U.S. Department of Housing and Urban Development, Washington, DC Compliance With the Improper Payments Elimination and Recovery Act Office of Audit, Financial Audits Division Audit Report Number: 2016-FO-0005 Washington, DC May 13, 2016 To: Joseph I. Hungate, Chief Financial Officer, F //signed// From: Thomas R. McEnanly, Director of Financial Audits Division, GAF Subject: HUD Did Not Comply With IPERA Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of HUD’s fiscal year 2015 compliance with the Improper Payments Elimination and Recovery Act of 2010. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. Audit Report Number: 2016-FO-0005 Date: May 13, 2016 HUD Did Not Comply With IPERA Highlights What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2015 compliance with the Improper Payments Elimination and Recovery Act of 2010 (IPERA). IPERA was enacted to eliminate and recover improper payments by requiring agencies to identify and report on programs that are susceptible to significant improper payments. IPERA also requires each agency’s inspector general to perform an annual review of the agency’s compliance with IPERA. Our audit objectives were to (1) determine HUD’s compliance with IPERA reporting and improper payment reduction requirements; (2) determine whether HUD’s reporting of improper payment data, including the agency’s performance in reducing and recapturing improper payments, was complete and accurate; and (3) determine whether HUD’s assessment of the level of risk associated with high-priority programs and the quality of the improper payment estimates and methodology were reasonable. What We Found In fiscal year 2015, we determined that HUD did not comply with IPERA. Out of the six requirements, HUD complied with four (compliance determinations a, c, d, and f) and did not comply with the remaining two (compliance determinations b and e). HUD also did not comply with IPERA in fiscal years 2013 and 2014. Specific areas of noncompliance for fiscal year 2015 were related to HUD’s failure to (1) conduct an annual risk assessment in accordance with the Office of Management and Budget (OMB) guidance and (2) meet its annual improper payment reduction target. Additionally, we noted some issues concerning (1) the completeness and accuracy of HUD’s improper payment data reporting, including payment recapture audit plans, and (2) the reasonableness of HUD’s improper payment estimate for its Rental Housing Assistance Programs. What We Recommend OIG made 13 recommendations to improve HUD’s compliance with IPERA and to address weaknesses identified in HUD’s payment recapture audit plans, rental housing assistance program improper payment estimation process, and reporting of improper payment information in the agency financial report. Table of Contents Background and Objectives ....................................................................................3 Results of Audit ........................................................................................................5 Finding 1: HUD Did Not Comply With IPERA ............................................................ 5 Finding 2: HUD’s Scope and Disclosure for Payment Recapture Audits Were Incomplete ....................................................................................................................... 12 Finding 3: HUD’s Improper Payment Estimate and Reporting for Its High-Priority Program Remained a Concern ...................................................................................... 14 Finding 4: HUD Did Not Fully Comply With the Reporting Requirements ............ 16 Scope and Methodology .........................................................................................20 Internal Controls ....................................................................................................22 Follow-up on Prior Audits.....................................................................................23 Appendixes ..............................................................................................................25 A. Auditee Comments and OIG’s Evaluation ............................................................. 25 2 Background and Objectives The Improper Payments Information Act of 2002 (IPIA) required the head of each agency to annually review all programs and activities administered by the agency, identify all such programs and activities that may be susceptible to significant improper payments, estimate the annual amount of improper payments for each program or activity identified as susceptible, and report those estimates. For programs with estimated improper payments exceeding $10 million, IPIA required agencies to report the causes of the improper payments, actions taken to correct those causes, and results of the actions taken. The Improper Payments Elimination and Recovery Act of 2010 (IPERA) decreased the frequency with which each agency was required to review all of its programs but increased the responsibilities and reporting requirements. IPERA also required each agency inspector general to determine whether the agency complied with IPIA as amended by IPERA. IPIA was further amended by the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA). Under IPERIA, the inspector general is required to review the assessed level of risk associated with high-priority programs, as determined by the Office of Management and Budget (OMB), the quality of the improper payment estimates and methodology for high-priority programs, and the oversight or financial controls to identify and prevent improper payments under high-priority programs. The inspector general must then submit recommendations to Congress for modifying any agency plans relating to improper payments determination and estimation methodology. IPERIA also established the Do Not Pay Initiative, requiring each agency to review prepayment and pre-award procedures to ensure that a thorough review of available databases with relevant information on eligibility is completed and used to determine program or award eligibility before the release of any Federal funds. OMB issued appendix C to Circular No. A-123, Requirements for Effective Estimation and Remediation of Improper Payments, on October 20, 2014, to provide guidance for agencies in the implementation of IPIA, IPERA, and IPERIA requirements. OMB Circular A-123, appendix C, requires agencies to follow a four-step process. Step 1 is to review all programs and activities and identify those that are susceptible to significant improper payments. Beginning with fiscal year 2014 reporting, “significant improper payments” are defined as gross annual improper payments (that is, the total amount of overpayments and underpayments) in the program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year reported or (2) $100 million (regardless of the improper payment percentage of total program outlays). Step 2 is to obtain a statistically valid estimate of the annual amount of improper payments in programs and activities for those programs identified in step 1 as susceptible to significant improper payments. Step 3 is to implement a plan to reduce improper payments, and step 4 is to report annually in the agency financial report (AFR) or the performance and accountability report (PAR). IPERA requires agencies to conduct recovery audits for each program and activity that expends $1 million or more annually if conducting such audits would be cost-effective. Under OMB Circular A-123, appendix C, all programs and activities that expend $1 million or more annually – including grant, benefit, loan, and contract programs – must be considered for payment recapture audits. If an agency determines that it would be unable to conduct a cost-effective payment recapture audit 3 program for certain programs and activities that expend more than $1 million, it must notify OMB and the agency’s inspector general of this decision and include any analysis used by the agency to reach this decision. In addition, the agency must report in its annual AFR or PAR (1) a list of programs and activities for which it has determined that conducting a payment recapture audit program would not be cost effective and (2) a description of the justifications and analyses that it used to determine that conducting a payment recapture audit program for these programs and activities was not cost effective. The U.S. Department of Housing and Urban Development’s (HUD) Secretary designated the Chief Financial Officer as the lead official for overseeing HUD’s actions to address improper payment issues and complying with the requirements of IPERA. HUD’s Office of the Chief Financial Officer (OCFO) reviewed one-third of all HUD programs that exceeded $40 million in expenditures in the previous fiscal year, with the exception of its rental housing assistance programs (RHAP) and Federal Housing Administration (FHA) programs, to determine whether they were susceptible to significant improper payments. FHA performed a separate risk assessment for its programs. None of the programs assessed in fiscal year 2015 were determined to be susceptible to significant improper payments. HUD reported improper payment rates in its AFR for two programs: RHAP and the Disaster Relief Appropriations Act supplemental appropriations. RHAP consists of three high-risk program areas: public housing, Section 8 Housing Choice Voucher and Moderate Rehabilitation programs, and owner-administered project-based assistance programs. HUD has reported an improper payment rate for RHAP since 2000. Three studies were undertaken to estimate the improper payment rate for RHAP. These studies were the quality control (QC) study, the income match study, and the billing study. Because RHAP has been designated as a high-priority program by OMB, HUD developed supplemental measures on which it reports quarterly to OMB’s Payment Accuracy Web site.1 The Disaster Relief Appropriations Act of 2013 designated the Disaster Relief Appropriations Act supplemental appropriations as susceptible to significant improper payments. On that basis, HUD is required to report an improper payment rate. HUD uses an alternative estimation approach approved by OMB to estimate improper payments for the Disaster Relief Appropriations Act supplemental appropriations. Our objectives were to (1) determine HUD’s compliance with reporting and improper payment reduction requirements; (2) evaluate the accuracy and completeness of the its reporting of improper payment data, including the agency’s performance in reducing and recapturing improper payments; and (3) evaluate the agency’s assessment of the level of risk associated with the high-priority programs and the quality of the improper payment estimates and methodology. 1 https://paymentaccuracy.gov 4 Results of Audit Finding 1: HUD Did Not Comply With IPERA For the third consecutive fiscal year, HUD did not in comply with IPERA. In fiscal year 2015, we assessed HUD’s compliance with six IPERA criteria. Of the six criteria, HUD failed to comply with two criteria. Areas of noncompliance were related to HUD’s failure to (1) conduct its annual risk assessment in accordance with OMB guidance, and (2) meet its annual improper payment reduction target. This condition occurred because of weaknesses in OCFO’s and FHA’s risk assessment processes and HUD’s continued inability to address all of the root causes of improper payments for RHAP. If HUD does not address its non-compliance with IPERA, it will continue to miss opportunities to prevent, identify, and recover improper payments. HUD Did Not Comply With IPERA According to OMB Circular A-123, appendix C, an agency must meet all six requirements to comply with IPERA. Based upon our review of the six requirements, HUD did not comply with IPERA because it failed to meet two (b and e below) of the six requirements. a. Published agency financial report – HUD complied with this requirement. It published an AFR for the most recent fiscal year and posted that report and accompanying materials required by OMB on the agency Web site. However, some of the information published in the AFR did not meet the reporting requirements of OMB Circular A-136. These deficiencies are discussed in finding 4. b. Conducted compliant risk assessment process – HUD did not comply with this requirement. See the body of this finding for further details of HUD’s noncompliance. c. Published estimate – HUD complied with this requirement. Although HUD published improper payment estimates for all programs and activities identified as susceptible to significant improper payments under its risk assessment, its estimate and methodology for RHAP continued to have deficiencies. These deficiencies are discussed in finding 3. d. Published corrective action plan – HUD complied with this requirement. Corrective actions for RHAP were included in HUD’s AFR. e. Published and met reduction targets – HUD did not comply with this requirement. Although HUD published reduction targets in its AFR, it did not meet the reduction targets. See the body of this finding for further details of HUD’s noncompliance. 5 f. Reported an estimate below 10 percent – HUD complied with this requirement. HUD’s improper payment rate for its RHAP and Disaster Relief Appropriations Act supplemental appropriations programs was below 10 percent. Fiscal year 2015 marked the third consecutive year that OIG has reported HUD’s noncompliance with IPERA. On August 18, 2015, HUD submitted to Congress and OMB its action plans for achieving compliance with IPERA. As of the end of fiscal year 2015, we had a number of audit recommendations that were still open. We determined in our fiscal year 2015 audit that the issues responsible for HUD’s noncompliance with IPERA had not been fully addressed. Therefore, those issues were carried forward in this year’s audit report. OCFO’s and FHA’s Risk Assessments Were Not Performed In Accordance With OMB Guidance Although OCFO and FHA conducted specific program risk assessments, they did not (1) assess all low-risk programs on a 3-year cycle and (2) consider all of the nine required risk factors, thus making the review incomplete and noncompliant with section 3(a)(3)(B) of IPERA. HUD’s noncompliance was due to a risk assessment process established by OCFO and FHA that did not follow the requirements in OMB Circular A-123, appendix C, for risk assessments. We also found instances in which OCFO did not rate risk factors in accordance with its own policy due to a lack of proper review procedures. Based upon our identification of two inherent risks that were not adequately considered by FHA, we disagreed with FHA’s assessment that the single family claims program was at medium risk for improper payments. The deficiencies in OCFO’s and FHA’s risk assessments may result in programs that are susceptible to significant improper payments not being identified for further review. OMB Circular A-123, appendix C, part I.A.10 states that IPERA required agencies to conduct risk assessments for all programs starting in fiscal year 2011, unless they received a waiver from OMB. For programs that are determined to be at low risk of significant improper payments, agencies must perform risk assessments at least once every 3 years. The Circular, defines “significant erroneous payments” as annual erroneous payments in the program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year reported or (2) $100 million (regardless of the improper payment percentage of total program outlays). As part of the risk assessment, agencies shall take into account the following risk factors likely to contribute to improper payments: (i) Whether the program or activity reviewed is new to the agency; (ii) The complexity of the program or activity reviewed, particularly with respect to determining correct payment amounts; (iii) The volume of payments made annually; (iv) Whether payments or payment eligibility decisions are made outside of the agency, for example, by a State or local government, or a regional Federal office; (v) Recent major changes in program funding, authorities, practices, or procedures; (vi) The level, experience, and quality of training for personnel responsible for making program eligibility determinations or certifying that payments are accurate; (vii) Inherent risks of improper payments due to the nature of agency programs or operations; (viii) Significant deficiencies in the audit reports of the agency including, but not limited to, the agency Inspector General or the Government Accountability Office (GAO) audit report findings, or other relevant management findings that might hinder accurate payment certification; and (ix) Results from prior improper payment work. 6 OCFO’s Risk Assessments Were Not Performed In Accordance With OMB Guidance and Its Own Internal Procedures. Beginning in 2006, OCFO determined that programs with expenditures of $40 million or less would be removed from the scope of the risk assessment because it did not believe that any of HUD’s programs were susceptible to having an error rate in excess of 25 percent (that is, 25 percent of $40 million = $10 million). HUD did not provide a waiver from OMB allowing it to exclude programs because they are below a certain threshold limit. We identified two programs (86-1-0183 and 86-X-0186) that had not had a risk assessment performed because their expenditures did not reach $40 million in a given year. Lastly, OCFO’s risk assessment procedures did not include steps to ensure that all of Ginnie Mae’s programs were included. One Ginnie Mae program has never been assessed. OCFO could not provide evidence that its risk assessment considered all of the required risk factors. The risk assessment report was incomplete in documenting its consideration of five of the required risk factors. OCFO staff provided other evidence not documented in the report to support their consideration of three of the risk factors. Neither the report nor the other evidence provided sufficiently addressed two of the risk factors. The human capital risk factor used by OCFO was high-level and general and OCFO staff was unable to provide support showing that it specifically considered the level, experience, and quality of training for personnel responsible for making program eligibility determinations or certifying that payments were accurate; and we found insufficient documentation that HUD considered whether payments or payment eligibility decisions were made outside of the agency for 4 of the 12 programs HUD assessed in its risk assessment. OCFO failed to assign the correct risk assessment rating for some programs in accordance with its internal risk assessment criteria. We found one instance in which the rating assignment for the category of human capital risk was misclassified and one instance where the rating assignment for the category of materiality of expenditures was misclassified, based on OCFO’s internal risk rating guidance. FHA’s Risk Assessments Were Not Performed In Accordance With OMB Guidance and We Disagree with FHA’s Risk Assessment for the Single Family Claims Program. In consultation with OCFO, FHA also excluded programs with less than $40 million in annual expenditures from the risk assessment. Based on its knowledge of and experience with FHA programs, it did not believe that any FHA programs were susceptible to having an error rate in excess of 25 percent. Although FHA stated that it no longer used the $40 million threshold and assessed all programs annually, we found no evidence that FHA assessed the risk of other programs below the $40 million threshold, with one exception. We identified three programs (Title I Claims, Multifamily Property, and Multifamily Premium Refunds) below the $40 million threshold that FHA had not included in its risk assessment in the last three cycles. In addition, FHA staff could not provide evidence to support that it had considered all nine required risk factors for each program that was assessed for fiscal year 2015. 7 In fiscal year 2015, FHA concluded that its single family claims program was at medium risk of improper payments using a qualitative risk assessment method that did not include an estimate of potential improper payments.2 Based on our review, we determined that FHA addressed six of the nine risk factors for the single family claims program. For the inherent risks of improper payments due to the nature of agency programs or operations (risk factor vii), FHA reported that it identified inherent risks for each area, but the inherent risks identified were not documented in the report or other documentation provided by FHA. Thus, there was no evidence that FHA considered this risk factor in its risk assessment. The inherent risks of the Single Family Claims program identified by us below strongly support a high risk rating. A high risk rating would mean that the single family claims program was susceptible to significant improper payments and that FHA would be required to estimate improper payments for the program. FHA performs post-endorsement technical reviews on a per loan basis, compliance monitoring reviews of lenders included on a targeting list, and quality control reviews of individual loans originated and underwritten by FHA-approved lenders. However, in fiscal years 2014 and 2015, noncompliant lenders agreed to pay $1.4 billion to settle allegations that the lenders failed to comply with FHA requirements when underwriting or endorsing loans. FHA lenders’ lack of compliance with FHA’s underwriting requirements increases FHA’s risk of significant improper payments. Because of the requirement that FHA pay debenture interest on timely-filed claims, FHA uses a largely automated process for claim payments.3 FHA relies on the post-claims review as a mechanism to identify and measure improper payments after the claim is paid. However, a previous audit4 reported deficiencies in FHA’s post-claims review process and questioned the effectiveness of this internal control. In response to our audit recommendations, FHA agreed that it needed to strengthen its controls in connection with the post-claims review. The inherent risks of the single family claims program raise the risk level for the program and make it potentially susceptible to significant improper payments. Under OMB Circular A-123, appendix C, part I.A.8, an improper payment for a loan guarantee program may include payments by the Government to non-Federal entities for defaults, delinquencies, interest and other subsidies, or other payments that are based on incomplete, inaccurate, or fraudulent information. They may also include duplicate payments; payments in an incorrect amount; or any payments that do not in comply with law, program regulations, or agency policy. FHA relies on the lenders to determine a borrower’s eligibility for an FHA mortgage. If a borrower is not 2 OMB Circular A-123, part I, (A)(9) requires the agency to use a systematic method in reviewing and identifying whether the programs are susceptible to significant improper payments. This systematic method could be either a qualitative or quantitative evaluation method. 3 According to OMB guidance, one of the categories of improper payments was program design and structural issue. This condition occurs when improper payments are the result of the design of the program or a structural issue; for example, a scenario in which a program has a statutory (or regulatory) requirement to pay benefits when due, regardless of whether all of the information has been received to confirm payment accuracy. 4 Audit Report 2015-LA-0003, Federal Housing Administration, Home Affordable Modification Program, Partial Claim Option, September 18, 2015. 8 eligible, any resulting claim payments would be improper because they would be based on inaccurate and possibly fraudulent information. The single family claims program has an average of $20 billion in annual disbursements. For FHA to reach the $100 million threshold, only 0.5 percent of the disbursements would have to meet the definition of an improper payment. Both OCFO’s and FHA’s risk assessment process implemented a threshold, automatically precluding them from assessing the risk for all programs. While both OCFO and FHA believed that they had considered all nine required risk factors, they could not provide evidence to support that they had done so. According to OCFO, the manager responsible for OCFO’s noncompliance with its internal risk rating policies is no longer at HUD. FHA assessed the risk of the single family claims program as medium because it believed that the controls in place for the program were sufficient to prevent and detect improper payments; however, FHA did not use a quantitative assessment, which would have helped it to determine whether the single family claims program was at risk of significant improper payments as a result of the inherent risks identified in our audit. HUD Did Not Meet Its Fiscal Year 2015 Improper Payment Reduction Target on Its Rental Housing Assistance Programs HUD published annual improper payment reduction targets for its high-priority program, namely RHAP; however, it failed to meet or exceed its improper payment reduction target for fiscal year 2015. In fiscal year 2015, HUD’s improper payment target rate for RHAP was 3.1 percent, but the improper payment rate realized in fiscal year 2015 was 4.01 percent, which was higher than the target. HUD’s QC study attributed the increase in the improper payment rate to a change in the number of tenants paying rent based on their income included in the sample, along with variation in the sampling errors for the entire population. According to the study, the number of cases with flat rent in the sample for the fiscal year 2015 study dropped substantially from 141 to 82 cases, which resulted in more tenants being included in the sample who paid rent based on their income. This condition contributed to the increase in the estimated error for the public housing program. According to the study, flat rent cases cannot have rent error. Therefore, we questioned the appropriateness of the including flat rent cases in the QC study population from which to select samples. Including flat rent cases when calculating HUD’s annual improper payment rate in the denominator could skew the overall RHAP improper payment rate. Although it was plausible to think that the change in the composition of non-income-based tenants included in the study was the reason for the increase in HUD’s improper payment rate in fiscal year 2015, we determined that it contributed to the error estimate for the public housing program only and did not affect the public housing agency-administered or owner-administered programs. HUD’s continued inability to address the root causes of its RHAP improper payments remains the fundamental reason why it did not meet its fiscal year 2015 reduction targets. In our fiscal year 2013 IPERA audit report5 (2014-FO-0004), we stated that HUD’s supplemental measures and corrective actions were not effective in (1) targeting the root causes of the RHAP improper 5 Audit Report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010 9 payments identified by the contractor and (2) tracking or monitoring the efforts of processing entities in mitigating these improper payments. For example, we stated that while HUD’s QC study cited root causes of error in RHAP, HUD’s overall efforts did not target the root causes of errors cited in the study. Additionally, we stated that with respect to the management of processing entities’6 performance, HUD’s corrective actions were not effective because they did not include specific metrics for measuring the performance of the processing entities in mitigating processing errors in RHAP and they did not include actions to hold these processing entities accountable for not doing so. As a result, HUD did not know or could not measure to what extent its efforts were making a significant impact in reducing its overall improper payment rate. A number of audit recommendations7 associated with these findings remained unimplemented; therefore, the deficiencies continued to exist, and HUD was not able to meet its reduction target. Conclusion HUD failed to meet two of the six compliance determination requirements, which were related to risk assessments and annual improper payment reduction targets. OCFO and FHA risk assessments were not performed in accordance with OMB guidance. In addition, HUD’s fiscal year 2015 annual reduction target for RHAP was not met. HUD’s non-compliance with OMB Circular A-123, appendix C, requirements for risk assessments may result in programs that are susceptible to significant improper payments not being identified for further review. This deficiency could prevent HUD from taking the necessary steps to address significant improper payments. Because HUD did not fully address the root causes of improper payments by implementing OIG’s previous audit recommendations, HUD did not meet its reduction target for RHAP. As there were six unimplemented recommendations surrounding HUD’s inability to meet its target, we will not make additional recommendations. Recommendations We recommend that the Office of the Chief Financial Officer: 1A. Revise its risk assessment process to ensure that all HUD programs, including Ginnie Mae programs, are (1) initially risk-assessed for improper payments or request a waiver from OMB, and if programs are determined to be low risk, reassess them on a 3-year cycle; and (2) risk assessed against all of the required risk factors. 1B. Establish policies and procedures to ensure that adequate documentation of the risk assessment process is maintained to facilitate an independent third-party’s review of OCFO’s compliance with the requirements of OMB Circular A-123, appendix C, for risk assessments. 6 Processing entities are public housing agencies for tenant-based Section 8 and public housing programs and owners or management agents for multifamily housing owner-administered projects. 7 See Followup on Prior Audits, recommendations 2014-FO-0004-1M, 2014-FO-0004-2A, 2014-FO-0004-2D, 2014-FO-0004-2E, 2014-FO-0004-2F, and 2014-FO-0004-2G 10 1C. Consider stratifying the population of RHAP tenant cases between income-based and non-income based rents going forward in determining the population of cases for the QC study and determine whether it is appropriate to include only the income-based tenants in the population. We recommend that the FHA Acting Comptroller: 1D. Reassess the susceptibility of the FHA single family claims program to significant improper payments using a quantitative assessment method and provide the results and all of the supporting documentation to OIG for review. At a minimum, FHA should consider all of the risk factors cited in this report, including the level of compliance with FHA’s underwriting requirements for FHA’s top 10 lenders. 1E. Revise its risk assessment process to (1) ensure that all FHA programs are assessed for significant improper payments or request a waiver from OMB; (2) establish a 3-year cycle to reassess all low-risk programs; and (3) ensure that consideration of all of the required risk factors is clearly documented. 11 Finding 2: HUD’s Scope and Disclosure for Payment Recapture Audits Were Incomplete The scope and disclosure of HUD’s agencywide payment recapture audit plan was incomplete. Specifically, HUD lacked support to demonstrate that all of its programs and activities that expended $1 million or more during the fiscal year were either considered for payment recapture audits or excluded based on cost-benefit considerations. Additionally, a complete list of programs that were excluded from the payment recapture audit plan, along with HUD’s justification and analysis for their exclusion, were not disclosed in HUD’s fiscal year 2015 AFR. This condition occurred because OCFO had a decentralized process that relied heavily on the decisions of the program offices without appropriate oversight from OCFO. As a result, HUD may have missed the opportunity to recover funds from those excluded programs that made improper payments, and HUD’s stakeholders may not have been fully informed of the extent of HUD’s implementation of the payment recapture audit program. Cost-Benefit Justification and Analysis for Excluded Programs Were Inadequate and Were Not Appropriately Disclosed in the Agency Financial Report HUD did not have adequate support to show that all of its programs and activities with annual expenditures of $1 million or more were either considered for payment recapture audits or excluded from the plan based on cost-benefit considerations. In fiscal year 2015, HUD submitted its justification and cost-benefit analysis for those programs in which it had determined that a payment recapture audit would not be cost effective to OMB. However, the justification and cost-benefit analysis were incomplete because they were done on a program office level and not on an individual program and activity level, which was the requirement. We reviewed the justification and cost-benefit analysis submitted to OMB for the Office of Public and Indian Housing (PIH) and found that HUD’s justification and cost-benefit analysis were incomplete. For example, of eight programs in PIH, we found a justification and cost-benefit analysis that only covered three programs (Housing Choice Voucher program, public housing programs, and the Public Housing Operating Fund). HUD failed to maintain a cost-benefit analysis and justification for other PIH programs, such as the Indian Housing Block Grants, HOPE VI, Indian Housing Loan Guarantee Program, Native Hawaiian Block Grants, or Choice Neighborhoods. Additionally, HUD failed to disclose in its fiscal year 2015 AFR a complete list of the programs that were excluded from the payment recapture audit plan, along with HUD’s justification and analysis for their exclusion. This disclosure was required under OMB Circular A-123, appendix C, part I, section (D)(6). OCFO Failed To Provide Program Offices With Adequate Guidance OCFO used a decentralized process and relied heavily on the program offices to make the payment recapture audit determination without providing the appropriate oversight. Additionally, OCFO did not have formal policies and procedures in place to ensure that (1) program offices provided a complete response covering each program or activity that expended $1 million or more annually, (2) program offices maintained a justification and cost-benefit analysis for each program or activity that expended $1 million or more annually to support the exclusion of these programs from the payment recapture audit plan, or (3) its justification and 12 cost-benefit analysis for the exclusion of certain programs and activities were adequately disclosed in the AFR. Conclusion HUD did not (1) maintain adequate documentation to support its conclusion that certain programs and activities should be excluded from its payment recapture audit plan, (2) provide OMB and us a complete cost-benefit analysis and justification, and (3) disclose the cost-benefit analysis and justification for all programs excluded from the payment recapture audit plan in the AFR. All of these actions are required under OMB Circular A-123, appendix C. However, more importantly, we believe that there may have been missed opportunities to recover funds from those excluded programs. Recommendations We recommend that the Office of the Chief Financial Officer 2A. Develop, document, and implement formal policies and procedures to ensure that (1) all programs or activities that expend $1 million or more annually for each program office identified are included in either the program office’s payment recapture audit plan or provide a justification and analysis showing why a payment recapture audit would not be cost effective for that program or activity and (2) justifications and analyses showing why a payment recapture audit would not be cost effective are maintained and adequately described in the AFR, in accordance with OMB Circular A-123, appendix C. 2B. Revisit the existing recovery audit plan and update it as needed to ensure that all programs and activities that expended more than $1 million annually were included in the recovery audit plan or excluded from the recovery audit plan and maintain the corresponding cost-benefit analyses supporting their exclusion. 2C. Resubmit the justifications for why a payment recapture audit would not be cost- effective for each program that expended over $1 million or more to OMB and OIG for programs that were not already identified under a separate recovery audit plan. 2D. Adequately disclose in the AFR a complete list of all programs that were excluded from the payment recapture audit plan, along with HUD’s justification and analysis for their exclusion in accordance with OMB Circular A-136 requirements. 13 Finding 3: HUD’s Improper Payment Estimate and Reporting for Its High-Priority Program Remained a Concern HUD’s RHAP improper payment estimate reported in the fiscal year 2015 AFR may not be accurate. Specifically, our concerns stemmed from HUD’s incorrect billing error adjustment made in fiscal year 2015 and HUD’s continued reporting of a combined RHAP improper payment rate instead of separate improper payment rates for each of the three RHAP components. Both issues were repeat findings from previous audits. In response to one of our prior-year audit recommendations,8 HUD attempted, in fiscal year 2015, to adjust the billing error for inflation, but HUD staff incorrectly adjusted it by only 1 year and used the incorrect percentage to make the adjustment. Because HUD staff intended to have a billing study done in fiscal year 2016, it did not develop a methodology to properly correct the billing error issue for fiscal year 2015 reporting. As a result of the incorrect billing error adjustments, we had concerns about the accuracy of HUD’s fiscal year 2015 RHAP improper payment estimate. HUD’s Adjustment to Billing Error Was Incomplete and Inaccurate In audit reports 2014-FO-0004 and 2015-FO-0005, we reported that HUD did not accurately report on its billing error for RHAP.9 Specifically, HUD’s billing error estimates were based on studies using fiscal year 2004 data for the Public Housing program and fiscal year 2009 data for the owner-administrator program. These estimates were not evaluated for changes in the environment, including inflation, programmatic changes, or population changes, despite recommendations from us, HUD staff, and the contractor hired to conduct the QC and income match studies. Based on our review of HUD’s fiscal year 2015 AFR and meetings with HUD staff, we determined that a new billing study was not completed in fiscal year 2015. We also determined that HUD did not adjust the billing error reported in the fiscal year 2015 AFR for programmatic changes or population changes. HUD did adjust the billing error for inflation, but HUD staff stated that it was adjusted by only 1 year. HUD should have used an inflation rate of 1.6 percent instead of 1.5 percent to adjust the billing error by 1 year. To produce accurate estimates of improper payments, the billing error reported for the public housing program should have been adjusted for inflation from fiscal years 2004 to 2014, and the billing error reported for the owner- administrator program should have been adjusted for inflation from fiscal year 2009 to 2014. Significant Improper Payment Rates May Be Masked Under One Combined Rate As previously reported,10 HUD reported a combined improper payment rate for the three components of RHAP in the AFR that may be masking increases in the improper payment rate for one or more of the components. OMB Circular A-123, appendix C, prohibits agencies from grouping programs or activities in a way that masks significant improper payment rates. In audit 8 Recommendation 2014-FO-0004-1F states: In future years, if a billing study is not performed annually, explain the reason for not doing so in the agency financial report and update billing error for inflation, programmatic, or population changes and any other factors that may change the billing error previously reported. 9 Audit Report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010 and Audit Report 2015-FO-0005, Compliance With the Improper Payments Elimination and Recovery Act 10 Audit Report 2014-FO-0004, Compliance With the Improper Payments Elimination and Recovery Act of 2010 14 report 2014-FO-0004, we recommended that OCFO report on Multifamily, public housing, and Section 8 improper payment rates separately in the AFR. This recommendation11 remains open, and we continue to have concerns regarding the accuracy of the improper payment rate reported. Conclusion Because HUD staff intended to have a billing study done in fiscal year 2016, it did not fully develop a methodology to adjust the billing error for factors such as programmatic or population changes for fiscal year 2015 reporting. The billing error used to estimate improper payments for RHAP was not adjusted appropriately to reflect the billing error for fiscal year 2014, which was reported in the fiscal year 2015 AFR. In addition, the combined RHAP improper payment rate could be masking significant improper payment rates for one or more RHAP components. Recommendations We recommend that the Office of the Chief Financial Officer 3A. Develop and document a methodology for adjusting the billing error for factors that may change the billing error previously reported if a billing study is not performed annually. 11 See Followup on Prior Audits, recommendation 2014-FO-0004-1G 15 Finding 4: HUD Did Not Fully Comply With the Reporting Requirements HUD did not fully comply with OMB Circular A-136 and Executive Order 13520 reporting requirements. Specifically, HUD’s reporting for supplemental measures, corrective actions, accountability, and the root cause category matrix in HUD’s fiscal year 2015 AFR did not fully comply with the reporting requirements of OMB Circular A-136. Additionally, HUD did not identify or report high-dollar overpayments for RHAP, in compliance with Executive Order 13520. This noncompliance occurred because HUD was still in the process of addressing our prior-year audit recommendations regarding the reporting of improper payments for deceased tenants, accountability, supplemental measures, and corrective actions. As a result, all relevant information regarding HUD’s agencywide improper payment initiatives was not adequately disclosed in the AFR. Additionally, HUD did not keep up with the change in OMB guidance regarding the reporting of high-dollar overpayments and was still performing research to determine appropriate reporting and how to go about collecting data. HUD’s Reporting for Supplemental Measures, Corrective Actions, Accountability, and Payment Recapture Audits Did Not Comply With OMB Circular A-136 HUD’s fiscal year 2015 AFR did not report on supplemental measures, corrective actions, accountability, and payment recapture audits in accordance with the reporting requirements of OMB Circular A-136 for Improper Payments. Specifically, HUD failed to report on the reasons for meeting, exceeding, or failing to meet the supplemental targets and failed to report on the frequency with which the supplemental measures were measured, in accordance with Section III: Improper Payment Reporting, f:High Priority Programs. HUD’s corrective actions described in the AFR did not explain how the corrective actions addressed the root causes identified in Table 2, Improper Payment Root Cause Category Matrix. Additionally, HUD did not include planned or actual completion dates of the actions, results of the actions taken to address the root causes, or explain in the AFR how it had specifically tailored its corrective actions to better reflect the unique processes, procedures, and risks involved in RHAP in accordance with Section V: Corrective Actions, i: High Priority Programs. Although HUD’s AFR made it clear that the responsibility for overseeing the improper payments in RHAP had been delegated to various agency officials, HUD failed to disclose the actions taken or planned (including a timeline) to ensure that that the agency managers, accountable officers, programs, and States and localities were held accountable for reducing and recapturing improper payments for RHAP in accordance with Section VII: Accountability. HUD did not include a listing of all of the programs and activities for which HUD determined that recovery audits were not cost effective and the justification and analysis 16 to support the conclusion in accordance with Section X:Recapture of Improper Payment Reporting, b:Programs Excluded from the Payment Recapture Audit Program.12 There are eight recommendations13 from prior audits regarding the completeness of HUD’s reporting for improper payments that remain open and unimplemented. The final action target date has not passed on one of the recommendations, management has requested extensions for the final action target dates for three of the recommendations, management has revised the management decision for two of the recommendations and is awaiting approval, and OIG and HUD have been unable to reach a management decision on two recommendations. Our review of the “IPERIA AFR Requirements Checklist” developed by OCFO to address one of the recommendations that were closed in fiscal year 2016 revealed the following issues: (1) some of the reporting requirements were missing from the checklist; (2) management noted in some cases that the information was unavailable; and (3) although locations for the reporting requirements were identified and verified according to the checklist in the draft AFR, they were not adequately and specifically addressed in the final version of the AFR. Thus, HUD did not have adequate policies and procedures to ensure compliance with OMB Circular A-136 in its fiscal year 2015 AFR. HUD Did Not Accurately Categorize Its Improper Payment Estimates HUD included Table 2, Improper Payment Root Cause Category Matrix, in the AFR but did not properly identify or categorize its improper payments in accordance with OMB guidance. In its fiscal year 2015 AFR, HUD reported improper payments only under the category “Administrative or Process Error Made by: Other Party.” Based on our review of the QC and income match studies used to calculate the improper payment rates for RHAP and the supplemental measures and corrective actions reported in the AFR, we believe that HUD should be reporting overpayments and underpayments in the failure to verify death data14 and failure to verify financial data15 categories as part of its estimate of improper payments for RHAP. Additionally, HUD needs to ensure that overpayments and underpayments reported in Table 2 resulting from the failure to verify death and financial data are included in the estimate of improper payments for RHAP reported in Table 1, Improper Payment Reduction Outlook. Prior to reporting for fiscal year 2015, agencies were only required to report on root causes of improper payments as part of the discussion of corrective actions. Agencies had to report root cause information (including error rate and error amount) based on the following three categories: documentation and administrative errors, authentication and medical necessity errors, and verification errors. However, those categories proved to be limited and not necessarily applicable to most programs. Therefore, OMB, in consultation with agencies, developed new 12 See finding 2, HUD’s Scope and Disclosure for Payment Recapture Audits Were Incomplete, for additional information regarding HUD’s reporting on programs excluded from the payment recapture audit program. 13 See Followup on Prior Audits, Recommendation 2014-FO-0004-1G, 2014-FO-0004-1M, 2014-FO-0004-1L, 2014-FO-0004-2A, 2014-FO-0004-2D, 2014-FO-0004-2F, 2014-FO-0004-2G and 2014-FO-0004-2H 14 Failure to verify death data is the failure to verify that an individual is deceased, and the agency (Federal, State, or local), or another party administering Federal dollars, pays that individual. 15 Failure to verify financial data is the failure to verify that an individual’s or household’s financial resources do not meet the threshold to qualify for a benefit, and the agency (Federal, State, or local), or another party administering Federal dollars, makes a benefit payment to that individual or household. 17 improper payment categories. Reporting information based on these categories was required for fiscal year 2015 and beyond. Based on our review of the studies performed by HUD’s contractor to prepare the improper payment estimates for RHAP, we determined that the studies did not quantify improper payments based on the new categories of error required by OMB Circular A-136 and OMB Circular A-123, appendix C. The studies were designed to identify and report improper payments (overpayments and underpayments) in the categories of program administrator error and tenant income reporting error. The third component of HUD’s improper payment estimate for RHAP, billing error, was not reviewed for fiscal year 2014. The QC study identified administrative errors and verification errors as root causes of improper payments, but the QC study report did not include separate estimates of the improper payments attributable to administrative errors and to verification errors. For this reason, HUD was not able to report separately in table 2 on verification errors, for example, the failure of the public housing agencies owners, or administrators to verify that an individual’s or household’s financial resources do not meet the threshold to qualify for RHAP or that an individual is deceased. The estimates of improper payments presented in the studies did not include estimates of improper payments to deceased tenants although one of the supplemental measures used by HUD to reduce improper payments for RHAP is the number of deceased single member households. Thus, the studies did not provide HUD with the estimates of improper payments necessary for HUD to report overpayments and underpayments in the appropriate categories in table 2 or to report all estimated improper payments for RHAP in table 1. We identified two prior-year audit recommendations which contributed to HUD’s failure to properly report estimated improper payments in accordance with OMB guidance: Recommendation 2015-FO-0005-004-A, from audit report 2015-FO-0005, recommended that for HUD’s high-priority programs, OCFO reevaluate the types of errors previously identified to determine whether new causes of errors exist that would lead to significant improper payments and require reporting in accordance with the improper payment categories outlined in OMB Circular A-123, appendix C, for fiscal years 2015 and beyond. Modifications to the contract for reporting in the fiscal year 2015 AFR were not made, so new categories for error were not identified and quantified for inclusion in Table 2. A new contract, issued on July 10, 2015, applied to the studies completed in fiscal year 2016. We will review the fiscal year 2016 AFR to determine whether the new contract permits HUD to obtain improper payment estimates for failure to verify financial and death data, and whether the information was properly reported in tables 1 and 2. Recommendation 2014-FO-0004-002-H, from audit report 2014-FO-0004, recommended that the OCFO work with the Office of Public and Indian Housing and the Office of Multifamily Housing Programs to determine annual improper payments HUD made to deceased tenants and report this amount as an additional source of improper payments in the AFR. OCFO management disagreed with identifying deceased tenants as an additional source of improper payments in the AFR. OCFO stated in its management decision that the current studies intentionally do not include deceased tenants because 18 they are handled through another method (the Enterprise Income Verification system). This recommendation remains open;16 thus, HUD studies continue to exclude identifying and quantifying error associated with the failure to verify death data for proper reporting in table 2. HUD Did Not Identify or Report High-Dollar Overpayments HUD failed to establish a process to identify whether there were reportable RHAP high-dollar overpayments or inform OMB and us that it had nothing to report in a given quarter. In prior years, under OMB Memorandum M-10-13, Issuance of Part III to OMB Circular A-123, appendix C, issued March 22, 2010, HUD was exempt from reporting on high-dollar overpayments to OMB and us. However, changes in the definition of an entity under OMB Memorandum, M-15-02, appendix C to Circular No. A-123, Requirements for Effective Estimation and Remediation of Improper Payments, issued October 20, 2014, removed HUD’s exemption. HUD did not implement a process to ensure that it complied with this requirement as a result of the change in definition. Conclusion OCFO developed and implemented the “IPERIA AFR Requirements Checklist” to help ensure improper payment reporting in the fiscal year 2015 AFR was complete and complied with OMB Circular A-136 requirements. However, there were issues with the implementation of the checklist as HUD failed to report all information required. HUD was in the process of determining how it would obtain the information necessary to report on high-dollar overpayments for RHAP. Recommendations We recommend that the Office of the Chief Financial Officer: 4A. Amend the checklist to ensure that the description of corrective actions in the AFR include an explanation of how the corrective actions address the root causes reported in table 2 and all required timelines. 4B. Establish and implement procedures to ensure that the required information specified in the checklist is adequately and specifically addressed and is included in the published AFR. 4C. Establish and implement a process to identify high-dollar overpayments and report them quarterly to OMB and us or submit a written request to OMB for an alternative reporting structure. 16 See Followup on Prior Audits, recommendation 2014-FO-0004-2H 19 Scope and Methodology We conducted our audit of HUD’s compliance with IPERA for fiscal year 2015 from December 2015 through April 2016 at HUD headquarters in Washington, DC, and followed OMB Circular A-123, appendix C, guidance on OIG’s responsibility. OMB Circular A-123, appendix C, states the following: To determine compliance with IPERA, the agency inspector general should review the agency’s AFR or PAR (and any accompanying information) for the most recent fiscal year. Compliance with IPERA means that the agency has a. Published an AFR or PAR for the most recent fiscal year and posted that report and any accompanying materials required by OMB on the agency Web site; b. Conducted a program specific risk assessment for each program or activity that conforms with the Section 3321 note in 31 U.S.C. (United States Code) (if required); c. Published improper payment estimates for all programs and activities identified as susceptible to significant improper payments under its risk assessment (if required); d. Published programmatic corrective action plans in the AFR or PAR (if required); e. Published, and is meeting, annual reduction targets for each program assessed to be at risk and estimated for improper payments (if required and applicable); and f. Reported a gross improper payment rate of less than 10 percent for each program and activity for which an improper payment estimate was obtained and published in the AFR or PAR. If an agency does not meet one or more of these requirements, it is not compliant under IPERA. In addition, as part of its review of these improper payment elements, the agency inspector general may evaluate the accuracy and completeness of agency reporting and evaluate agency performance in reducing and recapturing improper payments. Finally, as part of the annual compliance review, for agencies that have high-priority programs, the agency inspector general must: evaluate the agency’s assessment of the level of risk associated with the high-priority programs and the quality of the improper payment estimates and methodology; determine the extent of oversight warranted; and provide the agency head with recommendations, if any, for modifying the agency’s methodology, 20 promoting continued program access and participation, or maintaining adequate internal controls. To accomplish our audit, we reviewed OCFO’s and FHA’s fiscal year 2015 improper payment risk assessments, which did not identify any new programs as susceptible to significant improper payments. HUD reported improper payments for two programs in its fiscal year 2015 AFR): RHAP and the Disaster Relief Appropriations Act supplemental appropriations. We reviewed the information that HUD reported for these two programs in the AFR; met with the appropriate personnel from OCFO, PIH, the Office of Multifamily Housing Programs, and the Office of Community Planning and Development; and reviewed HUD’s internal controls, policies, procedures, and practices for preventing, reducing, and recovering improper payments. We also met with the contractor that performed the QC and income match studies for the RHAP improper payment estimate to help us evaluate HUD’s methodology and the results of the study. Lastly, we reviewed the requirements contained in the applicable Federal laws, Executive Order 13520, and the implementation guidance found in OMB Circular A- 123, appendix C, that govern actions needed by the agency to address the issue of improper payments. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 21 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objectives: HUD’s design and implementation of controls to prevent, detect, and recover improper payments. HUD’s reporting processes between program offices and OCFO. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following items are significant deficiencies: HUD’s improper payments risk assessment process did not ensure that all HUD programs were assessed on a 3-year cycle and did not consider all of the nine required risk factors (finding 1). HUD did not have a process in place to ensure that all programs that expended $1 million or more during the fiscal year were either considered for payment recapture audits or excluded because it was determined that these audits would not be cost effective (finding 2). HUD did not use accurate information to estimate improper payments due to billing error and did not evaluate the types of errors that could lead to significant improper payments (finding 3). HUD did not fully implement its documented procedures to ensure the reporting of complete and accurate information regarding improper payments in its AFR (finding 4). 22 Followup on Prior Audits We reviewed the recommendations from Audit Report 2014-FO-0004, Compliance with the Improper Payments Elimination and Recovery Act of 2010; and the recommendations from Audit Report 2015-FO-0005, Compliance with the Improper Payments Elimination and Recovery Act. As of May 13, 2016, we found that 9 of the 21 recommendations from audit report 2014-FO-0004 and that 1 of the 6 recommendations from audit report 2015-FO-0005 remained open with final action target dates between March 6, 2015, and August 31, 2018. Of these 10 open recommendations, management decisions had not been reached on 7. The 10 open recommendations are listed below. We recommended that the Chief Financial Officer 1. Report on Multifamily, Public Housing, and Section 8 program improper payment rates separately in the agency financial report (recommendation 2014-FO-0004-1G: no agreed-upon management decision or final action target date). 2. Work with PIH and Multifamily Housing to determine annual improper payments HUD made to deceased tenants, and report this amount as an additional source of improper payments in the agency financial report (recommendation 2014-FO-0004-2H: no agreed- upon management decision or final action target date). 3. Reassess the susceptibility of significant improper payments for the CPD [Office of Community Planning and Development] entitlement, non-entitlement, HOME Investment Partnerships Program, and other formula grant programs based on the results of audit report 2014-FO-0003 as well as the community service and self-sufficiency requirement in public housing subsidiaries identified in OIG audit report 2015-KC-0001 (recommendation 2015-FO-0005-3C: final action target date: August 31, 2018). We recommended that the Assistant Secretary for Public and Indian Housing 4. Reassess existing supplemental measures and corrective actions, and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (recommendation 2014-FO- 0004-2A: recommendation is pending approval for revised management decision - no final action target date).17 We recommended that the Deputy Assistant Secretary for Multifamily Housing Programs 5. Coordinate with all appropriate program officials when responding to OCFO’s information requests to ensure that all statements are accurate for the current fiscal year, to include but not be limited to updates to corrective action plans, internal controls in 17 A revised management decision was submitted on March 14, 2016, resetting the final action target date from April 30, 2015. 23 place, and information on any barriers the agency is experiencing (recommendation 2014-FO-0004-1L: final action target date: August 31, 2016). 6. Develop and execute formal plans to hold accountable program officials and processing entities (owners or administrators) responsible for improper payments (recommendation 2014-FO-0004-1M: recommendation is pending approval for revised management decision and extension of final action target date).18 7. Reassess existing supplemental measures and corrective actions, and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (recommendation 2014-FO- 0004-2D: recommendation is pending approval for revised management decision and extension of final action target date).19 8. Periodically reevaluate the supplemental measures and corrective actions so that new and innovative ways to reduce improper payments are identified and implemented (recommendation 2014-FO-0004-2E: final action target date: August 31, 2016). 9. Work with REAC [Real Estate Assessment Center] to develop management-level reports in EIV [Enterprise Income Verification system] that will allow Multifamily Housing management to efficiently and effectively identify processing entities that are responsible for improper payments and develop policies and procedures to hold owners/administrators identified accountable (recommendation 2014-FO-0004-2F: recommendation is pending approval for revised management decision and extension of final action target date).20 We recommended that the Deputy Assistant Secretary for the Real Estate Assessment Center 10. Work with PIH and Multifamily Housing management to develop management-level reports in EIV that will allow PIH and Multifamily Housing management to efficiently and effectively identify processing entities that are responsible for improper payments (recommendation 2014-FO-0004-2G: recommendation is pending approval for revised management decision - no final action target date).21 18 A revised management decision was submitted on March 3, 2016, resetting the final action target date. On April 19, 2016, management requested OIG’s approval to extend the final action target date from March 6, 2015 to August 31, 2016. 19 A revised management decision was submitted on February 25, 2016, resetting the final action target date. On April 19, 2016, management requested OIG’s approval to extend the final action target date from April 30, 2015 to April 30, 2017. 20 Ibid. 21 A revised management decision was submitted on October 2, 2015, resetting the final action target date from April 30, 2015. 24 Appendixes Appendix A Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments Evaluation Comment 1 Comment 2 Comment 3 25 Ref to OIG Evaluation Comment 3 Comment 4 26 OIG Evaluation of Auditee Comments HUD generally agreed with OIG’s overall conclusion about HUD’s noncompliance with IPERA. Comment 1: Our records showed that we issued 27 audit recommendations from our fiscal years 2013 and 2014 IPERA audit reports. Out of the 27 recommendations, HUD closed 17 of them prior to May 13, 2016, leaving 10 recommendations that were not fully implemented. We will continue to reconcile our differences in these areas with the Department during our audit follow-up. We are encouraged by the Department’s commitment to achieving full compliance with IPERA by changing its approach going forward. Comment 2: Our audit report cited two IPERA compliance determinations that were not met by HUD. HUD acknowledged the improper payment reduction target as the basis for its noncompliance but not the risk assessment issue. Additionally, HUD stated that the reason for not meeting its improper payment reduction target in fiscal year 2015 was because of fluctuations in stakeholder preferences. However, as noted in our report, HUD did not achieve its improper payment reduction target because it did not fully address the root causes of the improper payments. Additionally, OIG, in fiscal year 2015, cited problems with HUD’s risk assessment as the basis for noncompliance with IPERA. This was also reported in our fiscal year 2014 audit report. Comment 3: We disagree with HUD’s position that some of the audit issues cited in our report was based on incorrect assumptions or information. OIG’s position remains that our conclusion was based on facts supported by the evidence obtained during the audit. Our audit report cited specific instances in which HUD failed to adequately consider all nine required risk factors in accordance with OMB guidance. Additionally, OIG disagrees with OCFO’s two-step approach. Under this approach, a program or activity will not be subject to the qualitative risk assessment protocol established by OCFO if its annual outlays for the year are less than $40 million. We also do not agree with OCFO’s approach because it excludes programs that are under the $40 million threshold from the risk assessment process. In accordance with OMB Circular A-123, Appendix C, Part 1, (A)(10), HUD is required to perform risk assessments for all programs starting in fiscal year 2011 unless a waiver is received from OMB. We cited the two human errors as examples in which HUD did not comply with HUD’s internal policies for the risk assessment to emphasize that its oversight and review process failed to detect or prevent them. 27 Regarding HUD’s comments on the FHA single family claims program, we explained in our report the causal relationship between improper payments on claims and lender underwriting noncompliance. Specifically, we reported that noncompliant lenders agreed to pay HUD $1.4 billion in fiscal years 2014 and 2015 to settle allegations that they failed to comply with FHA’s underwriting requirements. This settlement amount is compensation for claims paid by FHA to these lenders. OIG has identified the risk of improper payments that is due to lender underwriting noncompliance. It is FHA’s responsibility to measure the significance of this risk by quantifying the rate or frequency of this risk in FHA’s mortgage insurance program. The methodology by which the rate or frequency of risk is determined will be up to FHA, but we expect it to be reasonable. Given the volume and magnitude of claim disbursements made by FHA each year, we determined that FHA must ensure that its improper payment rate is maintained below 0.5 percent of the total $20 billion average annual claim disbursements. This would ensure that it is under OMB’s $100 million threshold limit for significant improper payments. These factors strongly support a high risk rating for the FHA single family claims program. Comment 4: We noted actions taken by the HUD OCFO to address the issues that we brought to its attention during the audit. In response to our audit, HUD made changes in fiscal year 2016 to improve its transparency in its decision-making processes related to its payment recapture audit plan. We plan to review the implementation of these changes in our fiscal year 2016 audit. The findings and recommendations reported are based on audit issues identified during our fiscal year 2015 IPERA audit. They are intended to help HUD become compliant with IPERA and OMB Circular A-123, appendix C, in future years. We support HUD’s efforts to recalibrate its IPERA program using an external expert. We look forward to working with the department on this effort next year. 28
Fiscal Year 2015 Audit of HUD's Compliance with the Improper Payments Elimination and Recovery Act
Published by the Department of Housing and Urban Development, Office of Inspector General on 2016-05-13.
Below is a raw (and likely hideous) rendition of the original report. (PDF)