of improper payments due to following type of error (1) subsidy calculation and eligibility errors made by the PHAs and Owner-administrated projects and (2) from tenants that underreported their income. An improper payment is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements 73 Therefore, HUD needs to ensure that rental housing assistance program funds 54 are expended in compliance with the program’s regulations. 55 HUD must establish internal controls to ensure that PHAs and private multifamily project owners or management agents (1) correctly calculate housing subsidies by corroborating tenants’ eligibility, income level, reasonable market rent rates and unit sizes, and (2) provide safe, decent, and sanitary housing. HUD’s most recent contracted quality control study 56 of fiscal year 2012 estimated that HUD made substantial improper payments in three major rental housing assistance programs. The study reported gross erroneous payments of approximately $190.8 million in public housing, $430.7 million in PHA- administered Section 8, and $177.2 million in owner-administered Section 8 programs, amounting to approximately $798.8 million. The study was based on analyses of a statistical sample of tenant files, tenant interviews, and third-party documents verifying income. Errors in this study are a combination of program administrators’ not entering correct data into PIH’s Information Center system and HUD’s Tenant Rental Assistance Certification System and program administrators’ not verifying tenant-reported information. Additionally, the contractor performed a second study to identify tenants who intentionally did not report the income from their employers. Improper payments amounted to approximately $203.7 million in PHA-administered public housing, $168.8 million in PHA-administered Section 8, and $46.7 million in owner- administered Section 8 programs, totaling $419.2 million in subsidy costs. HUD did not conduct a study to estimate the error from the multifamily project owners billing to HUD for fiscal year 2012 but used the $106 million estimated billing error to arrive at the total gross error amount of $1.32 billion in improper payments. Conclusion HUD did not have sufficient controls in place to ensure that PHAs calculated and reported accurate financial, program, and compliance information on the 2,300 PHAs that received $18 billion in fiscal year 2013. Therefore, in fiscal year 2013, HUD could not reasonably ensure that its disbursements to PHAs were based on accurate VMS data or assert that PHAs had processes in place to ensure Section 8 program compliance for the MTW programs. Consequently, HUD was at risk of 54 HUD’s three major rental using housing programs are (1) the public housing operating subsidy, (2) the public housing Section 8 (Housing Choice Voucher and Modern Rehabilitation) and (3) the multifamily project owner- administered project-based programs. Rental housing assistance program combined funding provided to the PHAs and administrators amounted to $30 billion in 2012. 55 OMB Circular A-123, section I, states, “The proper stewardship of Federal resources is an essential responsibility of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources are used efficiently and effectively to achieve desired objectives.” 56 Quality Control for Rental Assistance Subsidy Determination, issued September 27, 2013. This report was produced for HUD by ICF International. 74 increased improper payments, and the Section 8 program was more susceptible to fraud, waste, and abuse. Recommendations We recommend that the Assistant Secretary for the Office of Public Housing 10A. Develop a risk assessment process that evaluates risk for all PHAs. Based on the risk assessment determine which PHAs need to be reviewed within the fiscal year to reasonably ensure VMS data is accurate and expenses are valid. 10B. Allocate resources so that all of the reviews determined as necessary in the risk assessment can be performed and clearly documented to show the qualitative and quantitative findings. 10C. Perform a cost benefit analysis on RATS reviews to determine whether (1) the results of the reviews are beneficial in determining accuracy of PHA self-reported data, (2) the process can be automated, and (3) staff performing RATS reviews can be reallocated to teams that perform other types of monitoring reviews. 10D. Develop and implement a mechanism to track the resolution process for all Quality Assurance Division reviews and require field offices to use this system during their follow-up. 10E. Develop and implement standard operating procedures for addressing PHAs that have not submitted financial statements, including a process for assessing and collecting late penalties in a consistent and timely manner. 75 Finding 11: Financial and Program Management Controls Over the Emergency Homeowner’s Loan Program Were Weak HUD did not implement sufficient controls over the Emergency Homeowner’s Loan Program (EHLP) to ensure compliance with program, accounting, and financial reporting requirements. This condition was due to a lack of permanent program management structure, causing the administration of the program to be fragmented among three different program offices, resulting in the lack of established policies and procedures to ensure adequate administration, monitoring, and oversight of the program. As a result, (1) $90.1 million in obligations remained as of September 30, 2013, that potentially no longer had a bona fide need, (2) loans were potentially issued in excess of the maximum loan amount mandated by law, and (3) the portfolio lacked an adequate subsidiary ledger to support the loan receivable balance recognized on the financial statements. Obligations Were Not Routinely Evaluated for Need The passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act enacted the Emergency Homeowners’ Relief Fund on July 21, 2010, which authorized $1 billion in assistance in the form of a declining balance, nonrecourse, zero-interest, subordinate secured loan up to $50,000 to eligible homeowners. HUD administered these funds through EHLP in two ways: (1) direct loans to eligible homeowners (HUD-administered) and (2) grants to States with substantially similar assistance programs (substantially similar States or SSS). Our prior-year report 57 determined that the program lacked a permanent management structure, a condition which continued. The two methods described above are formally administered by HUD’s Office of Policy Development and Research, which relies on OCFO and the Office of Housing to perform essential monitoring functions. However, our review found that substantial amounts of obligations that were potentially invalid remained obligated and were unreviewed by the program offices. Our review of the program obligations determined that administrative and assistance obligations were not routinely evaluated for need as required by Title 7, GAO, and HUD requirements. We found $24.3 million in potential invalid obligations, $8.8 million of which represented cases that had been terminated from the program and forwarded to the National Servicing Center (NSC). Additionally, $5.7 million and $2.7 million in projects were obligated in fiscal years 2011 and 2012, respectively, but as of September 30, 2013, had not been 57 Audit Report 2011-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Year 2011 and 2010 Financial Statements, issued November 15, 2011 76 disbursed. Additionally, we reviewed the fiscal agent agreement 58 and outstanding obligation balance as of September 30, 2013. Based on an analysis of the task pricing structure of the original contract and an assessment of future fiscal agent costs projected to be incurred through the end of the program, we determined that potentially $17.9 million of the remaining $18.7 million undisbursed obligation was no longer needed to fund the remainder of the program and, therefore, could be deobligated. The large reduction in the need for funding was primarily due to a significant shortfall in borrower program participation from that originally projected at contract execution. Our review of the State grantees’ outstanding obligations as of September 30, 2013, calculated projected run-out costs of the program based on quarterly files of application and loan-level data submitted by each of the five States compared with the outstanding obligation balance in LOCCS as of October 4, 2013. This analysis projected $25.6 million needed to fund remaining active loans for the duration of their term and identified as much as $47.9 million in excess obligations that could be eligible for deobligation, $27 million of which could be tied to loans that had already been terminated from the program. HUD Did Not Have Adequate Assurance of Controls Over Its Fiscal Agent and State Grantees Our review also determined that HUD did not have adequate assurance of controls over EHLP, including its fiscal agent, to ensure program compliance and accurate financial reporting on the program. Specifically, HUD lacked a Statement on Standards for Attestation Engagements (SSAE) 16 59 review of the fiscal agent performing all loan processing functions of the HUD-administered portion of the portfolio, which would have reported on the internal controls in place at the fiscal agent. This examination was not completed because the requirement to complete one was not included in the fiscal agent contract at the time of execution. The initial proposal from the fiscal agent included the requirement for an SSAE 16; however, HUD decided to have it excluded from the contract. The lack of this review resulted in HUD’s loss of assurances that (1) internal controls were in place and operating effectively for the program loan processing performed by the fiscal agent and (2) funds appropriated by Congress for the direct loan subcategory of EHLP totaling $209.8 million were protected against fraud, waste, abuse, and misappropriation at the time of contract obligation. After OIG’s inquiries, in September 2013, HUD began implementing reporting and reconciliation processes for the fiscal agent to compensate for the lack of an SSAE 16. Additionally, an onsite review at the fiscal agent was conducted in 58 An agreement entered into by HUD with another entity to provide general accounting and fiscal administrative control services on HUD’s behalf. 59 SSAE 16, Reporting on Controls at a Service Organization – Examination engagements undertaken by a service auditor to report on controls at organizations that provide services to user entities when those controls are likely to be relevant to user entities’ internal control over financial reporting. 77 September 2013 to ensure program compliance, which HUD planned to continue in the next fiscal year. The lack of these compensating measures for the 2 years since implementation of the program, however, resulted in HUD’s inability to protect $25.5 million invested in the fiscal agent. For the SSS subcategory, HUD’s assurance that State grantees were administering EHLP in accordance with statutory requirements significantly decreased in fiscal year 2013 when contract services to perform financial and program reviews of SSS’s EHLP were halted. Monitoring of the States was conducted by an independent public accounting firm; however, the contract for these reviews was not renewed by HUD, resulting in the lack of monitoring reviews performed in fiscal year 2013. The absence of monitoring and oversight efforts resulted in the disbursement of loan amounts in excess of the legally established $50,000 maximum for two borrowers that were issued loans from the State of Pennsylvania. Due to the lack of monitoring and oversight of these grantees, these instances of potential noncompliance were identified by OIG through routine audit work and not by HUD. Additionally, we found 16 instances in which SSS project amounts reported to NSC by the States exceeded amounts reassigned to HUD. Further, the excess amount reported for 15 of these 16 projects, after OIG inquiries, was revealed to be the result of (1) unrelated State program funding simultaneously granted to borrowers and (2) borrower contributions, all of which were erroneously reported to HUD in combination with the SSS-related amounts. Additionally, we identified instances of duplicate projects within the NSC records, each with different principal amounts. Similarly, we compared the NSC data as of September 30, 2013, with HUD’s general ledger records for the HUD-administered subcategory of EHLP. We noted that of 998 fully disbursed projects, 794 projects were not identified in NSC’s records. These 794 projects had a combined disbursed amount of $5.4 million. Of the 204 projects that were identified in NSC’s records, 182 reflected a principal balance that did not match the disbursed amount within the general ledger records. The total variance of these 182 projects was $4.6 million. We also compared the NSC data as of September 30, 2013, with those projects in HUD’s general ledger records that were not yet fully disbursed but were terminated from the program based on the fiscal agent’s records. As a result, we identified 15 projects that were terminated from the program between October 2012 and April 2013 but were not in NSC’s records as of September 30, 2013. These 15 projects had a combined disbursed amount of $0.6 million. Lastly, we identified 308 projects that were reported by the fiscal agent as having been terminated from the program between July 2012 and September 2013. These projects were identified in NSC’s records; however, the total disbursed amount 78 for these projects, according to HUD’s general ledger records, did not match NSC’s original principal amount. The total general ledger disbursed amount for these 308 projects was $9 million; the difference identified in NSC’s record was $1.8 million. We communicated these results to HUD and asked for explanations for the differences. HUD confirmed that the NSC files, which represent the basis from which HUD’s EHLP financial data were recorded, included inaccurate data in both amounts and project numbers and were undergoing review. Since HUD relied on NSC data for principal amounts and payments to record EHLP activity in the accounting records, the inaccurate data caused HUD’s financial statements to be misstated. HUD Lacked an Adequate Subsidiary Ledger To Support the General Ledger HUD failed to implement an adequate subsidiary ledger with loan-level detail for loans that were still active that supported the financial statements. Instead, LOCCS was used as a subsidiary ledger. However, LOCCS is a component of HUD’s core financial system, and, therefore, any loan receivable balances must be supported by an adequate financial system (subsidiary ledger) that is linked electronically to the core financial system and can perform the required functions of a loan system. The HUD-administered EHLP loan portfolio was not entered into a direct loan system (subsidiary ledger) until September 2013, 2 years after program implementation. This delay prevented OCFO from properly monitoring, servicing, and reporting on these loans in accordance with GAO and program requirements. Conclusion HUD did not implement sufficient controls over EHLP to ensure compliance with program, accounting, and financial reporting requirements. As a result, excess obligations remained as of September 30, 2013, that potentially no longer had a bona fide need, some of which were tied to borrowers who had been terminated from the program; loans were potentially issued in excess of the maximum loan amount mandated by law; and the portfolio lacked an adequate subsidiary ledger to support the loan receivable balance recognized on the financial statements. HUD needs to implement sufficient policies and procedures to establish internal controls over the program to ensure that it has adequate assurances regarding the loan processing completed by the fiscal agent and the States. Further, periodic reviews of all administrative and assistance obligations should be completed to ensure that invalid obligations do not remain available for disbursement. Lastly, HUD needs to ensure that an adequate subsidiary ledger is in place that supports all loan-level detail of the entire EHLP portfolio. 79 Recommendations We recommend the Office of Policy Development and Research 11A. Develop and implement procedures that establish internal controls over the HUD-administered EHLP to ensure that HUD has adequate assurances regarding the loan processing completed by the fiscal agent and other servicers for the HUD-administered subcategory of the EHLP portfolio. 11B. Develop and implement procedures that establish internal controls over the SSS EHLP to ensure compliance with program objectives through the duration of the program. 11C. Review the HUD-administered assistance obligations with remaining balances totaling $24.3 million and close out and deobligate amounts tied to obligations that are no longer valid or needed. 11D. Review the SSS assistance obligations for each State and deobligate as much as $47.9 million tied to obligations that are no longer valid or needed. 11E. Develop and implement procedures to routinely evaluate the assistance and administrative obligation balances for the HUD-administered and SSS subcategories of EHLP to determine whether a valid need still exists and if not, deobligate those balances. We recommend the Office of the Chief Financial Officer 11F. Ensure that an adequate subsidiary ledger is in place that supports the loan-level detail of all HUD-administered direct loans and reconciles to the EHLP loan receivable balance in the general ledger. 11G. Review the fiscal agent contract remaining obligation balance and deobligate as much as $17.9 million tied to contract funds that are no longer needed. 80 Finding 12: HUD’s Computing Environment Controls Had Weaknesses HUD’s computing environment, data centers, networks, and servers provide critical support to all facets of its programs, mortgage insurance, financial management, and administrative operations. In prior years, we reported on various weaknesses with general system controls and controls over certain applications, as well as weak security management. These deficiencies increase risks associated with safeguarding funds, property, and assets from waste, loss, unauthorized use, or misappropriation. We audited general and application controls over selected information systems that support the preparation of HUD’s financial statements. We also followed up on the status of previously reported application control weaknesses. Our review found information systems control weaknesses that could negatively affect HUD’s ability to accomplish its assigned mission, protect its data and IT assets, fulfill its legal responsibilities, and maintain its day-to-day functions. Presented below is a summary of the control weaknesses found during the review. HUD’s Continuous Monitoring Program Had Deficiencies We reviewed policies and processes applicable to HUD’s continuous monitoring program. Continuous monitoring is maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. It provides (1) ongoing assurance that planned and implemented security controls are aligned with organizational risk tolerance and (2) the information needed to respond to risk in a timely manner. We found that HUD’s continuous monitoring program needed improvements in its design to strengthen the collecting and reporting of information security data. The improvements would also increase assurance for the accuracy and reliability of the business and financial processes that the IT systems support. Specifically, we found that 1. Automated mechanisms were not in place to continuously detect hardware at the data center or continuously block unapproved software; thus, OCIO may have been unaware of hardware that was not securely configured and patched on HUD’s network at the data center. If the hardware was Internet accessible, it could be exploited from anywhere in the world. Also, because unapproved software was not continuously blocked, HUD systems could have run uniquely harmful software that threatened the confidentiality, integrity, or availability of the business processes that the IT systems support. 2. Web application vulnerability scans were not performed for more than 2 years on systems that support the financial statements, such as HUD’s 81 Consolidated Financial Statement System (Hyperion) and the Financial Data Mart. These systems continue to be given authorizations to operate despite the lack of knowledge regarding what vulnerability risk they may pose to the financial statements and HUD’s mission. 3. Continuous monitoring policies were not clearly defined to reflect reporting requirements and updated National Institute of Standards and Technology guidance on frequencies for security status monitoring. As a result, ongoing system security authorizations were maintained using security-related information that was not collected frequently enough to ensure that the reporting of the information was always accurate. Weaknesses With Contingency Planning Were Identified While observing the semiannual disaster recovery exercise in April 2013, we noticed that telecommunication links were not in place for transmitting data to Treasury from the recovery site. The OCIO has a Memorandum of Understanding (MOU) with Treasury to allow HUD applications to transfer business and budgetary information for action required by Treasury. The “Disasters and Other Contingencies” clause in the MOU requires the designated technical staff to immediately notify the designated counterpart in the event of a disaster or other contingency that disrupts the normal operation of the connected systems. The MOU does not contain any alternate provisions for the connection to be resumed at an alternate site. Upon further inquiry we determined there are no contingency plans in place for resuming operation of the telecommunication links to Treasury during a disaster recovery event. Information System Control Weaknesses Were Identified in the Financial Systems We reviewed the effectiveness of the information system controls that can impact the security and reliability of the financial information maintained in LOCCS, Hyperion, and HUDCAPS. We found HUD did not ensure that the general and application controls over these systems fully complied with Federal requirements and its own security policies. These control weaknesses place HUD’s resources at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. 82 Information System Control Weaknesses Were Identified in LOCCS The Line Of Credit Control System (LOCCS) is HUD’s primary system for disbursement, cash management, and post-award of financial grants. It is a mission critical system, with approximately 20,000 users. LOCCS is an integral part of OCFO’s core financial management system. It manages disbursements for the majority of HUD programs. LOCCS is available 7 days a week to service the funding needs of HUD's grant, loan, and subsidy clients. Users typically access LOCCS through Web enabled modules or by using the Voice Response System (VRS). The VRS is a hardware component relied upon by approximately 5,000 users. It allows recipients to request payments via a question/answer session using a touch-tone telephone. We found 60 that (1) the LOCCS VRS was not covered by a hardware maintenance agreement, (2) LOCCS disaster recovery testing did not include all of the essential components, (3) LOCCS access controls needed updates, (4) some of the LOCCS system documentation was outdated, and (5) the separation of duties between the LOCCS voucher processing and banking groups was not fully achieved. Information System Control Weaknesses Were Identified in Hyperion The HUD Consolidated Financial Statement System (Hyperion) is a mission- critical financial system for the consolidation of the general ledger activities from HUD’s program offices and HUD’s financial statement reporting system for reporting to the U.S. Department of the Treasury and the Office of Management and Budget. Hyperion summarizes financial activity provided by the OCFO, FHA, and Ginnie Mae. HUD uses Hyperion to report on more than $35 billion in new authority each fiscal year and more than $100 billion in unexpended balances. We found 61 that OCFO did not (1) follow HUD’s access control policies; (2) implement effective interface procedures to ensure that the FHA and Ginnie Mae financial data were protected during transmission and access to these data were restricted while stored; (3) modify the contract to ensure its support contractor was required to update the interface procedures to reflect the current data fields 60 2014-DP-0001, Information System Control Weaknesses Identified in the Line of Credit Control System, issued November 7, 2013. This was a limited distribution report due to the sensitive nature of the information reported, and was, therefore, not made available to the public. 61 2013-DP-0007, Information System Control Weaknesses Identified in the Hyperion Application System, issued September 30, 2013. This was a limited distribution report due to the sensitive nature of the information reported, and was, therefore, not made available to the public. 83 and reconciliation process being used for the interface financial data processing between Hyperion and Financial Data Mart; (4) assess the impact of system changes before implementation and did not ensure that Hyperion’s configuration was aligned with security controls and settings identified as being in place; and (5) take steps to ensure that Hyperion was considered for disaster recovery testing. Information System Control Weaknesses Were Identified in HUDCAPS The HUD Central Accounting and Program System (HUDCAPS) is the Department's core accounting system. It controls the budget from appropriation through Allotment for over $35 billion in new program funds annually for over 100 Treasury Appropriation Accounts. At any given time, HUDCAPS manages over $50 billion in HUD obligations via the budget execution process. We found that HUDCAPS was not compliant with core financial system requirements for the payment management function. The core financial system requirements state that the agency core financial system must contain automated processes to perform payment management functions. However, HUDCAPS did not import or update vendor data in accordance with requirements and did not meet all accounts payable, invoicing, disbursing and payment follow up requirements related to how payments were processed. For instance, HUDCAPS did not record full or partial receipt and acceptance of goods and services by document line item, perform matching options that match invoices to obligations, receiving reports and acceptance data, validate invoice period of performance and invoice delivery and performance dates, and was not being used to calculate the payment amount including discounts, interest, and penalties. Also, we found that documentation for application interfaces with HUDCAPS was not consistent, and technical details required to operate the interfaces were not included in the documentation as mandated by Federal requirements and HUD’s own internal policies. Internal Controls Within DRGR Remained Ineffective Operational since February 1999, the Disaster Recovery Grant Reporting (DRGR) was developed by HUD’s Office of Community Planning and Development (CPD) for the Disaster Recovery Community Development Block Grant program and other special appropriations. Data from the system are used by HUD staff to review activities funded under these programs and for required quarterly reports to Congress. The system was developed for grantees to identify activities funded under their action plans and amendments, to include budgets and performance goals for those activities. 84 In an audit conducted in fiscal year 2011 62, we determined that CPD management did not maintain effective internal controls over financial reporting within DRGR system. Our review found that DRGR did not have a sufficient data modification process in place to protect financial transaction data and audit trails from being overwritten. Specifically, CPD allowed DRGR grantee users to modify voucher transactions (financial events or transactions) to reflect changes to program cost allocation information between activities (the allocation of funds drawn for specific activities). As a result, reconciliation between DRGR and HUD’s core financial applications was cumbersome and time consuming. The situation was further aggravated because (1) DRGR did not maintain the full voucher number for payment transactions recorded in LOCCS, (2) CPD allowed revision of all or part of the original distribution, (3) CPD did not require grantees to record a reason or justification for making the change within DRGR, (4) CPD allowed voucher modifications to be made until the grant was closed out, and (5) CPD did not require grantee users to obtain approval from HUD for each modification transaction. Transaction-level data detailing how grantees use funding provided by HUD is not transferred to HUD’s core financial applications. The detailed financial transaction data is only maintained within DRGR; therefore, DRGR was the financial management systems of record for these data, since only summary information was transferred and maintained in the core financial systems. We followed up on the status of these weaknesses during fiscal year 2013. During fiscal year 2013 system modifications were implemented to develop functionality within DRGR to make modifications to program-specific data elements that do not overwrite financial transaction data and to develop functionality within DRGR to require grantee users to justify or explain the need for modifications. CPD is still working to complete actions to implement an approval process to require HUD review of data modifications in the DRGR voucher process. Conclusion HUD’s computing environment provides critical support to all facets of its programs, mortgage insurance, financial management, and administrative operations. During fiscal year 2013, as in prior years, we continued to identify information systems control weaknesses that could negatively affect HUD’s ability to accomplish its assigned mission, protect its data and IT assets, fulfill its legal responsibilities, and maintain its day-to-day functions. As a result, OIG continues to report a significant deficiency for HUD’s computing environment. 62 Audit Report 2012-DP-0001, Audit Report on the Fiscal Year 2011 Review of Information Systems Controls in Support of the Financial Statements Audit 85 Recommendations Recommendations were included in separate OIG audit reports. Therefore, no recommendations are reported here. 86 COMPLIANCE WITH LAWS AND REGULATIONS In fiscal year 2013, we found instances in which HUD did not ensure that transactions were executed in accordance with laws governing the use of budget authority and with other laws and regulations that could have a direct and material effect on the financial statements and any other laws, regulations, and governmentwide policies identified in OMB audit guidance. Specifically, we have identified noncompliance with the following: • Federal Financial Management Improvement Act • Anti-Deficiency Act • Section 218 (g) of the HOME Statute • Federal Information Security Management Act 87 Finding 13: HUD Did Not Substantially Comply with the Federal Financial Management Improvement Act In fiscal year 2013, we determined that HUD’s financial management systems as a whole continued to not substantially meet Federal Financial Management Improvement Act (FFMIA) requirements. Due to shortcomings from its current information technology systems and lack of systems capabilities, HUD lacked assurance that its systems can support management’s need for reliable, useful and timely information for accountability and day-to-day decision making. OIG’S FFMIA Compliance Determination In fiscal year 2013 OIG determined 7 63 of 39 HUD financial management systems did not substantially comply with FFMIA because they failed to meet one or more of the required elements for compliance under FFMIA Section 803. HUD on an entitywide basis, made limited progress as it attempted to address its financial management deficiencies to bring the agency’s financial management systems into compliance with FFMIA. While efforts are underway in fiscal year 2013 to address some of these issues, systems weaknesses remained a serious problem. HUD’s financial management systems (1) continued to not meet current requirements, (2) were not operated in an integrated fashion, and (3) were not linked electronically to efficiently and effectively provide agencywide financial support necessary to carry out HUD’s mission and support financial management needs. These matters are further described as a material weakness in the Internal Control section of this report. According to Section 803 of FFMIA, HUD’s financial management systems are required to substantially comply with (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the U.S. Standard General Ledger at the transaction level. OIG used OMB’s Implementation Guidance for the Federal Financial Improvement Act, dated January 9, 2009, to determine compliance. In its fiscal year 2013 Agency Financial Report, HUD and OIG agreed on five of seven non-FFMIA compliant systems as noted above, but HUD took exceptions on the remaining two (HUDCAPS and HIAMS). Additionally, fiscal year 2013 was the first year HUD reported IDIS as non-FFMIA compliant system although OIG had been reporting IDIS as non-FFMIA compliant since fiscal year 2010. 63 Of the seven non-FFMIA-compliant systems, five mixed systems (FIRMS, HIAMS, SPS, HPS, and IDIS) were reported in prior years, and two new non-FFMIA-compliant systems (HUDCAPS and GFAS), both of which core systems were identified in fiscal year 2013. 88 HUD’s FFMIA Compliance Determination In its fiscal year 2013 Agency Financial Report, HUD determined that the agency was not in compliance with FFMIA. Additionally, HUD reported that 5 of its 39 financial management systems did not comply with the requirements of FFMIA and OMB Circular A-127. Although individual systems had been certified as compliant with FFMIA, HUD had not completed any A-127 reviews in the last 5 years and relied upon the results of internal control reviews for the individual applications. We have included the specific nature of noncompliance issues, responsible program offices, and recommended remedial actions for the five noncompliant systems in appendix B of this report. Conclusion OIG reviewed HUD’s compliance with Section 803 of FFMIA as of September 30, 2012. In fiscal year 2013, HUD, on an entitywide basis, made limited progress as it attempted to address its financial management deficiencies to bring the agency’s financial management systems into compliance with FFMIA. In this regard, OIG continued to report that HUD’s financial management systems did not substantially comply with FFMIA as of September 30, 2013. 89 Finding 14: HUD Did Not Substantially Comply with the AntiDeficiency Act In fiscal year 2013, HUD made demonstrable progress in moving along several of the old 64 Antideficiency Act (ADA) 65 cases out of HUD OCFO 66 to OMB for review and approval. However, for the fifth consecutive year, no ADA violation was reported to the President, Congress, and the Comptroller General at the end of fiscal year 2013 as required. HUD did not make clearing of backlogged ADA cases a priority in fiscal year 2013. Untimely disposition of the ADA cases could delay the implementation of corrective actions, including any needed safeguards to strengthen HUD’s funds control system to prevent recurrence of the same ADA violation. Progress Made But Improvements Needed HUD’s performance in clearing a backlog of old ADA cases needs improvement. Although considerable progress had been made, none of the old cases determined to contain ADA violations was reported to the President, Congress, and the Comptroller General at the end of fiscal year 2013. Since fiscal year 2009, 67 we have reported HUD’s slow-moving process in conducting, completing, and closing the investigation of potential ADA violations identified by HUD. As of October 1, 2012, a total of 16 ADA cases were outstanding; nearly 63 percent of them were 3 to 10 years old. The 16 cases were in various stages of review at the beginning of fiscal year 2013. During the audit, we noted that HUD had made some headway in reviewing old ADA cases. As a result, as of September 30, 2013, HUD had found (1) four cases without ADA violations and (2) four cases 68 with ADA violations, which were sent to OMB for review and approval. HUD’s final review of the remaining eight 69 cases had not been completed. 64 As of September 30, 2013, a total of 16 cases were open and under review by HUD. The time elapsed since these cases were opened ranged from more than a year to 10 years. 65 31 U.SC. 1341, 342, 1350, 1517, and 1519. 66 Public Law 108-7, Division K, Title II Department of Housing and Urban Development Appropriations, 2003, granted HUD’s Chief Financial Officer, in consultation with the HUD budget officer, the “sole authority” to investigate potential or actual violations under ADA and all other statutes and regulations related to the obligation and expenditure of funds made available in any act. Further, the Appropriations Act provided that the Chief Financial Officer must determine whether violations occurred and submit the final reports required by law. 67 See OIG’s fiscal year 2009 audit report 2010-FO-0003 for details. 68 Of the four cases, two (2004-008 and 2008-001) were sent to OMB on January 8, 2013, and another two (2012- 002 and 2012-003) on July 16, 2012. 69 Five of eight ADA cases had been sent to OMB for review and approval as of November 12, 2013. Therefore, a total of nine cases (two cases in fiscal year 2012, two cases in fiscal year 2013, and five cases in fiscal year 2014) had been sent to OMB for its review as of November 12, 2013. 90 The status of 12 cases (4 cases 70 with ADA violations and 8 ongoing cases) as of September 30, 2013, is provided in detail below: Table 2. With ADA violation – Sent to Age in OMB for ADA Item Case Case years as of review and review number number opened 9/30/13 approval ongoing 1 2003-004 09/10/03 10.06 X* 2 2004-007 07/07/04 9.24 X* 3 2004-008 09/07/04 9.07 X 4 2008-001 06/05/08 5.32 X 5 2010-002 01/29/10 3.67 X 6 2010-004 08/17/10 3.12 X* 7 2010-005 08/31/10 3.08 X* 8 2012-001 11/09/11 1.89 X 9 2011-002 01/21/11 2.69 X 10 2012-002 12/11/11 1.81 X 11 2012-003 04/02/12 1.50 X 12 2012-004 07/01/12 1.25 X* Count 4 8 Legend: * HUD sent another five cases to OMB for review and approval on October 30, 2013, and November 12, 2013. The condition described above occurred because HUD did not make the clearing of backlogged ADA cases a priority in fiscal year 2013 by establishing a firm date for the final disposition of these cases. Although HUD’s ADA case processing timeframe policy calls for completion of HUD’s investigation of ADA cases within 1 year of referral or notification, HUD failed significantly to implement its policy on all of the cases as noted in the table above. Conclusion HUD did not substantially comply with ADA. Although HUD had moved along a considerable number of old ADA cases from prior years for final review by OMB, it had not reported any ADA violations to the President, Congress, and the 70 We did not review these four cases in fiscal year 2013. We reviewed only seven cases that were still open when we began our review in early August 2013. 91 Comptroller General at the end of fiscal year 2013 as required. HUD’s ADA case processing timeframe policy is to complete the end-to-end internal review within 1 year of referral or notification. However, HUD had significantly exceeded the processing timeframe on virtually all of its ADA cases. Going forward, HUD needs to make this matter a priority by ensuring the timely review and disposition of all future ADA cases. Recommendations We recommend that the Office of Chief Financial Officer 14A. Make the review of ADA cases a priority by enforcing HUD’s ADA case processing timeframe policy going forward and commit to a firm deadline for finalizing the review of the remaining old ADA cases. 92 Finding 15: HUD Did Not Comply With the HOME Investment Partnership Act HUD did not comply with section 218(g) of the HOME Investment Partnership Act. HUD’s misinterpretation of the plain language in the Act, the implementation of the cumulative method and the first in, first-Out (FIFO) technique, as well as the current recapture policies have resulted in HUD’s noncompliance with the HOME statute requirements. Consequently, HUD has incorrectly permitted some jurisdictions to retain and commit HOME program grant funds beyond the statutory deadline. HUD Policies Did Not Comply With the HOME Investment Partnership Act The HOME Investment Partnership Act required HUD to establish a HOME Investment Trust Fund for each participating jurisdiction (grantee), with a line of credit that included the grantee’s annual allocation. The Act also requires each grantee to place all of its annual allocation’s funds under a binding commitment within 24 months after it receives its line of credit. Failure to do so, would result in the grantee’s losing its right to draw any funds that were not placed under binding commitment within the 24 months and require HUD to make such reductions and reallocate the funds as soon as possible. HUD implemented a process, called the cumulative method, to determine a grantee’s compliance with the requirements of section 218(g) of the Act and determine the amount to be recaptured and reallocated in accordance with section 217(d). HUD measured compliance with the 24-month commitment requirement cumulatively so that all funds committed as of the grantee’s deadline were counted toward the grantee’s commitment requirement regardless of the allocation year used to make the commitments. HUD also implemented the FIFO method for the HOME program funds having the same source of funds, recipient of funds, and type of funds, in which the grant year was used to order the funds from the oldest year to newest year. When a grantee committed funds to an activity (by funding an activity using the activity funding function), the funds were committed from the oldest funds having the same source of funds, recipient of funds, and type of funds. The grantee was unaware of the year from which the funds were committed. Since this FIFO technique was applied to the commitments within the IDIS Online, commitments were not separated or identified by the dates on which the commitments were made, making it difficult to determine what commitments were made during the 24-month period by looking only at the year in question. HUD OIG had found this FIFO method to be a departure from Federal GAAP, as discussed in finding 93 1: CPD’s Formula Grant Accounting Does Not Comply With GAAP, Resulting in Misstatements on the Financial Statements. OIG determined the commitment status, based upon a noncumulative approach, for 287 grantees for the 2011 annual allocation commitment requirement and noted that 132 grantees had met the commitment requirement based upon HUD’s cumulative method but did not meet the requirement based upon OIG’s noncumulative method and 36 grantees did not meet the requirement based upon either method, resulting in a total net difference of $54.86 million, which could possibly have been recaptured and reallocated if HUD had used the noncumulative calculation and grantees did not provide evidence to support commitments that were not entered in IDIS Online. In 2009, OIG questioned whether HUD’s cumulative method for determining grantee compliance with the Act’s 24-month commitment requirement complied with the provisions of section 218(g). Due to its difference of opinion with HUD, OIG contacted GAO in 2011 and requested a legal decision and opinion. On July 17, 2013, GAO returned its opinion, reiterating OIG’s opinion that the language in the Act is clear and unambiguous regarding how HUD should determine compliance and make recaptures for noncompliant grantees. Therefore, HUD’s cumulative method did not comply with the Act. Accordingly, GAO advised HUD to stop using the cumulative method, take steps to identify and recapture funds that remained uncommitted after the statutory commitment deadline, and reallocate such funds in accordance with the Act. After consideration of the GAO’s opinion, OIG noted that for overlapping allocation years within a 24-month period, when recapture was necessary, the recapture could take place from another year’s annual allocation, as long as the recapture was from an annual allocation within the 24-month window, following the allocation year in question. HUD allowed reductions to grant allocations outside of the 24-month annual allocation window to resolve findings of noncompliance. CPD agreed to transition from the FIFO method in IDIS Online. After the changes to IDIS Online are made, CPD will implement steps to identify, recapture, and reallocate funds that remain uncommitted after the statutory commitment deadline and discontinue the use of the cumulative method. Conclusion The system limitations within IDIS Online, due to the application of the FIFO method and the exclusion of some of the pertinent relevant information to determine when commitments are made and should be applied, along with HUD’s misinterpretation of the HOME Investment Partnership Act and implementation of the cumulative method and its recapture policy, have 94 • Given participating jurisdictions credit for commitments made outside the 24- month statutory period; • Prevented HUD from complying with the plain language within the HOME Investment Partnership Act, which describes how compliance should be determined and what funds the jurisdiction loses rights to; • Resulted in $54.86 million not being questioned for evidence to show that commitments were made in an amount equal to the allocation amount within 24 months, however, not recorded in IDIS Online, and permitted those unquestioned funds to be retained by the jurisdictions and committed after the statutory deadline; and • Allowed grantees noncompliant with the 24-month commitment requirement to receive reductions from grant year allocations before and after the 24- month overlapping period. Recommendations We recommend that the Office of Community Planning and Development 15A. Make changes to IDIS Online, which will require grantees to specifically identify the grant allocation year to which the commitment should be assigned and include the commitment dates. The system should also allow HUD to ensure that commitments made during overlapping allocations and periods are counted toward only 1 year’s compliance requirements. 15B. Stop using the cumulative method and the deadline compliance report for determining compliance with the 24-month commitment requirement in the HOME Investment Partnership Act and use only the commitments made within the 24-month period to determine compliance. 15C. In accordance, with the GAO legal decision and opinion, take steps to identify and recapture funds that remain uncommitted after the statutory commitment deadline and reallocate such funds in accordance with the Act. 15D. Recapture funds from allocations during the 24-month overlapping period only for grantees that do not comply with the 24-month commitment requirement. 95 Finding 16: HUD Did Not Comply With the Federal Information Security Management Act The fiscal year 2013 independent evaluation of the HUD IT security program found significant deficiencies in most of the practices and component parts of the program. We found that the program did not comply with the Federal Information Security Management Act (FISMA) and information assets were at risk. Weaknesses in HUD’s Information Security Program We performed an independent evaluation 71 of HUD’s IT security program and practices as required by FISMA. The review identified the following significant deficiencies. HUD did not • Establish policies and procedures in accordance with the most recent OMB and National Institute of Standards and Technology guidance for IT security and privacy controls. • Conduct proper oversight to identify program deficiencies. • Consistently and fully document the information system inventory, leaving no assurance that HUD accounted for all of its information systems. • Have proper authorities to operate on many of the HUD systems. • Have personnel with specialized training for their roles in the IT security processes, leaving the agency ill-prepared to meet its responsibilities. In summary, HUD had not developed, documented, or implemented a compliant enterprisewide program. FISMA requires each agency to establish a risk-based information security program that ensures that information security is practiced throughout the life cycle of each agency system. Federal agencies and inspectors general are required to report annually to OMB on the adequacy and effectiveness of agency information security policies, procedures, practices and compliance 71 HUD OIG’s Information Technology Division, an office within OIG separate from the Office of Audit, performed the fiscal year 2013 FISMA evaluation and prepared the OIG FISMA responses to OMB. As the FISMA evaluation was an assignment that was not required to follow auditing standards, the Office of Audit performed a review of the Division’s evaluation work according to GAO audit guidance, Financial Audit Manual 650. 96 with FISMA. Specific details of the fiscal year 2013 FISMA evaluation were published in a separate report. 72 Conclusion OIG determined that HUD had not complied with FISMA and Federal IT security requirements as of September 30, 2013. Improving the overall management and security of IT resources needs to be a top priority for HUD. HUD is at a critical crossroad, as the HUD IT services contract expires in July 2014. HUD’s information systems are paramount to its mission. Executive leadership must establish a strategic approach and take corrective actions to ensure that future technology investments consider security requirements. There is an abundance of sensitive information in HUD information systems, and the protections in place were not commensurate with the risk and magnitude of harm that may result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems. Recommendations Because of recommendations made in our FISMA evaluation report, we are making no further recommendations in this report. 72 Evaluation Report Number 2013-ITED-0001, 2013 FISMA Evaluation, issued November 25, 2013 97 SCOPE AND METHODOLOGY We considered internal controls over financial reporting by obtaining an understanding of the design of HUD’s internal controls, determined whether these internal controls had been placed into operation, assessed control risk, and performed tests of controls to determine our auditing procedures for the purpose of expressing our opinion on the principal financial statements. We also tested compliance with selected provisions of applicable laws, regulations, and government policies that may materially affect the consolidated principal financial statements. We considered HUD’s internal controls over required supplementary stewardship information reported in HUD’s Fiscal Year 2013 Agency Financial Report by obtaining an understanding of the design of HUD’s internal controls, determined whether these internal controls had been placed into operation, assessed control risk, and performed limited testing procedures as required by the American Institute of Certified Public Accountings, U.S. Auditing Standards AU-C Section 730, Required Supplementary Information. The tests performed were not to provide assurance on these internal controls, and, accordingly, we do not provide assurance or an opinion on such controls. With respect to internal controls related to performance measures to be reported in Management’s Discussion and Analysis and HUD’s Fiscal Year 2013 Agency Financial Report, we obtained an understanding of the design of significant internal controls relating to the existence and completeness assertions as described in section 230.5 of OMB Circular A-11, Preparation, Submission, and Execution of the Budget. We performed limited testing procedures as required by AU-C Section 730, Required Supplementary Information, and OMB Bulletin 14- 02, Audit Requirements for Federal Financial Statements. Our procedures were not designed to provide assurance on internal controls over reported performance measures, and, accordingly, we do not provide an opinion on such controls. To fulfill these responsibilities, we • Examined, on a test basis, evidence supporting the amounts and disclosures in the consolidated principal financial statements; • Assessed the accounting principles used and the significant estimates made by management; • Evaluated the overall presentation of the consolidated principal financial statements; • Obtained an understanding of internal controls over financial reporting (including safeguarding assets) and compliance with laws and regulations (including the execution of transactions in accordance with budget authority); • Tested and evaluated the design and operating effectiveness of relevant internal controls over significant cycles, classes of transactions, and account balances; • Tested HUD’s compliance with certain provisions of laws and regulations; governmentwide policies, noncompliance with which could have a direct and material effect on the determination of financial statement amounts; and certain other laws and regulations specified in OMB Bulletin 14-02, including the requirements referred to in FMFIA; 98 • Considered compliance with the process required by FMFIA for evaluating and reporting on internal controls and accounting systems; and • Performed other procedures we considered necessary in the circumstances. We did not evaluate the internal controls relevant to operating objectives as broadly defined by FMFIA. We limited our internal controls testing to those controls that are material in relation to HUD’s financial statements. Because of inherent limitations in any internal control structure, misstatements may occur and not be detected. We also caution that projection of any evaluation of the structure to future periods is subject to the risk that controls may become inadequate because of changes in conditions or that the effectiveness of the design and operation of policies and procedures may deteriorate. Our consideration of the internal controls over financial reporting would not necessarily disclose all matters in the internal controls over financial reporting that might be significant deficiencies. We noted certain matters in the internal control structure and its operation that we consider significant deficiencies under OMB Bulletin 14-02. Under standards issued by the American Institute of Certified Public Accountants, a significant deficiency is a deficiency or a combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. A material weakness is a deficiency or combination of deficiencies in internal controls, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis. Our work was performed in accordance with generally accepted government auditing standards and OMB Bulletin 14-02 as amended. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 99 FOLLOW-UP ON PRIOR AUDITS Not included in the recommendations listed after each finding are recommendations from prior years’ reports on HUD’s financial statements that have not been fully implemented based on the status reported in the Audit Resolution and Corrective Action Tracking System (ARCATS). HUD should continue to track these recommendations under the prior years’ report numbers in accordance with departmental procedures. Each of these open recommendations and its status is shown below. Where appropriate, we have updated the prior recommendations to reflect changes in emphasis resulting from recent work or management decisions. Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and 2011 Financial Statements, 2013-FO-0003 With respect to the material weakness in achieving substantial compliance with FFMIA that continued to challenge HUD, we recommended that OCFO 1.a. Ensure that Section 108 Loan Guarantee program financial management system requirements are incorporated into HUD’s core financial system improvement program to get more transparent and complete information for financial and management reports. (Final action target date is December 31, 2014; reported in ARCATS as 1C.) With respect to the significant deficiency that there were weaknesses in the monitoring of PIH and the Office of Multifamily Housing’s program funds, we recommended that the Assistant Secretary of Public and Indian Housing 2.a Request that Congress include in the appropriations bill an offset of renewal funding for the Housing Choice Voucher program of $628 million or the amount of reserves in excess of 6 percent of the PHAs’ annual budgetary authority as of December 31, 2012. (Final action target date is April 30, 2014; reported in ARCATS as 2A.) 2.b Develop, implement, and document methodologies to calculate and track performance measures to enable comparability of data among MTW PHAs and ensure the reliability of reported data. (Final action target date is April 30, 2014; reported in ARCATS as 2C.) 2.c Develop, implement, and document standardized reporting requirements for the MTW data and results for all MTW PHAs. (Final action target date is December 31, 2013; reported in ARCATS as 2D.) 100 2.d Update the MTW plan and report review procedures to include steps to verify the reliability of presented data against HUD systems and retain all supporting documentation as evidence of controls performed. (Final action target date is December 31, 2013; reported in ARCATS as 2E.) 2.e Ensure that the staffing and funding levels for the MTW program office are adequate to provide proper oversight of the program. (Final action target date is December 31, 2014; reported in ARCATS as 2F.) With respect to the significant deficiency that HUD’s internal control over financial reporting had serious weaknesses, we recommended that OCFO 3.a Revise HUD’s Debt Collection Handbook 1900.25, REV-4, to include comprehensive procedures to ensure that amounts to be repaid from program monitoring findings, repayment agreements, and other binding documents are communicated to the accounting center for timely accrual of receivables. (Final action target date is November 29, 2013; reported in ARCATS as 3B.) 3.b Develop and implement formal financial management policies and procedures to require an annual evaluation by OCFO and applicable program offices of all allowance for loss rates and other significant estimates currently in use to ensure appropriateness. (Final action target date is November 29, 2013; reported in ARCATS as 3C.) With respect to the significant deficiency that CPD’s information and communication systems had weaknesses, we recommended that CPD 4.a Develop internal controls to review field office compliance more frequent than every 4 years, especially when findings have been identified in the past, and to ensure that action plans operate effectively and have addressed the deficiencies noted so that noncompliance is not repeated during the next quality management review. (Final action target date is January 31, 2014; reported in ARCATS as 4B.) With respect to the significant deficiency that HUD’s oversight of the administrative control of funds process had weaknesses, we recommended that OCFO 5.a In coordination with the Office of the Deputy Secretary, emphasize the importance of financial management for the administrative control of funds. (Final action target date is March 15, 2014; reported in ARCATS as 5A.) 5.b Work with program offices to follow HUD’s Policies Handbook 1830.2 procedures to ensure that funds control plans are complete, accurate, and 101 updated in a timely manner throughout the appropriation life cycle. (Final action target date is March 15, 2014; reported in ARCATS as 5B.) 5.c Perform compliance reviews of all approved funds control plans on a 5-year cycle. (Final action target date is November 29, 2013; reported in ARCATS as 5C.) With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that CPD 6.a Review the status of these expired contracts, which make up the $50.6 million, and recapture excess funds for the contracts that have not been granted extensions. (Final action target date is October 18, 2013; reported in ARCATS as 6A.) 73 6.b Review the 270 obligations with remaining balances totaling $432,147 and close out and deobligate amounts tied to obligations that are no longer valid or needed. (Final action target date is October 18, 2013; reported in ARCATS as 6B.)73 With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that OCHCO 6.c Review the 714 obligations with remaining balances totaling $8,428,808 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Additionally, the $448,022 in five obligations marked for deobligation should be deobligated. (Final action target date is December 31, 2013; reported in ARCATS as 6E.) With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that OCIO 6.d Review the 357 obligations with remaining balances totaling $6,832,833 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Additionally, the $618,560 in 45 obligations marked for deobligation should be deobligated. (Final action target date is December 12, 2013; reported in ARCATS as 6F.) With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that the Office of Fair Housing and Equal Opportunity 73 As of the date of this report, this unimplemented recommendation had a corrective action plan that was overdue for completion. OIG has performed audit follow-up activities to determine the status of the corrective action plan and is working with HUD to ensure that it is completed and the recommendation is addressed. 102 6.e Review the 70 obligations with remaining balances totaling $117,227 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Additionally, $95,857 in three program obligations marked for deobligation should be deobligated. (Final action target date is October 7, 2013; reported in ARCATS as 6K.)73 With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that the Office of Housing 6.f Review the 588 obligations with remaining balances totaling $1,912,078 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Additionally, $10,565,965 in 209 administrative obligations and $145,006 in eight program obligations marked for deobligation should be deobligated. (Final action target date is July 31, 2013; reported in ARCATS as 6L.)75 6.g Review the 69 inactive or expired obligations with $1,202,207 in remaining balances and coordinate with OCFO to deobligate any funds that are determined to be expired or inactive after review. (Final action target date is September 30, 2013; reported in ARCATS as 6O.)73 6.h Deobligate the $2 million in remaining loan obligations for ineligible borrowers under the Emergency Homeowners’ Loan Program. (Final action target date is September 30, 2013; reported in ARCATS as 6P.)73 With respect to the significant deficiency that deficiencies existed in the monitoring of HUD’s unliquidated obligations, we recommended that the Office of Departmental Equal Employment Opportunity 6.i Deobligate $54,982 in three administrative obligations marked for deobligation during the departmentwide open obligations review. (Final action target date is December 30, 2013; reported in ARCATS as 6Q.)73 With respect to HUD’s substantial noncompliance with the Antideficiency Act, we recommend that the OCFO 7.a. Establish policies and procedures for ensuring that investigators and all individuals involved in the review or concurrence process do not have any personal or external impairment that would affect their independence and objectivity in conducting ADA reviews and investigations. (Final action target date is March 15, 2014; reported in ARCATS as 9A.) 7.b. For current and future investigations, determine the qualifications and independence of personnel used at each stage of the investigation. (Final action target date is March 15, 2014; reported in ARCATS as 9B.) 103 7.c. Issue a legislative request for funding for additional staffing or to have ADA investigations conducted by an independent external organization. (Final action target date is November 29, 2013; reported in ARCATS as 9C.) Additional Details To Supplement Our Report on HUD’s Fiscal Years 2011 and 2010 Financial Statements, 2012-FO-0003 With respect to the significant deficiency that HUD needs to improve the process for reviewing obligation balances, we recommended that CPD 8.a Review the status of each of its homeless assistance contracts that make up the $32 million OIG identified as excess funding and recapture excess funds for expired contracts that have not been granted extension. (Final action target date was February 6, 2013; reported in ARCATS as recommendation 2B.)73 8.b Fully implement the internal control procedures and control activities that were drafted as a result of the fiscal year 2010 audit finding, which include specific policies, procedures, and mechanisms, including appropriate documentation of extensions granted and follow-up efforts with the grantees to obtain the closeout documents, to ensure that grants are closed out within the 90-day period after the contract expiration or after the extension period so that remaining balances are periodically recaptured. (Final action target date was February 6, 2013; reported in ARCATS as recommendation 2C.)73 With respect to the significant deficiency that HUD needs to improve its administrative control of funds, we recommended that OCFO 9.a Establish and implement procedures to ensure that all program codes that disburse HUD’s funds have complete and approved funds control plans before the funds can be disbursed. (Final action target date was April 27, 2013; reported in ARCATS as recommendation 4A.)73 9.b Establish and implement procedures to ensure that the funds control plans are updated to include the new program codes and new appropriation requirements. (Final action target date was April 27, 2013; reported in ARCATS as recommendation 4B.)73 104 9.c Develop and implement a 3-year cycle of funds control compliance reviews for all approved funds control plans by completing the assessments of one- third of approved funds control plans each fiscal year. (Final action target date was March 29, 2013; reported in ARCATS as recommendation 4C.)73 With respect to the significant deficiency that HUD needs to continue improving its oversight and monitoring of subsidy calculations, intermediaries’ performance, and use of Housing Choice Voucher and operating subsidy program funds, we recommended that PIH’s 10.a. Office of Housing report on income discrepancies at the 100 percent threshold level as a supplemental measure; assign staff to review the deceased single-member household and income discrepancy reports at least quarterly and follow up with owners and management agents (O-A) listed on these reports; and include in the contract between HUD and O-As a provision for improper payments that requires to resolve in a timely manner income discrepancies, failed identity verifications, and cases of deceased single-member households. (Final action target date is April 1, 2014; reported in ARCATS as recommendation 5B.) Additional Details To Supplement Our Report on HUD’s Fiscal Years 2010 and 2009 Financial Statements, 2011-FO-0003 With respect to the significant deficiency that HUD’s financial management systems need to comply with Federal financial management system requirements, we recommended that CPD 11.a Cease the changes being made to IDIS Online for the HOME program related to the FIFO rules until the cumulative effect of using FIFO can be quantified on the financial statements. (Final action target date is June 15, 2015; reported in ARCATS as recommendation 1A.) 11.b Change IDIS Online so that the budget fiscal year source is identified and attached to each activity from the point of obligation to disbursement. (Final action target date is June 15, 2015; reported in ARCATS as recommendation 1B.) 11.c Cease the use of FIFO to allocate funds (fund activities) within IDIS Online and disburse grant payments. Match outlays for activity disbursements to the obligation and budget fiscal source year in which the obligation was incurred and in addition, match the allocation of funds (activity funding) to the budget fiscal year source of the obligation. (Final 105 action target date is June 15, 2015; reported in ARCATS as recommendation 1C.) 11.d Include as part of the annual CAPER [consolidated annual performance and evaluation report] a reconciliation of HUD’s grant management system, IDIS Online, to grantee financial accounting records on an individual annual grant basis, not cumulatively, for each annual grant awarded to the grantee. (Final action target date is June 15, 2015; reported in ARCATS as recommendation 1D.) With respect to the significant deficiency that HUD needs to improve the process for reviewing obligation balances, we recommended that OCFO, in coordination with the appropriate program offices, 12.a Review the 510 obligations that were not distributed to the program offices during the open obligations review and deobligate amounts tied to closed or inactive projects, including the $27.5 million we identified during our review as expired or inactive. (Final action target date was October 31, 2011; reported in ARCATS as recommendation 2C.)73 With respect to the significant deficiency that HUD needs to improve the process for reviewing obligation balances, we recommended that the OCFO, in coordination with PIH, 12.b Recapture the full amount of obligations from these 434 PIH low-rent grants totaling $174 million and return to the U.S. Treasury the total balance of budgetary resources from invalid grants. (Final action target date was June 30, 2012; reported in ARCATS as recommendation 2N.)73 With respect to the significant deficiency that CPD needs to improve its oversight of grantees, we recommended that CPD 13.a. Review the status of each of its homeless assistance contracts that make up the $97.8 million OIG identified as excess funding and recapture excess funds for expired contracts that have not been granted extensions. (Final action target date was March 16, 2012; reported in ARCATS as recommendation 4A.) 73 With respect to the significant deficiency that HUD needs to improve its administrative control of funds, we recommended that OCFO 14.a Establish and implement procedures to ensure accuracy and completeness of ARRA funds control plans. (Final action target date was December 30, 2011; reported in ARCATS as recommendation 5B.)73 106 14.b Conduct periodic reviews of the program offices’ compliance with requirements of the funds control plans. (Final action target date was December 30, 2011; reported in ARCATS as recommendation 5D.)73 With respect to the significant deficiency that HUD needs to improve its administrative control of funds, we recommended that OCFO, in coordination with the appropriate program offices, 15.a Develop and implement funds control plans for any program found to be without an up-to-date funds control plan. (Final action target date was December 30, 2011; reported in ARCATS as recommendation 5J.)73 With respect to HUD’s substantial noncompliance with ADA, we recommended that OCFO, in coordination with the appropriate program offices, 16.a Complete required steps on the six known potential ADA issues and report those determined to be violations immediately to the President, Congress, and GAO as required by 31 U.S.C. (United States Code) and OMB Circular A-11. (Final action target date was December 30, 2011; reported in ARCATS as recommendation 6A.)73 16.b Investigate the potential ADA violation and other interagency agreements that were similarly executed. If the investigation determines that an ADA violation occurred, immediately report it to the President, Congress, and GAO as required by 31 U.S.C. and OMB Circular A-11. (Final action target date was December 30, 2011; reported in ARCATS as recommendation 6B.)73 Additional Details To Supplement Our Report on HUD’s Fiscal Years 2009 and 2008 Financial Statements, 2010-FO-0003 With respect to HUD’s substantial noncompliance with ADA, we recommended that OCFO, in coordination with the appropriate program offices, 17.a Complete the investigations and determine whether ADA violations have occurred and if an ADA violation has occurred, immediately report to the President, Congress, and GAO. (Final action target date was March 11, 2011; reported in ARCATS as recommendation 5A.)73 107 17.b Report the six ADA violations immediately to the President, Congress, and GAO, as required by 31 U.S.C. and OMB Circular A-11, upon receiving OCFO legal staff concurrence with the investigation results. (Final action target date was March 16, 2011; reported in ARCATS as recommendation 5B.)73 108 APPENDIXES Appendix A SCHEDULE OF FUNDS TO BE PUT TO BETTER USE Recommendation Funds to be put number to better use 1/ 2A $643,600,000 8A 50,900,000 8B 14,742,564 8D 21,255,197 8E 9,300,000 8F 26,000,000 8G 1,337,015 8H 11,000,000 8J 12,710,563 8K 3,117,373 8N 7,300,000 8O 7,263,662 8P 85,544 8Q 71,274 8R 88,604 8S 10,684 8T 3,488,009 8U 145,060 8V 26,829 8W 11,420 8X 166,083 8Y 132,080 8Z 7,391 11C 24,300,000 11D 47,900,000 11G 17,900,000 Total $902,859,352 1/ Recommendations that funds be put to better use are estimates of amounts that could be used more efficiently if an Office of Inspector General (OIG) recommendation is implemented. These amounts include reductions in outlays, deobligation of funds, withdrawal of interest, costs not incurred by implementing recommended improvements, avoidance of unnecessary expenditures noted in preaward reviews, and any other savings that are specifically identified. 109 Appendix B FEDERAL FINANCIAL MANAGEMENT IMPROVEMENT ACT NONCOMPLIANCE, RESPONSIBLE PROGRAM OFFICES, AND RECOMMENDED REMEDIAL ACTIONS This appendix provides details required under FFMIA reporting requirements. To meet those requirements, we performed tests of compliance using the implementation guidance for FFMIA issued by OMB and GAO’s Financial Audit Manual. The results of our tests disclosed that HUD’s systems did not substantially comply with requirements. OIG determined 7 74 of 39 HUD financial management systems did not substantially comply with FFMIA because they failed to meet one or more of the required elements for compliance under FFMIA Section 803. However, HUD’s annual assurance statement reported five nonconforming systems because HUD took exceptions to two non-FFMIA compliant systems, HUD Central Accounting and Program System and HUD Integrated Acquisition Management System (HIAMS). The details about non- FFMIA compliant systems, responsible parties, primary causes, and HUD’s intended remedial actions are included in the following sections. Federal Financial Management Systems Requirements The organizations responsible for systems that were found not to comply with the requirements of OMB Circular A-127 based on HUD’s assessments are as follows: Responsible office Number of Nonconforming compliant systems systems Office of Housing 16 0 Office of the Chief Financial Officer 13 1 Office of Chief Human Capital Officer 1 1 Office of the Chief Procurement Officer 1 3 Office of Community Planning and Development 2 1 Office of Public and Indian Housing 1 0 Government National Mortgage Association 0 1 Totals 34 5 We have summarized HUD’s plan to correct noncompliance with OMB Circular A-127 as submitted to us as of September 30, 2013. 74 The seven non-FFMIA-compliant systems include are (1) A35-HUD Procurement System (HPS), (2) P035-Small Purchase System (SPS), (3) D67A-Facilities Integrated Resources Management System (FIRMS), (4) C04 – Integrated Disbursement and Information System Online (IDIS Online), (5) P237 – Ginnie Mae Financial Accounting and Program System (GFAS), (6) A75 – HUD Central Accounting and Program System (HUDCAPS), and (7) P273 – HUD Integrated Acquisition Management System (HIAMS). 110 Integrated Disbursement & Information System Online (IDIS Online) - Since fiscal year 2010, OIG reported that C04 –IDIS Online was noncompliant with the requirements of FFMIA, as a result of its use of the First-In, First-Out (FIFO) method to account for and disburse formula grant obligations. However, fiscal year 2013 is the first year that HUD’s annual assurance statement, issued pursuant to Section 4 of the Financial Manager’s Integrity Act, reported IDIS Online as noncompliant. HUD will therefore modify IDIS Online to eliminate the FIFO accounting method. The Office of Community Planning and Development is responsible for IDIS Online. CPD has begun efforts to eliminate FIFO within IDIS by drafting a FIFO Elimination Plan dated September 20, 2013 and will provide a remediation plan to resolve the FFMIA noncompliance issues. Facilities Integrated Resources Management System (FIRMS) – In fiscal year 2009, OIG identified weaknesses related to HUD’s control over acquisition of accountable equipment and property management system and made four audit recommendations. The Office of Chief Human Capital Officer (OCHCO) is responsible for FIRMS. One of the four audit recommendations remains unimplemented as of September 30, 2013; recommendation 2A, which deals with system interfaces with the core financial system and the acquisition system. According to OCHCO, remediating FIRMS is progressing, by way of a short term maintenance contract to correct and upgrade the FIRMS system. OCHCO anticipates being able to furnish a complete accurate depreciation report once a nationwide inventory is completed and reconciled by February 14, 2014. HUD Procurement System (HPS) and Small Purchase System (SPS) - For several years, HUD reported the HUD Procurement System (HPS) and Small Purchase System (SPS) as substantially noncompliant systems. The Office of the Chief Procurement Officer (OCPO) is responsible for HPS and SPS. In fiscal year 2012, OCPO began implementing a new procurement system, the HUD Integrated Acquisition Management System (HIAMS), to replace HPS and SPS. However, as of August 27, 2013; OCPO was still closing actions out in HPS and SPS and de-activating users that are not needed for close out. Upon the completion of migrating and validating data into HIAMs Enterprise Acquisition Reporting Tool Data warehouse, HPS/SPS will begin decommissioning, with anticipated completion by end of fiscal year 2014. Ginnie Mae Financial & Accounting System (GFAS) – In fiscal year 2013, the OIG determined that GFAS was not substantially compliant with FFMIA due to the fact that GFAS (as a core system) was not currently configured to support Ginnie Mae’s accounting and reporting requirements for its budgetary resources. Government National Mortgage Association is responsible for GFAS. To substantially comply with FFMIA, the financial management system must comply with the US Standard General Ledger (USSGL) at the transaction level. This means that each occurrence of a financial event affecting the budgetary resources should be recorded in the system at the transaction level according to USSGL guidance. Ginnie Mae uses a manual process to generate the Statement of Budgetary Resources (SBR). GNMA prepared a remediation plan to bring GFAS into substantial compliance with FFMIA by June 30, 2014. 111 Appendix C AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 Comment 2 112 Ref to OIG Evaluation Auditee Comments Comment 3 Comment 4 Comment 5 Comment 6 Comment 7 113 Ref to OIG Evaluation Auditee Comments 114 OIG Evaluation of Auditee Comments Comment 1 While HUD management did not provide formal and additional detailed comments to all reported control deficiencies and compliance with laws and regulations, they indicated agreement with most of OIG’s conclusions. Accordingly, OIG looks forward to reviewing HUD’s progress in establishing an effective financial management governance structure, timely and accurate recording of accounts receivables and accruals of expenses incurred for grants and administrative costs, improvement in HUD’s administrative control of funds over all obligations and disbursements, reductions in unliquidated obligations, improvement over monitoring of HUD’s RHAP and EHLP programs, as well as eliminating information security and business application control deficiencies. Additionally, we will again review HUD’s progress on improving its compliance with FFMIA, Antideficiency Act, HOME Investment Act, as well as FISMA. Comment 2 Our office will review, evaluate, and report on CPD’s progress on implementing corrections to CPD’s system to provide for GAAP, budgetary, and statutory compliant transaction processing. OIG would like to emphasize that due to the cumulative method for determining program compliance and FIFO for disbursement of obligations, all of the current funded activities were subjected to processing which more likely than not did used the incorrect source of funds. As a result, HUD’s Statement of Budgetary Resources will be materially misstated until the current portfolio of activities no longer makes up a material amount of undisbursed obligations, unless HUD develops a methodology to reasonably estimate appropriate adjustments needed to correct the errors and completes a restatement related to this issue. Comment 3 OIG appreciates HUD’s commitment to properly account for PIH’s Housing Choice Voucher Program (HCVP) Cash Management Process in accordance with Federal GAAP. If PIH is able to design and implement appropriate internal controls over financial reporting and appropriate Federal GAAP accounting; our concerns over the lack of detailed transaction level data, reliability of estimates, and improper classification/presentation and valuation of assets should be resolved in fiscal year 2014. In regards to our inability to apply necessary audit procedures over the accounting adjustments performed, HUD provided two methodologies for estimating NRA and VMS expenses. At the beginning of November, HUD provided the methodology for the NRA report. This is an old methodology we have reviewed in the past, where HUD estimates the amount of unused Section 8 NRA funds held by the PHAs. This methodology does not include the accounting policies for financial reporting. On November 19th, HUD provided an updated methodology which included considerations for the cash management, monitoring reviews, and accounting procedures. Compliance with our audit standards required OIG to evaluate and perform audit testing on the methodology’s assumptions. In the case of the mid November submission we needed to audit the estimate to validate that 115 the $902 million and $534 in additional Advances and Program Cost recognized for fiscal years 2012 and 2013, were accurate and complete and that these expenses actually were paid by the PHAs from their NRA accounts. OIG cannot validate that PHAs actually paid $1.5 billion in additional program expenses from their NRA accounts by just comparing the change in the NRA balance estimated in NRA reports at different points in time. OIG notified HUD about this issue in August; however, it was late October when HUD discussed what type of adjustments would be made and late November when OCFO recorded adjustments to recognize this activity on the financial statements. Providing the methodology at the beginning of November did not allow sufficient time to complete the necessary audit procedures we deemed necessary to determine if the estimates recorded were reasonable. Further, OCFO continued to make additional adjustments to recognize the activity after the first set of adjustments were made which required validation. This involves not only reading the journal entries and methodologies, but it would also involve planning necessary audit steps, and requesting, gathering, and evaluating the additional evidence. In addition, OIG reviewed the OMB Circular A-133 Single Audit Act compliance supplement for the Section 8 Program. We concluded that PIH reliance of IPA audits is not substantiated by the suggested audit steps in the circular. The audit steps did not specifically require IPAs to audit VMS submissions to ensure that expenditures are reconciled with the check registers and PIC tenant data. We agree that PIH performed a confirmation of PHAs NRA after OIG recommended to improve the monitoring of PHAs VMS reporting. However, this effort began in 2009 and ended in 2011. This effort should have been performed annually. According to a REAC memorandum to the PIH, there are concerns that many PHAs did not have the cash on hand or available to support the NRA balance estimated by PIH. We concluded that this could be part of the reasons for postponing the NRA Transition to HUD. Since the implementation of the Section 8 Fixed-Budget methodology in 2005, OIG has been providing recommendations to improve the utilization of funds monitoring and enhance the safeguarding of the Program resources. OIG has recommended more frequent reconciliation of PHAs accounts and perform additional reviews of PHAs NRA accounts. We acknowledge HUD’s progress for improving the monitoring activities in this area. However, the implementation of Treasury rules for cash management required HUD to account and report for PHAs NRA funds in HUD’s financial statements. This change elevates HUD’s requirements for providing assurances of internal controls in financial reporting from Program’s monitoring controls to compliance with the CFO Act, Federal GAAP and OMB Circular A-123 compliance with financial reporting requirements. Consequently, HUD’s monitoring based data is now subject to auditing standards, which is different than in prior years. As a result, this year OIG readjusted the audit and considered the current applicable laws and regulations HUD needs to comply with. 116 Comment 4 During our review, we noted that QAD efforts were undermined by reduction in staff and travel resources. QAD indicates that they managed their limited staffing and resources by targeting the PHAs with the highest risk. We continue to question why PIH could not allocate $500 thousand to complete the travel funds requested to perform onsite reviews to improve the quality of data on which they are relying to operate a $16 billion program. Comment 5 We acknowledge that HUD is developing new systems. However, this should not prevent PIH and OCFO to work together in finding a cost effective (temporary) solutions to properly account and report for the PHAs NRA balances. The implementation of the new systems does not address the need for additional resources required for maintaining adequate monitoring controls over the VMS data. Comment 6 OIG will continue to monitor HUD’s progress in replacing its noncompliant core financial management system. With the decision to place the application at a shared service center starting in fiscal year 2015, OIG will monitor the planned changes in business processes and any impact on fiscal year 2014 accounting operations and financial reporting. Comment 7 We plan to evaluate HUD’s implementation of the GFAS system’s budgetary accounting module in the fiscal year 2014 audit. Comment 8 While we agree that HIAMS performs the reservation and obligation core functions, in general, we disagree with the comments from OCFO. HIAMS is the only application currently in use within HUD with the capability to record the acceptance and delivery data necessary to perform the core functional requirements related to the payment management function. The acquisition software in use by the department has the capability to record acceptance and delivery data but that functionality is not being used. HUDCAPS, the Department’s current core application, is capable of performing the core functions, but would require changes to its configuration, interfaces, business processes, and how users utilize the application. In addition, a coordinated effort between HUDCAPS and HIAMS is required in order for HUDCAPS to be able to perform the core functions as mandated. The OCPO comments point to the functionality in HIAMS as being a duplication of the functionality in the new core financial application. However, the Department does not yet have a new core financial application. The acquisition software that makes up HIAMS was designed to interface with the core financial system to allow utilization of this data by both applications. At this time, HUD is not collecting the data and it is therefore unable to be utilized by either application. While we agree that HIAMS does not perform the payment management functions cited, we do not agree that HIAMS is not required to perform the functions. Our audit found that HIAMS does not electronically send the 117 necessary financial data to HUDCAPS to enable the OCFO to perform the payment functions required by a core financial system because HIAMS does not collect the data. HIAMS also does not interface with HUDCAPS for payment related information, and therefore cannot leverage the information in the core financial system related to invoices and payments by pulling the information processed in HUDCAPS back into HIAMS. Instead, HIAMS obtains invoice and payment information from the Financial DataMart. 118
Additional Details To Supplement Our Report on HUD's Fiscal Years 2013 and 2012 (Restated) Financial Statements
Published by the Department of Housing and Urban Development, Office of Inspector General on 2013-12-16.
Below is a raw (and likely hideous) rendition of the original report. (PDF)