U.S. Department of Housing and Urban Development, Washington, DC Compliance With the Improper Payments Elimination and Recovery Act Office of Audit, Financial Audits Division Audit Report Number: 2015-FO-0005 Washington, DC May 15, 2015 To: Brad R. Huther, Chief Financial Officer, F /s/ From: Thomas R. McEnanly, Director of Financial Audits Division, GAF Subject: HUD Did Not Comply With IPERA Due to Significant Deficiencies in Its Reporting and Risk Assessment Processes Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of HUD’s fiscal year 2014 compliance with the Improper Payments Elimination and Recovery Act of 2010. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. Audit Report Number: 2015-FO-0005 Date: May 15, 2015 HUD Did Not Comply With IPERA Due to Significant Deficiencies in Its Reporting and Risk Assessment Processes Highlights What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2014 compliance with the Improper Payments Elimination and Recovery Act of 2010 (IPERA). IPERA was enacted to eliminate and recover improper payments by requiring agencies to identify and report on programs that are susceptible to significant improper payments. IPERA also requires each agency’s inspector general to perform an annual review of the agency’s compliance with IPERA. Our audit objectives were to (1) determine HUD’s compliance with IPERA reporting and improper payments reduction requirements; (2) determine whether HUD’s reporting of improper payments data, including the agency’s performance in reducing and recapturing improper payments, was complete and accurate; and (3) determine whether HUD’s assessment of the level of risk associated with high-priority programs and the quality of the improper payments estimates and methodology were reasonable. What We Found HUD did not comply with IPERA for fiscal year 2014. Specifically, HUD did not adequately report on its supplemental measures and its risk assessment did not include a review of all relevant audit reports nor did it consider the dollar amounts associated with OIG and GAO audit reports or HUD’s program monitoring findings. Additionally, HUD’s estimate of improper payments for the billing error component was based on out-of-date information, and the methodology for developing the estimate did not include an evaluation of all types of errors that could lead to significant improper payments. Finally, HUD’s noncompliance with IPERA reported in fiscal year 2013 continued and 18 recommendations from our fiscal year 2013 IPERA compliance report remained open. What We Recommend We recommend that HUD (1) implement procedures to ensure that all required improper payments reporting elements are included in its annual financial report and all relevant OIG and GAO audit reports are considered in its risk assessments, (2) consider the dollar amounts related to OIG and GAO audit reports and HUD’s program monitoring findings in its risk assessment, and (3) reevaluate the types of errors previously identified to determine whether there are new causes of significant improper payments that would require reporting. Table of Contents Background and Objectives ....................................................................................3 Results of Audit ........................................................................................................5 Finding 1: HUD Did Not Comply With IPERA ............................................................ 5 Finding 2: HUD Did Not Completely and Accurately Report All Information on Improper Payments and Its Recovery Efforts ............................................................... 8 Finding 3: HUD’s Improper Payments Risks Assessments Had Deficiencies .......... 10 Finding 4: HUD’s Improper Payments Estimate Was Based on Outdated Information ...................................................................................................................... 13 Scope and Methodology .........................................................................................15 Internal Controls ....................................................................................................17 Follow-up on Prior Audits.....................................................................................18 2 Background and Objectives The Improper Payments Information Act of 2002 (IPIA) required the head of each agency to (1) annually review all programs and activities the agency administered, (2) identify all programs and activities that might be susceptible to significant improper payments, (3) estimate the annual amount of improper payments for each program or activity identified as susceptible, and (4) report those estimates. For programs with estimated improper payments exceeding $10 million, IPIA required agencies to report the causes of the improper payments, actions taken to correct those causes, and results of the actions taken. IPIA was amended in July 2010 by the Improper Payments Elimination and Recovery Act (IPERA). IPERA decreased the frequency with which each agency was required to review all of its programs but increased the responsibilities and reporting requirements to eliminate and recover improper payments. It also required each agency inspector general to determine whether the agency complied with IPERA. IPIA was further amended by the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA). IPERIA further strengthened the reporting requirements of IPIA and IPERA by setting standards for agencies to follow in determining the validity of sampled payments to ensure that amounts being billed, paid, or obligated for payment were proper. Under IPERIA, the inspector general is required to review (1) the assessed level of risk associated with high-priority programs as determined by the Office of Management and Budget (OMB), (2) the quality of the improper payments estimates and methodology, and (3) the agency’s oversight or financial controls to identify and prevent improper payments. The inspector general is then required to submit to Congress recommendations for modifying any agency plans relating to improper payments determination and estimation methodology. IPERIA also established the Do Not Pay Initiative, requiring each agency to review prepayment and preaward procedures to ensure that a thorough review of available databases with relevant information on eligibility is performed to determine program or award eligibility before the release of Federal funds. OMB issued Circular A-123, Appendix C, Requirements for Effective Estimation and Remediation of Improper Payments, to provide guidance for agencies in the implementation of IPIA, IPERA, and IPERIA requirements. The U.S. Department of Housing and Urban Development’s (HUD) Secretary designated the Chief Financial Officer as the lead official for overseeing HUD actions to address improper payments issues and complying with IPERA requirements. The responsibility for conducting an agencywide IPERA program risk assessment is jointly shared by the Federal Housing Administration’s (FHA) Office of the Comptroller and the Office of the Chief Financial Officer (OCFO). Historically, none of the FHA programs has been determined to be susceptible to improper payments. 3 HUD identifies the public housing, tenant-based voucher,1 and project-based assistance2 programs (collectively referred to as the rental housing assistance programs (RHAP)) as susceptible to significant improper payments. In these programs, beneficiaries pay 30 percent of their adjusted income toward the market rent and HUD subsidizes the remainder of the rental cost (or the operating cost in the case of public housing). HUD has identified the following three sources of error and improper payments in RHAP: • Program administrator error – The program administrator’s failure to properly apply income exclusions and deductions and correctly determine income, rent, and subsidy levels; • Tenant income reporting error – The tenant beneficiary’s failure to properly disclose all income sources and amounts upon which subsidies are determined; and • Billing error – Errors in the billing and payment subsidies due between HUD and third-party program administrators or housing providers. In consultation with OMB, HUD developed supplemental measures to track and report on intermediaries’ efforts in addressing improper payments. HUD provided the details of these supplemental measures in its accountable official report to the Office of Inspector General (OIG). All of HUD’s supplemental measures are reported quarterly on OMB’s payment accuracy Web site. HUD calculated its estimated annual improper payments amount using a quality control study, an income match study, and a billing study conducted by independent contractors. The quality control and income match studies were conducted using data from the prior fiscal year (fiscal year 2013). However, the billing studies used estimates from fiscal year 2004 for public housing and fiscal year 2009 for the owner-administrator program. Due to the increased scrutiny and requirements for agencies to report on their improper payments, OIG plans to start identifying and tracking potential improper payments identified in its audits for fiscal year 2015 and forward. Our objectives were to (1) determine HUD’s compliance with IPERA’s reporting and improper payments reduction requirements, (2) evaluate the accuracy and completeness of HUD’s reporting of improper payments data, and (3) evaluate HUD’s assessment of the level of risk associated with high-priority programs and the quality of the improper payments estimates and methodology. 1 HUD’s Office of Public and Indian Housing (PIH) is the office responsible for the oversight of the Public Housing Operating Fund and the Section 8 tenant-based voucher RHAP. PIH allocates and disburses funding to the State and local public housing agencies that administer the program in accordance with program eligibility requirements. 2 HUD’s Office of Multifamily Housing (Multifamily Housing) is responsible for the Section 8, 202, and 236 project-based RHAP. It allocates and disburses funding to multifamily project owners or their agents that administer the program in accordance with the applicable eligibility requirements. 4 Results of Audit Finding 1: HUD Did Not Comply With IPERA HUD did not comply with the IPERA reporting and improper payments reduction requirements for fiscal year 2014. HUD did not include all information required by OMB in its agency financial report in accordance with IPERA, and there were significant deficiencies related to the accuracy, completeness, and quality of HUD’s improper payments risk assessments and improper payments estimate. HUD did not include all information required by OMB in its agency financial report because it did not have documented procedures to ensure the reporting of complete and accurate information. HUD’s risk assessments did not comply with IPERA requirements because HUD relied on a management report that did not include the most recently issued OIG audit report and the risk assessments were performed using a template that did not take into account the dollar amounts associated with OIG and U.S. Government Accountability Office (GAO) audit reports nor the dollar amounts associated with HUD’s program monitoring reviews. As a result, HUD’s risk assessments may have underestimated the risk of significant improper payments, and its estimate of improper payments may have been misstated. HUD’s Published Agency Financial Report Did Not Include All IPERA Required Reporting Elements HUD did not comply with section 3(a)(3)(A) of IPERA which requires agencies to publish an agency financial report and any accompanying materials required under OMB guidance on their Web site. While HUD published an agency financial report and accompanying materials, entitled “IPIA (as amended by IPERA) Reporting Details,” on March 3, 2015, HUD did not include all of the information required by OMB Circular A-123, appendix C. Specifically, HUD did not include an adequate discussion of its supplemental measures. This deficiency is discussed in finding 2. HUD Did Not Conduct Compliant Program Specific Risk Assessments HUD did not comply with section 3(a)(3)(B) of IPERA which states that if required, agencies must conduct a program-specific risk assessment for each program or activity that conforms with section 2(a) of IPIA (31 U.S.C. (United States Code) 3321). While HUD performed program- specific risk assessments, there were significant deficiencies in the completeness and quality of the risk assessments performed by HUD’s OCFO that were significant enough to not comply with section 3(a)(3)(B) of IPERA. Specifically, the Office of Community Planning and Development’s (CPD) formula grant programs were not appropriately considered in HUD’s risk assessment, based on material findings reported in OIG audit reports. These deficiencies are discussed in detail in finding 3. FHA conducted a comprehensive risk assessment for all of its disbursement programs in fiscal year 2013. During fiscal year 2014 FHA conducted a review of internal control documents, performed statistical sampling and a review of statistically sampled case binders, and analyzed disbursement programs. 5 HUD Published Improper Payments Estimates HUD complied with section 3(a)(3)(C) of IPERA, which states that agencies must publish improper payments estimates for all programs identified as being susceptible to significant improper payments, if required. HUD published an improper payments estimate for RHAP, the only programs it identified as susceptible to significant improper payments, in its fiscal year 2014 agency financial report. While HUD published an improper payments estimate for RHAP, there were deficiencies in the methodology for preparing the estimate, which are discussed in finding 4. HUD Published Programmatic Corrective Action Plans HUD complied with section 3(a)(3)(D) of IPERA, which requires agencies to publish corrective action plans, prepared under section 2(c) of IPIA, for programs identified as susceptible to significant improper payments. For RHAP, HUD included in its fiscal year 2014 agency financial report a discussion of the causes of improper payments, actions taken to correct those causes, and results of the actions taken to address those causes. HUD Published and Met Its Annual Reduction Target HUD complied with section 3(a)(3)(E) of IPERA, which requires agencies to publish and meet annual improper payment reduction targets for programs identified as susceptible to significant improper payments. HUD published an improper payments rate for RHAP of 3.2 percent, which was lower than its published reduction target of 4.2 percent. HUD Reported an Improper Payments Rate of Less Than 10 Percent HUD complied with section 3(a)(3)(F) of IPERA, which requires agencies to report improper payments rates of less than 10 percent for each program for which an estimate was published. HUD published an improper payments rate of 3.2 percent for RHAP in its fiscal year 2014 agency financial report, well below the threshold of 10 percent. HUD’s IPERA Noncompliance for Fiscal Year 2013 Continued, and Recommendations Remained Open OIG cited HUD as noncompliant with IPERA for its fiscal year 2013 reporting. 3 Specifically, HUD was noncompliant with IPERA because it did not (1) meet its annual reduction target; (2) accurately report on billing and component error rates; (3) accurately and sufficiently report on its efforts to recover improper payments; (4) include all required elements of accountability; and (5) report accurately on its corrective actions, internal controls, human capital, and information systems. OIG’s report on HUD’s fiscal year 2013 IPERA compliance contained 21 recommendations, 18 of which remained open as of the date of this report. Further detail on the open recommendations can be found in the Follow-up on Prior Audits section of this report. 3 Audit report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010. 6 Conclusion HUD did not comply with IPERA for fiscal year 2014. Specifically, HUD did not comply with sections 3(a)(3)(A) or 3(a)(3)(B) as it did not include all information required by OMB in its agency financial report and there were significant deficiencies in its risk assessments. HUD did comply with the remaining four elements of compliance with IPERA. We also noted deficiencies in the completeness and quality of HUD’s methodology for estimating improper payments. These instances of noncompliance and deficiencies are discussed in detail later in this report. Additionally, HUD’s fiscal year 2013 IPERA noncompliance issues were not completely resolved. Recommendations There are no recommendations associated with this finding. Recommendations related to the deficiencies that led to HUD’s noncompliance are included in findings 2 and 3, where the deficiencies are discussed in detail. 7 Finding 2: HUD Did Not Completely and Accurately Report All Information on Improper Payments and Its Recovery Efforts HUD did not completely and accurately report information on supplemental measures or its actions to recover improper payments in its agency financial report in accordance with IPERA and OMB Circular A-123, appendix C. This condition occurred because HUD did not have documented procedures and did not adhere to the reporting guidance in OMB circulars A-123, appendix C and A-136. As a result, HUD officials and other users, including Congress and OMB, did not have a complete and accurate picture for making decisions regarding HUD’s internal controls over improper payments and efforts to recover improper payments. Accordingly, HUD did not comply with the reporting requirements of section 3(a)(3)(A) of IPERA. HUD Did Not Include All Required Reporting Elements for Supplemental Measures in its Agency Financial Report HUD’s fiscal year 2014 agency financial report did not include a summary of its supplemental measures that included all elements required by OMB Circular A-123, appendix C, part III Requirements for Implementing Executive Order 13520. Appendix C, part III, states that agencies shall ensure their agency financial reports contain a basic summary discussing the supplemental measures, the frequency of each supplemental measure (that is, how often will the area be measured and reported on PaymentAccuracy.gov), the measurement baseline, a discussion of how information from this measurement will help the program reduce improper payments, and the actual (or planned) targets, including any reasons for meeting, exceeding, or failing to meet the supplemental targets. HUD lacked documented procedures to ensure the reporting of complete and accurate information, causing the information HUD reported to Congress, OMB, and other users to be incomplete and inaccurate. Additionally, Section 3(a)(3)(A) of IPERA states that compliance with IPERA means the agency published annual financial statements for the most recent fiscal year and posted that report and any accompanying material required by OMB on the agency Web site. Because HUD did not include a summary of its supplemental measures in its agency financial report as required by OMB Circular A-123, appendix C, HUD did not in comply with IPERA. HUD Did Not Report Completely on Its Actions To Recover Improper Payments As noted in our report on HUD’s fiscal year 2013 compliance with IPERA, HUD did not perform recovery audits for all programs that expended more than $1 million or provide an accurate justification for its determination in its agency financial report. HUD’s fiscal year 2014 report stated that HUD was in the process of implementing the recovery audit requirements under IPERIA and that it was still in discussions with OMB regarding the cost effectiveness of recovery audits for the RHAP programs. However, communications we obtained between OMB and HUD showed that OMB believed HUD needed to further research options for performing recovery audits. Additionally, in the fiscal year 2014 agency financial report, there was no discussion of methods for recovering overpayments or summary of how recovered amounts were disposed of. As a result, HUD’s reporting of its efforts to recover improper payments was incomplete and inaccurate, causing users to have an incomplete picture of HUD’s efforts to recover improper payments. 8 Conclusion HUD did not include all information required by OMB in their agency financial report and, therefore, did not comply with IPERA. Additionally, due to the deficiencies in HUD’s reporting on improper payments, HUD officials and other users of the AFR, including Congress and OMB, did not have a complete and accurate picture of HUD’s improper payments and recovery efforts for use in policy-making decisions. Accurate reporting is necessary to convey to Congress, OMB, and the public HUD’s progress in preventing and recovering improper payments. Recommendations We recommend that the Chief Financial Officer 2A. Develop, document, and implement procedures to ensure that all required improper payments reporting elements are included in HUD’s agency financial report, including but not limited to the requirements in OMB Circular A-123, appendix C and OMB Circular A-136. 9 Finding 3: HUD’s Improper Payments Risks Assessments Had Deficiencies In performing its fiscal year 2014 improper payments risk assessments, HUD did not consider relevant OIG audit reports or the dollar amounts associated with OIG audit reports or program monitoring findings. This condition occurred because HUD relied on a management report that did not include the most recently issued OIG audit report and the risk assessments were performed using a template that did not consider the dollar amounts associated with OIG and GAO audit reports or the dollar amounts associated with HUD’s program monitoring reviews. As a result, significant audit findings were not considered, and HUD may have understated the susceptibility of its programs to significant improper payments. As a result, HUD did not comply with IPERA. HUD Did Not Consider All Relevant OIG Audit Reports HUD did not include all relevant OIG audit reports in its fiscal year 2014 improper payments risk assessment. Specifically, OIG audit report 2014-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Year 2013 and 2012 (Restated) Financial Statements, was not considered during the risk assessment of the CPD formula grant programs. This report included a material weakness regarding CPD’s formula grant accounting departure from generally accepted accounting principles, a finding on HUD’s noncompliance with the HOME Investment Partnership Act, and a noncompliance with Federal financial management system requirements on the information system that is used in formula grant program disbursements. These findings indicated potentially significant improper payments. The material weaknesses related to the CPD formula grant accounting’s departure from generally accepted accounting principles was not included in HUD’s risk assessments. HUD prepared an analysis which identified the amount of budget outlays affected by the first in, first out (FIFO) method 4 of accounting for CPD’s formula grant programs. This analysis, prepared in late fiscal year 2013 and updated in fiscal year 2014, identified $46 billion in budget outlays impacted by FIFO. The analysis indicated that payments of approximately $18 billion were made in fiscal years 2013 and 2014 and payments of $5.9 billion were estimated to be made in fiscal year 2015. Further, OIG reported that the information system CPD used to process these transactions did not meet Federal financial management system requirements. A finding of this significance should have been properly assessed by HUD to determine whether the program was susceptible to significant improper payments. The finding on HUD’s noncompliance with the HOME Investment Partnership Act reported that the use of the cumulative method 5 to determine compliance with the commitment requirement 4 Under the FIFO method, disbursements for CPD’s formula grant programs were made using the oldest (first in) funds available, rather than matching the disbursement to the specific funds that were obligated for it. 5 HUD used the cumulative method to determine a grantee’s compliance with section 218(g) of the HOME Investment Partnership Act. HUD measured compliance with the commitment requirement cumulatively, disregarding the allocation year used to make the commitments. 10 was not appropriate. This noncompliance was due to HUD not implementing a legislative change to the HOME Investment Partnerships Program, which took effect in 2002. In fiscal year 2013, OIG estimated that for the 2011 annual allocation commitment requirement, $54.86 million could have possibly been recaptured and reallocated if HUD had used a noncumulative calculation. As a result of the OIG audit report, in fiscal year 2014, HUD agreed to implement the legislative change for fiscal year 2015 grants and forward. This change in practice should have resulted in the reassessment of the susceptibility of improper payments in the HOME program in HUD’s risk assessment. Further, OIG believes HUD’s consideration of its findings would have resulted in the HOME program meeting the requirements to be considered susceptible to significant improper payments; therefore, it should have been included in HUD’s overall improper payments estimate. Section 2(a)(3)(B)(vii) of IPERA states that significant deficiencies in the audit report of the agency or other relevant management findings that might hinder accurate payment certification should be considered in conducting the improper payments risk assessments. OMB Circular, appendix C, which implements the requirements of IPERA, states that agencies should consider significant deficiencies in the audit reports of the agency, including but not limited to, the agency inspector general or GAO audit report findings or other relevant management findings, that might hinder accurate payment certification. It further states that for programs deemed to be at low risk of significant improper payments, agencies must perform risk assessments at least once every 3 years. However, if a low-risk program experiences a significant change in legislation or a significant increase in its funding level, agencies are required to reassess the program’s risk susceptibility during the next annual cycle, even if it is less than 3 years from the last risk assessment. Additionally, appendix C states that recent major changes in program funding, authorities, practices, or procedures must be considered when performing a risk assessment. HUD staff stated that OIG audit report 2014-FO-0003 was not included in the management report used to identify relevant audit reports and findings for its fiscal year 2014 improper payments risk assessment. Additional steps were not taken to identify OIG audit reports that were recently issued but not included in the management report. As a result, HUD may have understated the susceptibility of its programs to significant improper payments. HUD Did Not Consider the Dollar Amounts Associated With OIG or GAO Audit Reports or Program Monitoring Findings HUD did not consider the dollar amounts associated with OIG or GAO audit reports or program monitoring reviews conducted by HUD management when performing its improper payments risk assessments. HUD considered only the number of audit reports issued when determining a program’s susceptibility to improper payments. HUD staff members stated that they followed the risk assessment format developed by a contractor after the enactment of IPIA and the criteria used to assess the level of risk of significant improper payments did not include the consideration of the total dollar amounts associated with audit reports or program monitoring findings. By considering only the number of audit reports issued and not the dollar amounts associated with any relevant findings a program’s susceptibility to significant improper payments might be understated. For example, a program could have only one relevant audit report or finding, but that audit report or finding could identify potential improper payments that are considered 11 significant based on the definition in OMB Circular A-123, appendix C. 6 For example, one OIG audit report, 7 2015-KC-0001, identified an estimated $448 million in public housing operating subsidies for units occupied by tenants who did not comply with the community service and self- sufficiency requirement. Conclusion HUD may have underestimated the susceptibility of its programs to significant improper payments by not considering all OIG audit reports and the dollar amounts associated with findings and recommendations. As a result, programs may not be identified as susceptible to significant improper payments. When performing its fiscal year 2014 improper payments risk assessments, HUD relied on a management report that did not contain the most recently issued audit report on HUD’s financial statements. Additionally, it used a template that considered only the number of audit reports issued relating to each program and did not take into account the dollar amounts associated with those audit reports or the dollar amounts identified in HUD’s program monitoring findings. Recommendations We recommend that the Chief Financial Officer 3A. Implement procedures to ensure that all relevant OIG audit reports are identified and included in the improper payments risk assessments, including those that were recently issued. 3B. Consider the dollar amounts associated with relevant OIG and GAO audit reports and findings, as well as the dollar amounts associated with program monitoring findings conducted by HUD management, when determining a program’s susceptibility to significant improper payments. 3C. Reassess the susceptibility of significant improper payments for the CPD entitlement, non-entitlement, HOME Investment Partnerships Program, and other formula grant programs based on the results of audit report 2014-FO-0003 as well as the community service and self-sufficiency requirement in public housing subsidiaries identified in OIG audit report 2015-KC-0001. 6 OMB Circular A-123, appendix C, defines significant improper payments as gross annual improper payments (that is, the total amount of overpayments and underpayments) in the program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year report or (2) $100 million (regardless of the improper payment percentage of total program outlays). 7 Audit report 2015-KC-0001, Monitoring of the Community Service and Self-Sufficiency Requirement, issued February 13, 2015 12 Finding 4: HUD’s Improper Payments Estimate Was Based on Outdated Information HUD’s methodology for developing its estimate of improper payments for RHAP used estimates of billing error based on data from fiscal year 2004 for the public housing program and fiscal year 2009 for the owner-administrator program. Additionally, HUD may not have included all types of errors that lead to significant improper payments when developing its improper payments estimate. HUD did not update the billing error studies because it believed billing error made up a small portion of improper payments and performing new billing studies would be too expensive. Additionally, HUD did not reassess the types of errors that occur in RHAP. As a result, HUD’s estimate of improper payments may have been misstated. HUD Reported on Its Billing Error Using Outdated Information HUD did not report on its billing error, as required by section 2(b)(1) of IPERA, which states that agencies must produce a statistically valid estimate or an estimate that is otherwise appropriate, using a methodology approved by OMB, of the improper payments made by each program. HUD’s billing error estimates were based on studies using fiscal year 2004 data for the public housing program and fiscal year 2009 data for the owner-administrator program. As we reported last year, 8 these studies were conducted several years ago, and they had not been evaluated for changes in the environment, including inflation, programmatic changes, and population changes, despite recommendations from OIG, HUD staff, and the contractor hired to conduct HUD’s quality control and income match studies. HUD did not update the billing error studies because it believed that billing error was a small component of the total amount of improper payments and that performing new billing error studies would be too expensive. Using data from fiscal years 2004 and 2009 for the billing error studies detracted from the accuracy and completeness of HUD’s estimate of improper payments for RHAP and led to improper payments estimates and related information that was unreliable and not useful in evaluating the programs for effectiveness of internal controls or necessary policy changes. HUD Did Not Consider All Errors That Lead to Improper Payments HUD did not consider all possible types of errors when evaluating programs to identify those susceptible to significant improper payments or when preparing estimates of improper payments. For example, HUD did not report a billing error for the Section 8 tenant-based program because HUD believed billing error was eliminated when the program changed to a budget-based approach, using predetermined payments. As reported last year, 9 while traditional billing error may not exist because the predetermination of payments was based on expenses that were self- reported by public housing agencies (PHA) through HUD’s Voucher Management System 8 Audit report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010 9 Audit report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010 13 (VMS), HUD is still at risk of paying PHAs improperly. Other OIG audit reports 10 indicated that reviews of VMS data were not sufficiently verified to reasonably ensure the accuracy of the PHA-reported data and noted millions of dollars in discrepancies and adjustments. Another example reported in an OIG audit report 11 identified an estimated $448 million in public housing operating subsidies for units occupied by tenants who did not comply with the community service and self-sufficiency requirement, a type of error that could lead to significant improper payments, which had not been identified by HUD. As a result HUD may not have considered all causes of error that would result in significant improper payments, and its estimate of improper payments may have been understated. Conclusion HUD’s estimate of improper payments for RHAP may have been misstated. HUD did not update its billing error studies or reevaluate RHAP for different causes or types of errors that could lead to significant improper payments. Recommendations We recommend that the Chief Financial Officer 4A. For HUD’s high priority programs, 12 reevaluate the types of errors previously identified to determine whether new causes of errors exist that would lead to significant improper payments and require reporting in accordance with the improper payments categories outlined in OMB Circular A-123, appendix C, for fiscal years 2015 and beyond. 4B. For fiscal year 2015 reporting and beyond, evaluate all other HUD programs and the causes and types of errors associated with each program and activity and identify all types of errors included in OMB’s new improper payments categories when assessing a program’s susceptibility to improper payments and reporting on improper payments, in accordance with OMB Circular A-123, appendix C. 10 Audit reports 2015-FO-0002, Interim Report on HUD’s Internal Controls Over Financial Reporting, and 2014- FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Year 2013 and 2012 (Restated) Financial Statements 11 Audit report 2015-KC-0001, Monitoring of the Community Service and Self-Sufficiency Requirement, issued February 13, 2015 12 High priority programs are those identified by OMB as the programs with the most egregious cases of improper payments. HUD’s RHAP was identified as high-priority by OMB. 14 Scope and Methodology We conducted our audit from January to April 2015 at HUD headquarters in Washington, DC, and followed OMB Circular A-123 guidance on OIG’s responsibility. OMB Circular A-123 states, To determine compliance with IPERA, the agency Inspector General should review the agency's PAR [performance and accountability report] or AFR [agency financial report] (and any accompanying information) for the most recent fiscal year. Compliance with IPERA means that the agency has: a. Published a PAR or AFR for the most recent fiscal year and posted that report and any accompanying materials required by OMB on the agency website; b. Conducted a program specific risk assessment for each program or activity that conforms with Section 3321 of Title 31 U.S.C. (if required); c. Published improper payment estimates for all programs and activities identified as susceptible to significant improper payments under its risk assessment (if required); d. Published programmatic corrective action plans in the PAR or APR (if required); e. Published, and has met, annual reduction targets for each program assessed to be at risk and measured for improper payments; f. Reported a gross improper payment rate of less than 10 percent for each program and activity for which an improper payment estimate was obtained and published in the PAR or APR; and If an agency does not meet one or more of these requirements, then it is not compliant under IPERA. In addition, as part of its review of these improper payment elements, the agency Inspector General may also evaluate the accuracy and completeness of agency reporting and evaluate agency performance in reducing and recapturing improper payments. Finally, as part of the annual compliance review, for agencies that have high-priority programs, the agency Inspector General shall: evaluate the agency’s assessment of the level of risk associated with the high-priority programs and the quality of the improper payment estimates and methodology; determine the extent of oversight warranted; and provide the agency head with recommendations, if any, for modifying the agency’s methodology, promoting continued program access and participation, or maintaining adequate internal controls. To accomplish our audit objectives, we reviewed HUD’s fiscal year 2014 improper payments risk assessment, which did not identify any new programs as susceptible to significant improper payments. We focused our review on RHAP, which HUD had previously identified as 15 susceptible to significant improper payments and for which it annually reported an improper payments estimate. To complete this work, we interviewed appropriate personnel from OCFO, the Office of Public and Indian Housing (PIH), Multifamily Housing, and HUD’s Real Estate Assessment Center. In addition, we reviewed the information HUD reported in its fiscal year 2014 accountable official report and fiscal year 2014 agency financial report and assessed the validity of the information provided. In addition, we reviewed HUD’s internal controls, policies, procedures, and practices and evaluated HUD’s efforts in preventing, reducing and recovering improper payments. We analyzed the quality control and income match studies that were used to estimate HUD’s improper payments by calculating rental errors in a statistical sample of RHAP projects for fiscal year 2013. We also met with HUD’s contractor that performed the quality control and income match studies to gather sufficient information to evaluate HUD’s methodologies and the accuracy of the underlying improper payment data. Lastly, we reviewed the applicable Federal laws, Executive Order 13520, and the implementation guidance found in OMB Circular A-123, appendix C, which govern actions needed by the agency to address the issue of improper payments. OMB Circular A-123, appendix C, parts I and II, provide guidance on the implementation of IPIA as amended by IPERA. Part II requires each agency’s inspector general to review the agency’s improper payments reporting in its agency financial report and accompanying materials. OMB Circular A-123, appendix C, part III, requires each agency inspector general to review the accountable official annual report required under section 3(b) of Executive Order 13520. HUD was provided a draft copy of this report for review. However, they were not able to provide a formal response due to time constraints. We met with HUD’s Chief Financial Officer and Deputy Chief Financial Officer and discussed the audit’s results and recommendations. HUD’s Chief Financial Officer stated that the OCFO would be fully engaged in resolving the shortcomings we identified. We look forward to working with OCFO in arriving at management decisions in order to resolve and correct the issues identified in the audit. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 16 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to • Effectiveness and efficiency of operations, • Reliability of financial reporting, and • Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objectives: • HUD’s design and implementation of controls to prevent, detect, and recover improper payments. • HUD’s reporting processes between program offices and OCFO. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following items are significant deficiencies: • HUD did not have documented procedures to ensure the reporting of complete and accurate information regarding improper payments in its agency financial report (see finding 2). • HUD’s improper payments risk assesment did not include a review of all relevant audit reports or consider the dollar amounts associated with OIG and GAO audit reports or program monitoring findings (see finding 3). • HUD did not use accurate information to estimate improper payments due to billing error or evaluate the types of errors that could lead to significant improper payments (see finding 4). 17 Follow-up on Prior Audits We reviewed the recommendations from audit report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010, and found that 18 of 21 recommendations remained open with final action target dates between November 19, 2014, and August 12, 2015. Of these 18 open recommendations, management decisions had not been reached on 8. HUD disagreed with these eight recommendations and they had been referred to the Deputy Secretary as of the date of this report. The 18 open recommendations are listed below, We recommended that the Chief Financial Officer 1. Work with PIH and Multifamily Housing to accurately identify and report on all corrective actions in place at the time of the report and periodically verify that all these actions are performed during the year (referred to the Deputy Secretary). 2. Work with PIH and Multifamily Housing to identify and report on all human capital and information system limitations that hamper reduction efforts and track progress in addressing and overcoming these obstacles (referred to the Deputy Secretary). 3. In the agency financial report and accountable official’s report, report on PIH and Multifamily Housing plans to hold program officials and processing entities (PHAs and owner administrators) accountable for improper payments (final action target date is August 12, 2015). 4. In fiscal year 2015, conduct a current billing study for Multifamily and Public Housing to accurately determine 2014 improper payment billing rate errors (referred to the Deputy Secretary). 5. For fiscal year 2015, conduct a study to assess improper payments arising from Housing Choice Voucher program PHAs misreporting their 2014 expenses to HUD (referred to the Deputy Secretary). 6. In future years, if a billing study is not performed annually, explain the reason for not doing so in the agency financial report and update billing error for inflation, programmatic, or population changes and any other factors that may change the billing error previously reported (referred to the Deputy Secretary). 7. Report on Multifamily, Public Housing, and Section 8 program improper payment rates separately in the agency financial report (referred to the Deputy Secretary). 8. Update its recovery audit plan annually and for each program that expends more than $1 million, report in the agency financial report on the amount recovered using the corresponding activity mentioned in the plan. If recovery activities are not cost effective for 18 a particular program, explain why they are not cost effective in the agency financial report (final action target date was November 19, 2014). 9. Develop and implement formal procedures to collect and verify information provided by program offices to ensure information reported is accurate and in compliance with IPERA reporting requirements (referred to the Deputy Secretary). 10. Work with PIH and Multifamily Housing to determine annual improper payments HUD made to deceased tenants, and report this amount as an additional source of improper payments in the agency financial report (referred to the Deputy Secretary). We recommended that the Assistant Secretary for Public and Indian Housing 11. Develop and execute formal plans to hold accountable program officials and processing entities (PHAs) responsible for improper payments (final action target date was April 30, 2015). 12. Reassess existing supplemental measures and corrective actions, and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (final action target date is September 2, 2015). We recommended that the Deputy Assistant Secretary for Multifamily Housing 13. Coordinate with all appropriate program officials when responding to OCFO’s information requests to ensure that all statements are accurate for the current fiscal year, to include but not be limited to updates to corrective action plans, internal controls in place, and information on any barriers the agency is experiencing (final action target date is May 29, 2015). 14. Develop and execute formal plans to hold accountable program officials and processing entities (owners or administrators) responsible for improper payments (final action target date was March 6, 2015). 15. Reassess existing supplemental measures and corrective actions, and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (final action target date was April 30, 2015). 16. Periodically reevaluate the supplemental measures and corrective actions so that new and innovative ways to reduce improper payments are identified and implemented (final action target date was April 30, 2015). 17. Work with REAC to develop management-level reports in EIV [Enterprise Income Verification system] that will allow Multifamily Housing management to efficiently and 19 effectively identify processing entities that are responsible for improper payments and develop policies and procedures to hold owners/administrators identified accountable (final action target date was April 30, 2015). We recommended that the Deputy Assistant Secretary for the Real Estate Assessment Center 18. Work with PIH and Multifamily Housing management to develop management-level reports in EIV that will allow PIH and Multifamily Housing management to efficiently and effectively identify processing entities that are responsible for improper payments (final action target date is September 2, 2015). 20
HUD Did Not Comply With IPERA Due to Significant Deficiencies in Its Reporting and Risk Assessment Processes
Published by the Department of Housing and Urban Development, Office of Inspector General on 2015-05-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)