Office of the Chief Financial Officer, Washington, DC Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit Office of Audit, Financial Audits Division Audit Report Number: 2017-FO-0003 Washington, DC November 15, 2016 To: Courtney Timberlake, Deputy Chief Financial Officer, F /signed/ From: Thomas McEnanly, Director, Financial Audits Division, Washington DC, GAF Subject: Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) additional details to supplement our audit of HUD’s internal controls over financial reporting and compliance with applicable laws, regulations, and governmentwide policy requirements and provisions of contracts and grant agreements. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. Audit Report Number: 2017-FO-0003 Date: November 15, 2016 Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit Highlights What We Audited and Why We are required to audit the consolidated financial statements of the U.S. Department of Housing and Urban Development (HUD) annually in accordance with the Chief Financial Officers Act of 1990 as amended. This report supplements our independent auditor’s report on the results of our audit of HUD’s principal financial statements for the fiscal years ending September 30, 2016 and 2015 (Restated) related to HUD’s internal controls and compliance with applicable laws, regulations, and governmentwide policy requirements and provisions of contracts and grant agreements. What We Found We issued a disclaimer of opinion on HUD’s consolidated financial statements for fiscal years 2016 and 2015 (restated) due to HUD’s inability to deliver principal financial statements for the fiscal years ending September 30, 2016 and 2015 (Restated) and accompanying notes in a timely manner. This report provides additional details on five material weaknesses, four significant deficiencies, and four instances of noncompliance with applicable financial management laws and regulations. Details of the results of our audit of HUD’s component entities, the Federal Housing Administration and Government National Mortgage Association (Ginnie Mae), can be found in separate audit reports. Primarily, HUD (1) lacked adequate controls over its financial reporting preparation process, (2) inadequately accounted for assets and liabilities in accordance with GAAP, (3) delayed completion of significant reconciliations, (4) did not account for the Office of Community Planning and Development’s formula grant programs’ commitments and disbursements in accordance with GAAP, and (5) lacked adequate financial management systems to ensure accurate and reliable financial reporting. These conditions were caused by (1) inadequate monitoring and rushed implementation of the New Core Project and the transition to a Federal shared service provider, (2) poor internal controls and oversight of Ginnie Mae’s financial reporting, and (3) continued weaknesses in HUD’s financial management governance structure. What We Recommend We recommend that HUD (1) properly account for all financial transactions in accordance with GAAP, (2) improve internal controls over the financial reporting process, (3) transition as much as $168.3 million in excess funding from public housing agencies to HUD-held reserves, and (4) deobligate $332.4 million in invalid or inactive obligations. Table of Contents Background and Objective......................................................................................3 Results of Audit ........................................................................................................4 Material Weaknesses ........................................................................................................ 4 Finding 1: Weak Internal Controls Over Financial Reporting Led to Errors and Delays in the Preparation of Financial Statements and Notes ...................................... 4 Finding 2: HUD Assets and Liabilities Were Misstated and Not Adequately Supported......................................................................................................................... 11 Finding 3: Significant Reconciliations Were Not Completed in a Timely Manner . 19 Finding 4: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements ............................................ 25 Finding 5: HUD’s Financial Management System Weaknesses Continued in 2016 28 Significant Deficiencies ................................................................................................... 33 Finding 6: HUD’s Financial Management Governance Was Ineffective ................. 33 Finding 7: Weaknesses in HUD’s Administrative Control of Funds System Continued......................................................................................................................... 39 Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations ........................................................................................................................................... 45 Finding 9: HUD’s Computing Environment Controls Had Weaknesses ................. 52 Compliance With Laws and Regulations.............................................................58 Finding 10: HUD’s Financial Management System Did Not Comply With the Federal Financial Management Improvement Act ...................................................... 59 Finding 11: HUD Continued To Not Comply With the HOME Investment Partnership Act ............................................................................................................... 61 Finding 12: HUD Did Not Comply With Treasury Financial Manual Rules on Cash Management or 2 CFR Part 200.................................................................................... 64 Finding 13: HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010 ...................................................................................................... 68 Scope and Methodology .........................................................................................71 Followup on Prior Audits ......................................................................................73 Appendixes ..............................................................................................................87 A. Schedule of Funds To Be Put to Better Use .................................................... 87 B. Departmentwide Obligation Review – Schedule of Recommended Deobligations ...................................................................................................... 88 C. Federal Financial Management Improvement Act Noncompliance, Responsible Program Offices, and Recommended Remedial Actions ......... 89 D. Auditee Comments and OIG’s Evaluation ..................................................... 91 Background and Objective We are required by the Chief Financial Officers Act of 1990, as amended by the Government Management Reform Act of 1994 and implemented by Office of Management and Budget (OMB) Bulletin 15-02, Audit Requirements for Federal Financial Statements, to audit the U.S. Department of Housing and Urban Development’s (HUD) principal financial statements or select an independent auditor to do so. The objective of our audit was to express an opinion on the fair presentation of these principal financial statements. In planning our audit of HUD’s principal financial statements, we considered internal controls over financial reporting and tested compliance with selected provisions of applicable laws, regulations, and government policies that may materially affect the consolidated principal financial statements. Providing an opinion on internal controls or compliance with selected provisions of laws, regulations, and government policies was not an objective, and, accordingly, we do not express such an opinion. Management is responsible for • Preparing the financial statements in conformity with accounting principles generally accepted in the United States of America; • Establishing, maintaining, and evaluating internal controls and systems to provide reasonable assurance that the broad objectives of the Federal Financial Management Improvement Act of 1996 (FFMIA) are met; and • Complying with applicable laws and regulations. In auditing HUD’s principal financial statements, we were required by Government Auditing Standards to obtain reasonable assurance about whether HUD’s principal financial statements were presented fairly, in accordance with generally accepted accounting principles (GAAP), in all material respects. We believe that our audit provides a reasonable basis for our disclaimer of opinion. This report is intended solely for the use of HUD management, OMB, and Congress. However, this report is a matter of public record, and its distribution is not limited. 3 Results of Audit Material Weaknesses Finding 1: Weak Internal Controls Over Financial Reporting Led to Errors and Delays in the Preparation of Financial Statements and Notes Internal controls over HUD’s financial reporting process were weak, hindering HUD’s ability to deliver the yearend financial statements and accompanying notes in a timeframe that allowed for sufficient OIG audit review. Additionally, Ginnie Mae closed material accounts prematurely. Finally, HUD performed 2,868 journal vouchers to adjust transactional data in its general ledger, primarily due to data quality issues. Ineffective governance over HUD’s transition to a Federal Shared Service Provider (FSSP), Treasury’s Administrative Resource Center (ARC), and Ginnie Mae’s budgetary accounting created an ineffective financial reporting environment that could not prevent and detect errors in a timely manner. As a result, (1) we could not audit HUD’s yearend financial statements and accompanying notes, (2) HUD’s fiscal year 2016 third quarter financial statement notes contained unsupported balances and errors totaling $477 million, and (3) HUD had to restate its fiscal year 2015 statement of budgetary resources due to an error with an absolute value of $2 billion. Further, HUD’s extensive reliance on manual journal vouchers increased the risk of error in its general ledger and financial statements. HUD’s Year End Consolidated Financial Statements and Notes Were Not Available For Audit In fiscal year 2016, HUD transitioned to a FSSP, ARC, which included the migration of its general ledger to Oracle Federal Financials and many of its financial reporting processes. Although HUD worked with ARC prior to implementation, the financial reporting process was never tested or documented to ensure that Oracle Federal Financials could produce HUD’s consolidated financial statements and HUD proper notes within required timeframes, which lead to delays in the delivery of final financial statements and notes. Despite requests from OIG to provide first and second quarter financial statements and note disclosures as a means of testing the process, HUD decided to delay preparing financial statements and notes because they were not required to be reported to OMB until the third quarter. Once HUD and ARC went through the reporting process to prepare third quarter statements and notes, they realized that there were many issues that they had not previously 4 identified. 1 Further, HUD did not have standard operating procedures and desk procedures that (1) clearly outlined roles and responsibilities between HUD, FHA, Ginnie Mae, and ARC at an individual financial statement component and note disclosure level, (2) detailed steps on how to prepare the financial statements and notes, and (3) provided an agreed upon timeline for completion of all steps required to complete consolidated financial statements. This led to confusion regarding responsibilities and deadlines, causing errors and unsupported data in HUD’s third quarter notes. These weaknesses were exacerbated by the late notification of restatements for both of HUD’s component entities, FHA and Ginnie Mae. HUD’s OCFO decided to implement a new quality control validation review after the preparation of its year end statements, which identified errors. While HUD’s intention for the quality control validation review was to ensure the accuracy of its consolidated financial statements, this internal control procedure should have been implemented as part of HUD’s complementary controls after the transition to the FSSP. HUD agreed to provide its final consolidated financial statements and notes to the OIG on October 31, 2016. However, due to the internal control weaknesses described above, it could not provide them until November 10, 2016, only three business days prior to the issuance of our independent auditor’s report on HUD’s consolidated financial statements on November 15, 2016. Due to the significant delay in delivery of the final statements and notes, we were unable obtain sufficient appropriate audit evidence to validate their accuracy. Therefore, we were unable to provide an opinion over HUD’s fiscal year 2016 and 2015 (restated) consolidated financial statements and notes. HUD’s Third Quarter Financial Statement Notes Contained Errors or Were Unsupported As discussed above, we identified several issues as part of our third quarter financial statement and notes review. First, 11 of the 18 third quarter financial statement note disclosures ARC was responsible for contained errors and ARC’s RSSI Statement of Net Costs was inaccurate. Further, the information that ARC did provide was provided too late in the process for HUD’s OCFO to use for submission to OMB. Since ARC could not use Oracle Federal Financials, HUD’s system of record, to provide all the financial information HUD needed to prepare its consolidated note disclosures, HUD used its Hyperion Financial Management System (HFM). While HFM is a good validation tool to identify potential errors in statements and notes prepared by ARC, relying on it for note preparation increased the risk of a misstatement in HUD’s financial statements and note disclosures because (1) it had not been adequately validated for 1 For example, we noted the following issues at third quarter: 1) Program cylinders in Oracle needed modifications so that funds could be grouped under the correct program. 2) HUD and ARC had not come to agreement on who would include eliminations in the note disclosures. 3) Some of the data attributes and formulas used to produce the notes and Required Supplementary Stewardship Information (RSSI) were incorrect. HUD reported issues with the consolidation of Ginnie Mae and FHA and “other” identified errors at fourth quarter, but did not provide the specifics. 5 accuracy2 and (2) post-closing adjustments could be made in Oracle after the final data load to HFM. Due to these deficiencies, we noted the following errors in HUD’s third quarter notes and disclosures: (1) HUD’s Note 30- Reconciliation of Net Cost of Operations to Budget was off by $187 million compared to HUD’s financial statements, and (2) HUD’s Note 28- Apportionment Categories of Obligations Incurred; category A versus B obligations and direct versus reimbursable obligations were incorrect by approximately $278 million and $12 million, respectively. In addition to the errors noted above, since ARC could not produce all of the financial statement information needed for the note disclosures from Oracle Federal Financials, we were not able to obtain reasonable assurance over all of the lines items in the following notes because they were prepared using data from HFM and could not be supported with data from HUD’s system of record (Oracle Federal Financials): Note 7-Accounts Receivable Notes 22- Total Cost and Earned Revenue by Budget Functional Classification Note 23- Expenditures by Strategic Goal Note 24- Net Costs of HUD’s Cross-Cutting Programs Note 27- Disaster Recovery Relief Efforts Note 30- Reconciliation of Net Cost of Operations to Budget With proper testing and planning, these issues should have been identified and addressed prior to third quarter reporting. However, since this testing was not performed, all of the issues could not be resolved in time for third quarter reporting and remained unresolved, which ultimately led to our disclaimer on HUD’s financial statements and notes. 2 HFM was previously designed to read and extract HUDCAPS data. For HFM to produce correct financial statements and notes, it must understand how to read and crosswalk the data loaded into the application based on its data attributes. Since data attributes and system logic are different in HUDCAPS versus Oracle, testing is needed to ensure HFM correctly crosswalks the Oracle data to produce accurate financial statements and notes. The financial statement balances produced by HFM contained differences when compared to Oracle as of the third quarter. If there are differences at the financial statement level, there is an increased risk that differences exist at the more granular level. 6 Ginnie Mae’s Fiscal Year 2015 Statement of Budgetary Resources Contained Material Errors During fiscal year 2015, we reported 3 that we were not able to audit Ginnie Mae’s statement of budgetary resource activity because Ginnie Mae (1) manually adjusted most of its budgetary accounts,4 (2) lacked proper controls or an adequate audit trail to support its material adjustments, and (3) did not provide its budgetary resources trial balances and detailed supporting documentation within the timeframe needed to conduct adequate audit procedures. This condition occurred because Ginnie Mae’s management did not devote sufficient resources to ensure the successful implementation of a new budgetary module in its financial system, the Ginnie Mae Financial Accounting System (GFAS). We reviewed the material adjustments made in fiscal year 2015 as part of our audit work in fiscal year 2016 and determined that several of the adjustments were incorrect because they closed U.S. Standard General Ledger (USSGL) accounts 4700 (commitments), 4610 (allotments), and 4450 (unapportioned authority) before yearend closing. The USSGL requires that agencies close these accounts in the yearend closing process, not before issuance of its yearend statements. As a result, HUD’s apportioned and unapportioned authority line items on its fiscal year 2015 statement of budgetary resources were understated and overstated by $1 billion (total absolute value of $2 billion). Therefore, HUD restated its fiscal year 2015 consolidated statement of budgetary resources to correct the errors caused by Ginnie Mae. Ginnie Mae reported that this had always been its closing process and could not explain why its process deviated from the USSGL. 5 In addition, Ginnie Mae lacked a review process to identify and reject adjustments that were not in compliance with the USSGL. As reported in fiscal year 2015, the manual calculation to determine the final balances was performed by one staff member, and the journal vouchers used to adjust the balances did not include sufficient support for proper supervisory review. Further, while HUD’s Office of the Chief Financial Officer (OCFO) performed some review of Ginnie Mae’s financial statements, its review would not have detected these material errors since they were made at the component level. We attributed this financial reporting error to Ginnie Mae’s weak financial management governance, which we reported on in fiscal year 2015. 6 Historically, Ginnie Mae has not prioritized the accounting for its statement of budgetary resources primarily because it is not included in its stand-alone financial statements. 7 This problem is evidenced by the fact that 3 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit 4 Ginnie Mae adjusted 8 accounts, which affected 10 of the 11 accounts it reported in its status of budgetary resources in its trial balance. These accounts adjusted made up 98 percent of Ginnie Mae’s total status of budgetary resources and totaled $20.4 billion. 5 Ginnie Mae stated that it must have been initiated because the apportionment for the negative subsidy payment is an estimate that requires adjustment at the end. We agree that this explanation supports an adjustment; however, it does not explain why the entire 4610 and 4700 accounts were closed to 4450 before yearend. 6 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit 7 Ginnie Mae does not include a statement of budgetary resources in its stand-alone statements because its statements are issued under the Financial Accounting Standards Board, not the Federal Accounting Standards 7 Ginnie Mae did not have a system to account for and report its budgetary resources until fiscal year 2015, 8 in response to an Office of Inspector General (OIG) finding on the subject. Even then, the module that was implemented within its core financial system was producing incorrect balances due to insufficient resources allocated by Ginnie Mae management to ensure that the new module accounted for and reported budgetary resources accurately. In response to our fiscal year 2015 recommendations, Ginnie Mae hired additional staff in this area. With an automated system and increased staff, Ginnie Mae is making progress toward improving the quality of its statement of budgetary resources; however, the effects of its old process continue to impede its efforts. HUD’s Reliance on Manual Journal Vouchers Increased Risk HUD relied heavily on manual journal vouchers in fiscal year 2016 to ensure that its general ledger and financial statements were accurate. Specifically, HUD used 2,868 journal vouchers totaling $7.8 trillion to adjust transactional data in its general ledger. 9 While many of these journal vouchers did not impact amounts at the USSGL account level by fund, they did manually change transactional data either by (1) adjusting one or more segments of the accounting flex field 10 or (2) closing accounting flex fields manually to maintain vendor-level detail. 11 Most of these journal vouchers, which adjusted transactional data totaling $5.8 trillion, were used to correct data conversion issues that arose from differences in processing requirements between the HUD Centralized Accounting and Program System (HUDCAPS) and Oracle. 12 Eighty-eight percent of this $5.8 trillion was to manually close the accounting flex fields that required vendor- level detail because Oracle’s yearend close process did not roll forward vendor-level information that was needed to populate HUD’s custom trial balances. The remaining $680 billion in journal vouchers was used to adjust transactional data to correct misalignments of summary templates and other issues with HUD’s converted data. We attributed these issues to the rushed implementation of phase 1, release 3, of the New Core Project. 13 In addition to the data issues, HUD did not do enough research and preparation to ensure that Oracle Federal Financials could adequately address its needs. Advisory Board (FASAB). The Financial Accounting and Standards Board does not require a statement of budgetary resources. 8 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit 9 This includes both the debits and the credits. 10 The accounting flex field represents the accounting strip or line of accounting and must be present on every transaction in Oracle Federal Financials. Segments include fund, budget fiscal year, USSGL, budget objects class, internal org, cost pool, Cam 1, category B, program, cohort, Cam 2, and Cam 3. 11 Oracle’s yearend close process did not roll forward vendor-level information that was needed to populate HUD’s custom trial balances. Therefore, ARC had to manually close the accounting flex fields that required vendor-level detail. 12 HUD converted all of its pre-2016 HUDCAPS data into Oracle and used a New Core Interface Solution (NCIS) interface to convert HUDCAPS data into Oracle data throughout the year. There were issues with the initial conversion and the activity that was converted from HUDCAPS to Oracle throughout the year. 13 For further details, see Audit Report 2016-DP-0004, New Core Project: Phase 1, Release 3, Implementation and New Core Interface Solution Functionality, Finding 1: HUD Rushed Implementation of Phase 1, Release 3, of the New Core Project. 8 In addition to the adjustment related to data conversion, HUD adjusted transactional data totaling (1) $1.7 trillion as part of Oracle’s normal closing process; (2) $16.5 billion to correct differences identified between its general ledger and its subledgers; (3) $17.3 billion to record loan balances and loan guarantee limits and subsidy transfers that should have been recorded in prior years and to resolve discrepancies between HUD’s subsidiary records and general ledger; (4) $2.7 billion to adjust its budgetary balances to agree with Standard Form (SF)-132; (5) $1.2 billion to adjust its cash balances to agree with those of the U.S. Treasury; (6) $4.7 billion to account for daily loan activity; and (7) $70.2 billion for items that will always require manual adjustments, such as grant accruals and eliminations. This extensive use of journal vouchers complicated the financial reporting process, burdened staff, and increased the risk of error. Conclusion HUD’s financial reporting process is complex and time sensitive. The planned transition of this process to ARC should have included the design and implementation of internal controls to ensure that errors would be prevented or detected in a timely manner. However, ineffective oversight of the New Core project and Ginnie Mae’s accounting for budgetary resources allowed for insufficient controls to exist, causing (1) significant delays in HUD’s year end financial statements and notes, and (2) errors in HUD’s fiscal year 2015 combined statement of budgetary resources and fiscal year 2016 third quarter notes. As a result, we could not provide an opinion over HUD’s fiscal year 2016 and 2015 consolidated financial statements and notes and HUD’s fiscal year 2015 statement of budgetary resources were restated due to material misstatements with an absolute value totaling $2 billion. HUD’s financial statements were at additional risk of error because of the extensive number of journal vouchers used to adjust transactional data in its general ledger. Recommendations We recommend that the Deputy Chief Financial Officer 1A. Restate HUD’s fiscal year 2015 consolidated financial statements to report the correct balances for Ginnie Mae’s unobligated apportioned and unapportioned line items. 1B. Communicate the reissuance of the fiscal year 2015 financial statements to those charged with governance, oversight bodies, funding agencies, and others who rely on or are likely to rely on the financial statement(s), as required by OMB Circular A-136. 1C. Review Ginnie Mae’s accounting policies to ensure that they comply with the USSGL. 1D. Develop and implement policies and procedures that clearly outline the role and responsibilities of both HUD and ARC in the financial statement preparation and review process, including a timeline that will ensure compliance with OMB financial reporting deadlines and allow sufficient time to be audited. 1E. Determine which notes cannot be completed in Oracle and develop and implement a plan to ensure that these notes can be produced in Oracle. 9 1F. Perform user acceptance testing in Oracle to ensure that it can produce all HUD proper financial information needed for note preparation within the timeframe required. If it is determined that HFM will be used for some portions of the notes, perform user acceptance testing to ensure that HFM is reading and crosswalking the Oracle data correctly. 1G. Based on the user acceptance testing, implement any further modifications needed in Oracle or HFM to ensure that the notes are populated correctly. 1H. Prepare first and second quarter financial statements and note disclosures for fiscal year 2017 and beyond to ensure the early identification of errors or problems in the financial reporting process. 1I. Work with ARC to develop an automatic process for closing accounts that maintains the vendor level detail needed to populate HUD’s custom trial balances. We recommend that Ginnie Mae’s Chief Financial Officer 1J. Implement controls to ensure that apportionments, allotments, and commitments (accounts 4510, 4610, and 4700) are closed to unapportioned authority (account 4450) as part of the yearend closing process and not before issuing any of its future financial statements. 10 Finding 2: HUD Assets and Liabilities Were Misstated and Not Adequately Supported HUD did not properly account for, have internal controls over, or have adequate support for all of its assets and liabilities. Specifically, (1) the Office of Community Planning and Development (CPD) did not validate its accrued grant liabilities estimates; (2) HUD’s accounting for its cash management process did not include the recognition of receivables and payables when incurred and understated its prepayment balance; (3) HUD did not recognize a prepayment for funds advanced to its Indian Housing Block Grant (IHBG) grantees used for investment; (4) the Emergency Homeowners’ Loan Program (EHLP) could not be audited; (5) balances related to HUD’s loan guarantee programs were not reliable; and (6) HUD did not properly account for its property, plant, and equipment. These problems occurred because of continued weaknesses in HUD’s internal controls and a lack of communication between OCFO and the program offices. As a result, several financial statement line items were misstated or could not be audited as of September 30, 2016. Specifically, (1) CPD’s accrued grant liabilities estimates could not be audited; (2) HUD’s Office of Public and Indian Housing (PIH) prepayments and accounts receivable balances contained errors with an absolute value of approximately $513.9 million 14 and $201.2 million, respectively, and accounts payable were understated by an unknown amount; (3) HUD’s expenses on its statement of net costs contained errors with an absolute value of $330.9 million; 15 (4) loans receivable balances for the EHLP could not be audited and were potentially misstated; (5) balances related to HUD’s loan guarantee programs were misstated by unknown amounts; and (6) HUD’s $297 million balance for property, plant, and equipment was not supported. CPD Did Not Validate Its Accrued Grant Liabilities Estimates For fiscal years 2016 and 2015, CPD reported accrued grant liabilities of $2.3 billion and $2 billion, respectively. These amounts accounted for 85 percent of HUD’s $2.7 billion total accrued grant liabilities reported for fiscal year 2016 and 84 percent of $2.4 billion for fiscal year 2015. As we first reported in fiscal year 2014, 16 CPD continued to lack a validation process for its estimated accrued grant liabilities due to a lack of procedures and relevant grantee reporting. As a result, it could not ensure that its assumptions and, therefore, its estimates were accurate and reliable in accordance with the requirements of Federal Accounting Standards Advisory Board (FASAB) Technical Release 12, Accrual Estimates for Grant Programs. Additionally, we did not have sufficient time to perform all of the audit procedures we deemed necessary to obtain sufficient, appropriate audit evidence to form an opinion on CPD’s fiscal year 2016 accrued grant liabilities because CPD did not have adequate internal controls in place. We were also unable to obtain all of the supporting documentation necessary for our work on CPD’s fiscal year 2015 estimates due to delays in obtaining HUD’s disbursement data, as 14 $513.9million = $260.1 million in prepayments not recorded for IHBG minus $183 million in receivables not recorded in the Housing Choice Voucher program plus a $70.8 million error in prepayment valuation. 15 $330.9 million = $260.1 million for IHBG advances that were expensed and $70.8 million due to errors in the Moving to Work program (MTW) calculation. 16 Audit Report 2015-FO-0004, Fiscal Years 2014 and 2013 Consolidated Financial Statements Audit, issued March 6, 2015 11 discussed in finding 5. There were no other compensating audit procedures that could be performed in the time available to obtain reasonable assurance regarding CPD’s accrued grant liabilities estimates for fiscal years 2015 and 2016. As a result, we were unable to obtain sufficient, appropriate audit evidence for CPD’s accrued grant liabilities and could not form an opinion on CPD’s accrued grant liabilities for fiscal years 2016 and 2015. CPD was working to develop a statistical sampling plan to validate its estimates and to obtain a waiver from Paperwork Reduction Act requirements so that it will be able to obtain relevant information from its grantees. As of September 30, 2016, a validation process had not been implemented. HUD Did Not Properly Account for Accounts Receivable, Payables, and Prepayments Related to PIH’s Cash Management Process in Accordance With GAAP PIH’s cash management process 17 reconciled HUD’s disbursements with actual expenses incurred by public housing agencies (PHA) to identify excess funds disbursed that should be recorded as advances (prepayment) or receivables or funding shortages that should be recorded as payables. Based on the completed reconciliations, PIH either performed offsets 18 to recover overpayments or provided additional funding to cover shortages. In fiscal year 2016, HUD also performed a confirmation process with PHAs to determine how much they were holding and how much of the excess it could transition back. The amount determined for transition back to HUD from this process also should have been recorded as a receivable. However, at the time these accounting events occurred, OCFO did not recognize a receivable or payable or reduce its prepayment balance by the amount of the receivable in accordance with Statements of Federal Financial Accounting Standards (SFFAS) 1, Accounting for Selected Assets and Liabilities. For example, in PIH’s March 31, 2016, confirmation process and June 30, 2016, cash reconciliation, PIH determined that it overpaid $201.2 19 million to certain PHAs and underpaid $33.1 million to others. However, OCFO did not recognize these as receivables or payables in the general ledger or interim financial statements, resulting in (1) $201.2 million in understated accounts receivable balances, (2) $183 million 20 in overstated prepayment balances, and (3) an understated accounts payable balance on its September 30, 2016, consolidated balance sheet. We could not determine the appropriate accounts payable balance as of September 30, 2016, because HUD did not track additional disbursements made to liquidate the payables. Since the cash reconciliation was completed several months after the period end, it was likely that the payable was liquidated before it was determined because of PHAs requesting additional funding 17 PIH performed cash management reconciliations (quarterly in calendar year 2015 and semiannually in calendar year 2016) to identify excess accumulations, which were collected through offsets against future monthly Housing Choice Voucher program disbursements. 18 When PIH determined that a PHA received a prepayment in excess of its immediate disbursement need, it offset future disbursements to collect the excess funding provided. 19 $123.2 million from regular housing assistance payment reconciliation, $18.2 million for admin fee reconciliation, $26.9 million from MTW housing assistance payment reconciliation, and $32.9 remaining and determined to be offset from the MTW PIH confirmation process 20 Only the regular housing assistance payment reconciliation impacts the PIH prepayment: $201.2 million - $18.2 million for admin expenses = $183 million. 12 to cover the shortages. However, since HUD did not track this process, we cannot be certain of the payable balance. HUD did not record receivables or payables because it did not have the necessary information systems to capture PHAs’ monthly housing assistance payment expenses. 21 As a result, it relied on PHA-reported expense information, which was not in real time and required HUD validation. 22 As a result, HUD’s cash management transactions were not recognized when incurred. The lack of an automated system and real-time expense information also made it challenging for HUD to determine its prepayment to Moving to Work program (MTW) PHAs. In fiscal year 2016, PIH spent extensive time and resources to manually determine this balance. While PIH had made progress with its valuation, we determined that the PIH prepayment contained errors with an absolute value of $70.8 million because two components of PIH’s calculation were incorrect 23. First, PIH used “restricted net position” as the beginning balance for four of its PHAs, as opposed to their “cash and investment balance,” which understated the beginning balance component by $33.1 million 24 This process is inconsistent with the way it calculated the balance for the 35 other MTW PHAs and inconsistent with SFFAS 1, which considers all cash outlays for anticipated expenses to be advances. Second, PIH used disbursement data with disbursement dates that did not match HUD’s general ledger. This misstated the disbursement component of HUD’s calculation because it excluded several disbursements totaling $34.6 million and included disbursements that did not occur during that period totaling $3.1 million. In our fiscal year 2013 report, we recommended that PIH’s cash management process be automated, and management generally concurred. However, without assurance from senior-level HUD management, PIH was reluctant to commit to a corrective action plan that involved the automation of this process. Therefore, as of the date of this report, management had not provided an agreed-upon action plan for our prior-year recommendations. Recently, PIH informed us that it was working with the Office of the Chief Information Officer (OCIO) on a project to replace HUD’s Inventory Management System-PIH Information System (IMS-PIC) and Voucher Management System, 25 which would change the way HUD disburses its money and help provide real-time expense information. 21 See Material Weakness 5 – Financial Management Systems for further detail. 22 PIH performed these manual calculations outside HUD’s financial systems using Excel spreadsheets and data from the Financial Assessment Subsystem, HUDCAPS, and the Voucher Management System for approximately 2,200 PHAs. 23 To calculate the MTW prepayment balance PIH used 3/31/16 PHA confirmed balances and added HUDCAPS disbursements from April-September and subtracted VMS expenses from April-July expenses and estimated expenses August- September. 24 To calculate restricted net position for these four PHAs, PIH subtracted liabilities and a 1-4 month Housing Choice Voucher program operating reserve from the total cash and investments on hand. 25 IMS-PIC allows PHAs to electronically submit information to HUD. IMS-PIC is responsible for maintaining and gathering data about all of PIH’s inventories of PHAs, developments, buildings, and units. HUD’s Voucher Management System supports the information management needs of PIH’s Housing Choice Voucher program management functions performed by the Financial Management Center and the Financial Management Division. This system’s primary purpose is to provide a central system to monitor and manage the PHA’s use of 13 HUD’s Accounting for Indian Housing Block Grant Prepayments Was Not in Accordance With GAAP HUD did not properly account for approximately $260.1 million 26 in advanced payments it made to its IHBG grantees for investment. In accordance with statutes, HUD authorized grantees to invest unused IHBG program grant funds for up to 5 years. These grantees must spend the funds on eligible, affordable housing activities by the 5-year deadline or return the funds to their line of credit in HUD’s Line of Credit Control System. As of June 30, 2016, 31 grantees authorized to invest funds had drawn down approximately $260.1 million in grant funds for investment activities. However, HUD accounted for these funds as disbursements and recorded an expense on the financial statements. These disbursements did not represent actual expenses because the grantees had not yet provided goods or services in return. Therefore, they should be recognized as an advanced payment on HUD’s financial statements in accordance with SFFAS 1. Initially, HUD did not record these prepayments as advances because OCFO was unaware that payments were being advanced to IHBG grantees. This condition occurred because OCFO did not regularly communicate with program offices to identify and evaluate the impact on financial reporting of program events through the use of a senior assessment council or comparable team. In fiscal year 2015, we notified OCFO about the advances and the need to properly account for them. We also recommended that the program office develop a tracking function to facilitate financial reporting and that the OCFO evaluate the process and work with the program office to calculate the amounts advanced to grantees. We have not reached a management decision on these recommendations because OCFO used IHBG program regulations instead of accounting standards to defend its position on expensing IHBG investments instead of recognizing them as advances on the financial statements. OCFO stated that it expensed IHBG investments because program regulations 27 allowed for investment of Federal cash; therefore, the funds were used for statutory purposes. This position conflicts with SFFAS 1 because it does not consider the timing of actual expenses, which occur when the grantee provides goods or services, 28 not when it invests Federal cash. While the grantees are authorized to invest Federal cash, this activity does not meet the criteria of an expense for financial accounting and reporting purposes. Additionally, grantees report the balances invested on OMB’s SF-425, 29 which requires them to vouchers. The Voucher Management System collects PHA data that enable HUD to fund, obligate, and disburse funding. 26 This estimate is based on our review of SF-425s as of December 31, 2015, and June 30, 2016. SF-425s for September 30, 2016, were not available in time for this report. 27 Regulations at 24 CFR (Code of Federal Regulations) 1000.58 permit IHBG grantees to invest their funding for up to 5 years. 28 According to SFFAS 1, “…advances are cash outlays made by a Federal entity to its employees, contractors, grantees, or others to cover a part or all of the recipients’ anticipated expenses or as advance payments for the cost of goods and services the entity acquires. Examples include travel advances disbursed to employees prior to business trips, and cash or other assets disbursed under a contract, grant, or cooperative agreement before services or goods are provided by the contractor or grantee.” 29 SF-425 is a Federal financial reporting standard form prescribed by OMB (OMB approval number 0348-0061). The form is completed by grantees and submitted to the Federal agency. Grantees report their investments on line 10c, Cash on Hand. The instructions for this line item state, “A recipient must compute the amount of Federal Cash on Hand due to undisbursed advance payments using the same basis that it uses in requesting the advances.” 14 report advances of Federal cash to the agency. This government document further supports that these funds are considered advances according to OMB rules. PIH Repayment Agreements Were Not Recognized in the General Ledger for Most of the Fiscal Year Several PHAs owed $41 million to HUD for a variety of reasons and agreed to pay it back through repayment agreements. Most of these repayment agreements originated before the start of fiscal year 2016; however, as of June 30, 2016, HUD did not record these as receivables in its third quarter financial statements, and they were not tracked in a central location and available to OCFO. On October 6, 2016, PIH provided these repayment agreements to OCFO, and OCFO recorded these repayment agreements; however, HUD’s internal controls to ensure the recognition of accounts receivable from repayment agreements failed, allowing this deficiency to exist for most of the fiscal year. As of the date of this report, PIH and OCFO were working on a process to ensure that all repayment agreements would be recorded in a timely manner in the future. The EHLP Loans Receivable Balance Was Not Auditable As reported in our fiscal year 2015 audit, 30 loan balances related to the EHLP were incomplete and unreliable. They continued to be unavailable for audit during our fiscal year 2016 audit. This condition continued because the loan data in HUD’s systems were not reliable and HUD did not complete processing corrections from its review of the data in time for inclusion in the fiscal year 2016 financial statements. As a result, we were unable to perform all of the audit procedures necessary to obtain sufficient, appropriate audit evidence regarding the accuracy of loans receivable balances related to the EHLP. During fiscal years 2015 and 2016, HUD performed a “scrub” of the loan-level detail data for the 7,960 open loans in the EHLP portfolio as a result of differences identified between the National Service Center’s Single-Family Mortgage Asset Recovery Technology system (SMART), where the loan files were maintained, with the data in the Loan Accounting System (LAS). We identified $116 million related to loan records in SMART that were not in LAS. The scrub was meant to ensure the accuracy and completeness of the EHLP loan data in SMART before entering the corrected data into LAS. The scrub was completed during fiscal year 2016; however, adjustments to correct the data were being made as of the end of our fieldwork. Therefore, the corrected data were not uploaded into HUD’s systems or available for audit by September 30, 2016. Balances Related to HUD’s Loan Guarantee Programs Were Not Reliable On September 15, 2016, HUD’s OCFO provided us with a walkthrough of its efforts in collaboration with ARC to reconcile and clean up balances related to its loan guarantee programs. We were informed that discrepancies were identified between (1) guaranteed loan- level limit carryover balances presented on the SF-132, Apportionment and Reapportionment Schedule, and what is recorded in HUD’s financial systems; (2) the subsidiary records and 30 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015 15 Oracle for the guaranteed loan level used and guaranteed principal outstanding general ledger accounts; (3) general ledger tie points in the program and financing accounts, (4) Oracle and the subsidiary records in the deferred revenue general ledger account, (5) Oracle and the subsidiary records in the foreclosed property general ledger account, and (6) Oracle and the subsidiary records when subsidy and obligation balances were looked at by cohort. Adjustments had been made to address some of the identified discrepancies; however, as of September 30, 2016, HUD and ARC were researching and resolving additional discrepancies. As of September 30, 2016, eight journal entries, with a total impact of $17.3 billion, 31 had been processed to correct identified discrepancies. Four of these journal entries, with a total impact of $16.4 billion, were made to record loan guarantee authority levels that were not recorded in fiscal year 2015. The other adjustments were made to record subsidy transfers that were not recorded in prior years, clear abnormal balances, and bring tie points between the program and financing accounts into agreement. HUD and ARC identified an additional $20.4 million in adjustments that had not been made as of September 30, 2016, and they continued to analyze the trial balances for the loan guarantee programs to identify any additional adjustments to reconcile and clean up HUD’s accounts. Our review of trial balances for HUD’s loan guarantee programs as of September 30, 2016, identified $8.8 million in discrepancies between undelivered orders – obligations, unpaid in the program accounts, and unfilled customer orders without advance in the financing accounts. These discrepancies existed because HUD did not have policies and procedures or the proper financial systems in place to account for and track its loan guarantee programs before fiscal year 2016. As a result, HUD’s loan guarantee balances, including its loan guarantee liability, foreclosed property, unpaid obligations, and memorandum accounts used to track the status of loan guarantee authority were not reliable. HUD’s Property, Plant, and Equipment Were Not Adequately Supported and Could Not Be Audited HUD’s accounting for its property, plant, and equipment did not comply with Federal accounting standards. The following deficiencies were identified and remained outstanding as of September 30, 2016: Inadequate subsidiary ledger for internal use software and commercial-off-the-shelf software licenses: HUD’s capitalized cost of internal use and commercial-off-the-shelf software licenses were not supported by an adequately detailed subsidiary ledger. A list of internal use software projects with an estimated cost of $254.3 million did not have adequate support for the underlying transactions. Additionally, $8 million in estimated costs for the development and implementation of the New Core Interface Solution (NCIS) software was not included. Lastly, HUD had not analyzed its inventory of commercial-off-the-shelf software licenses to determine the capitalized cost. 31 Absolute value of all debits and credits 16 Inadequate subsidiary ledger for property, plant, and equipment: Approximately $1.5 million of HUD’s property, plant, and equipment related to furniture and equipment could not be audited because the subsidiary ledger was unreliable and incomplete. In addition, we found at least $5 million in furniture and equipment purchases that were misclassified as expenses and had been excluded from the subsidiary records since 2014. Unrecorded reporting of leasehold improvements: Remodeling projects, totaling at least $15.5 million, to renovate the HUD headquarters cafeteria, lobby, and auditorium were not properly accounted for. In addition, $46 million in energy-saving improvements occurring in 2011 was not capitalized, including the $46 million liability incurred to finance the project. Overall, HUD’s controls over (1) accounting for internal use and commercial-off-the -shelf software licenses; (2) accounting for small and large acquisitions of furniture and equipment; (3) safeguarding property and equipment against waste, loss, unauthorized use, or misappropriation; and (4) accounting for leasehold improvements were not effective. Communication and information sharing among OCFO, OCIO, the Office of Administration, and administrative and contracting officers throughout HUD were weak and in some cases, nonexistent. Additionally, HUD had been unable to produce a complete and accurate property inventory for a number of years due to system issues and resource constraints, which we reported on in our prior-year audit.32 HUD planned to use the Facilities Acquisition Management Enterprise System (FAMES) going forward; however, it was not functional for fiscal year 2016. The effort to interface FAMES with HUD’s procurement system (PRISMTM) has been hampered by the inability to obtain technical information related to data locations, formats, and interfacing protocols. While the FAMES development team continues to pursue development of these interfaces, ARC already maintains a project cost module that is directly interfaced with Oracle Federal Financials, HUD’s general ledger, which HUD is not using as part of the shared services provided by ARC. As a result, the $297 million property, plant, and equipment balance reported on HUD’s consolidated balance sheet could not be relied upon. Additionally, the Office of Administration lacked effective controls over property for which it is accountable and may be unable to accurately report government assets that have been lost, stolen, or damaged as required by Government Performance and Results Act and General Services Administration regulations. Conclusion HUD did not account for all of its assets and liabilities in accordance with GAAP or have adequate internal controls over them. CPD did not have a validation process in place for the estimates of its accrued grant liabilities. As a result, we were unable to obtain sufficient, appropriate audit evidence for CPD’s fiscal years 2016 and 2015 accrued grant liabilities. Therefore, we could not form an opinion on CPD’s accrued grant liabilities for fiscal years 2016 and 2015. OCFO did not have a function in place to facilitate communication with the program offices and enable it to evaluate financial events or financial systems that impact financial 32 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015 17 reporting. Therefore, HUD did not account for prepayments, receivables, and payables in its PIH programs in accordance with GAAP. Specifically, (1) HUD’s PIH prepayments and accounts receivable contained errors with an absolute value of approximately $513.9 million and $201.2 million, respectively; (2) HUD’s expenses on its statement of net costs contained errors with an absolute value of$330.9 million; 33 and (3) HUD’s accounts payable were understated by an unknown amount. Balances related to the EHLP could not be audited due to data integrity issues, and balances in accounts related to HUD’s loan guarantee programs had discrepancies and were not reliable. Finally, HUD’s $297 million balance for property, plant, and equipment was not supported and could not be audited. Recommendations Several prior-year recommendations regarding the CPD accrued grant liabilities; Housing Choice Voucher program; IHBG; and property, plant, and equipment portions of this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have the following new recommendations. We recommend that the Deputy Chief Financial Officer 2A. Continue working with ARC and complete the reconciliation and cleanup efforts for balances related to HUD’s loan guarantee programs. 2B. Ensure that approved funds control plans and procedures to properly record loan guarantees are in place at the program offices. 2C. Work with the Office of the Chief Administration Officer to establish control activities (that is, procedures) to completely and accurately record internal use software, leasehold improvement, and property acquisition transactions and enable compliant financial reporting. 2D. Evaluate whether using existing Oracle accounting modules and ARC business processes to account for fixed assets and internal use software will be more cost effective and beneficial for HUD operations. We recommend that the Chief Information Officer 2E. Work with the OCFO to establish controls that ensure the timely communication of internal use and commercial-off-the-shelf software license acquisition activity and data. We recommend that the Chief Administrative Officer 2F. Work with OCFO to develop control activities that address risks related leasehold improvement and property acquisition data completeness and accuracy. 33 $330.9 million = $260.1 million for IHBG advances that were expensed and $70.8 million due to errors in the MTW PIH prepayment calculation. 18 Finding 3: Significant Reconciliations Were Not Completed in a Timely Manner Material differences between subsidiary ledgers and the general ledger were not resolved, and sufficient evidence to support financial statement line items was not maintained. Further, OCFO did not complete required cash reconciliations or intragovernmental reconciliations in a timely manner. In fiscal year 2016, HUD began using an FSSP for financial reporting but failed to define (1) roles and responsibilities between HUD and the FSSP and (2) policies and procedures for completing key reconciliations of material financial statement line items. HUD’s policies and procedures were not effective. The lack of these internal controls increased the risk of a material misstatement occurring in the financial statements and the potential of material misstatements being undetected by management. HUD’s Subsidiary Ledgers Were Not Reconciled to the General Ledger As of September 30, 2016, HUD was unable to reconcile material differences between subsidiary ledgers and the general ledger or provide sufficient evidence to support material financial statement line items. The differences were originally identified in March 2016; however, research on the material differences did not begin until July 11, 2016. HUD was researching $29.38 billion in subsidiary ledger to general ledger differences that could not be supported. The $29.38 billion in differences included $27.21 billion in differences in unliquidated obligations that were included in HUD’s program accounting system but not in the general ledger. The remaining $2.17 billion primarily represents differences in unliquidated obligation balances, accounts receivable, advances, liability for nonentity assets, loan guarantee liability, and account receivable allowance for loss. Refer to table 1 below. 19 Table 1 Reconciling differences (as of September 30, 2016) Current Description difference total Unliquidated obligations (0164) $27,208,789,932 Unliquidated obligations (all other funds) 663,963,583 Advances 626,037,159 Loan guarantee liability 294,925,122 Liability for nonentity assets not reported on statement of custodial activity 245,695,701 Account receivable allowance 98,458,414 Accounts receivable 67,122,492 Other 34 170,741,372 Total 29,375,733,775 HUD did not have effective controls implemented to ensure that source documentation was adequately maintained to support subsidiary ledger application or end user computing application balances in accordance with Principle 10 of the U.S. Government Accountability Office’s (GAO) Green Book. 35 Additionally, HUD did not have effective controls in place to prevent or detect differences between subsidiary ledgers-end user application balances and the general ledger. HUD’s previous information technology (IT) environment was insufficient and resulted in manual processes to develop subsidiary ledgers. However, the high risks associated with manual processes has contributed to the unsupportable balances because manually prepared subsidiary ledgers are not always easily located or readily available for review. This is one of the challenges HUD is experiencing in its efforts to reconcile general ledger balances to subledger information. In July of 2016, HUD initiated an effort to resolve differences between the subsidiary records and general ledger. OCFO established a subledger project workgroup to resolve the differences with a completion date of September 30, 2016. Although the workgroup was conducting analysis to identify the cause of the reconciling differences and impact on the financial statements, the $29.38 billion balance was not resolved by fiscal yearend. 34 Other includes 14 general ledger accounts contributing to the total differences between the subledger and the general ledger. We concluded that the individual differences were immaterial to the financial statements; however, the total amount should be included in the total difference. The accounts include (1) loan interest receivable, (2) fixed assets, (3) accounts payable, (4) deferred credit fees, (5) advances from others, (6) disbursements in transit, (7) interest payable, (8) accrued funded payroll, (9) liability for deposit accounts, (10) unfilled customer orders, (11) foreclosed property, (12) foreclosed property allowance, (13) other debt, and (14) liability for clearing account. 35 Principle 10: Design Control Activities requires that internal control be clearly documented and financial records be properly managed and maintained. Specifically, 10.03: Design of Appropriate Types of Control Activities requires that transactions be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions, which is applicable to the entire process or life cycle of a transaction. Additionally, management should design control activities so that all transactions are completely and accurately recorded. Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. 20 Reconciliations of Significant Account Balances Were Delayed for Part of the Year OCFO’s Accounting Monitoring and Analysis Division did not perform required cash reconciliations in a timely manner or have a reconciliation process that included verifying HUD’s monthly reports to Treasury. Additionally, HUD did not perform intragovernmental transaction (IGT) reconciliations for fiduciary and nonfiduciary transactions for part of the fiscal year. In our prior-year audit, we reported on these internal control deficiencies related to the performance of reconciliations for cash and IGT fiduciary and nonfiduciary transactions. We recommended that OCFO (1) distribute the workload among available accounts to ensure that all cash reconciliations are performed in timely manner and (2) ensure that there is proper oversight for ensuring that IGT differences are promptly researched and resolved. In fiscal year 2016, we determined that these recommendations had not been addressed by OCFO and the deficiencies remained. Cash reconciliations were not performed for all reporting periods. During our review of cash reconciliation status reports for the first 6 months of fiscal year 2016, we found that cash reconciliations were performed more than 60 days after the end of the applicable month. The number of appropriations impacted varied from 19 to 60 per month. Additionally, reconciliations for 15 of the appropriations were consistently not performed for a 5-month period from October 2015 to February 2016. This condition resulted from management’s not ensuring that roles and responsibilities for performing cash reconciliations were communicated and understood after the transition to an FSSP at the beginning of the fiscal year. There were no implemented policies and procedures that explained and defined the roles and responsibilities or processes for reconciling HUD’s fund balance with Treasury. Additionally, management did not ensure that all staff accountants had the proper system access before the transition to the reports necessary for completing the cash reconciliations to be run. As of March 31, 3016, the financial impact of the 15 appropriations for which reconciliations were not performed had a fund balance with Treasury totaling $37.8 billion, of which $36.7 billion resided in four funds. Additionally, fund 86X0162 had a $3.1 billion unreconciled difference that occurred in October, which was not resolved until after the first quarter of the fiscal year. Refer to table 2 for additional details for cash reconciliations not performed in the first 5 months of 2016. Unresolved differences compromise the reliability of the fund balance with Treasury balances and Treasury’s published financial reports. 21 Table 2 Fund balance with Treasury balances for 15 appropriations (cash reconciliations were not performed within 60 days for the first 5 months) Fund balance with Appropriation Treasury as of Fund count March 31, 2016 0162 $21,579,230,505.51 10 0192 6,420,688,522.84 9 0205 3,862,079,151.83 9 0304 4,871,702,292.92 10 Material fund subtotal 36,733,700,473.10 38 0176 170,004,273.28 9 0193 10,867,895.58 1 0203 4,726,294.30 1 0218 145,798,017.73 3 0235 28,707,777.60 2 0305 5,927,336.01 1 0344 256,845,918.64 1 0349 467,033,781.95 5 3875 11,755,333.46 2 3885 -1,092,433.47 1 4015 9,912,963.60 1 Total 37,844,187,631.78 65 Intragovernmental balances reconciliations were not performed for part of the year. HUD did not perform required intragovernmental transaction reconciliations, including HUD’s fiduciary investments and borrowings with Treasury’s Bureau of Fiscal Service and nonfiduciary reconciliations for transfers of budget authority and transfers of assets among Federal agencies, including Treasury’s General Fund, for the first quarter 2016. Since the fiduciary reconciliations were not performed, there were unsupported differences for (1) $10.7 million for investments, (2) $53.6 million for borrowings with Treasury, and (3) $41.4 million for buy-sell transactions among Federal agencies, such as HUD’s trading partners. These differences were reported in HUD’s scorecard for the first quarter 2016 and were included in the total difference amount of $434.80 million. Refer to table 3 for the dollar value differences by the IGT subcategories included in the scorecard. 22 Table 3 HUD IGT scorecard differences General fund Quarter 1, 2016 Nonentity $208.9 million Other general fund RCs 36 0.1 million IGT Quarter 1, 2016 Investments 10.7 million Borrowings 53.6 million Benefits: Office of Personnel Management 9.4 million Buy-sell 41.4 million Transfers 110.7 million Grand total 434.80 million Further, the Accounting Monitoring and Analysis Division did not provide the appropriate review and formulate corrective action plans for differences identified among trading partners. As a result, HUD could not provide evidence of research and resolution efforts for reconciling IGT differences reported on the agency’s quarterly consolidated IGT scorecard issued by Treasury. 37 This condition occurred due to undefined responsibilities between OCFO’s Accounting Monitoring and Analysis Division and the FSSP at the start of the fiscal year after the transition to the FSSP. Additionally, OCFO’s IGT reconciliation procedures were not updated to reflect the roles and responsibilities of the FSSP for assisting the Accounting Monitoring and Analysis Division with reconciling differences reported on HUD’s scorecard.38 Conclusion HUD had significant unreconciled differences between subsidiary ledger records and the general ledger totaling $29.38 billion. There was a lack of effective controls to ensure that source documentation properly supported general ledger balances. The inability to detect and correct financial statement errors in a timely manner impeded the ability of stakeholders to evaluate program performance and program personnel to effectively manage budgets, which increased the risk to the reliability of HUD’s financial statements. 36 As defined within Treasury Financial Manual, volume I, part 2, chapter 4700, reciprocal category (RC) is a set of reclassified financial statement Federal line items or a grouping of USSGLs. The set is used to perform eliminations at the governmentwide level. 37 Fiscal Service has established a set of performance metrics and scorecards to help identify and resolve root causes of IGT differences. The scorecards are at a governmentwide and agency-specific level and are sent to significant entities within 90 calendar days after the end of a quarter. The scorecard will focus on differences by trading partner, IGT subcategory, USSGL account, and reciprocal category. Fiscal Service will monitor the quarterly scorecards to assess how well agency corrective actions resolve problematic areas. 38 HUD’s scorecard includes FHA, Ginnie Mae, and HUD amounts combined. 23 Additionally, HUD’s reconciliations were not completed in a timely manner for its fund balance with Treasury and the intragovernmental transactions of fiduciary and nonfiduciary balances. OCFO’s inability to implement policies and procedures that explained the roles and responsibilities or processes for reconciling these significant account balances led to unresolved differences for part of fiscal year 2016. The weak internal control activities provided the potential for misstatement of the closing balances with Treasury, inaccurate financial activity reported to Treasury, and material differences going undetected. HUD’s failure to implement timely and effective reconciliation processes for significant line items increased the risks of fraud, waste, and mismanagement of funds; affected the Government’s ability to effectively monitor budget execution; and affected the ability to accurately measure the full cost of the Government’s programs. Recommendations Prior-year recommendations regarding the IGT reconciliations from this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have four new recommendations in this report. We recommend that the Deputy Chief Financial Officer 3A. Develop and implement standard operating procedures, including descriptions of roles and responsibilities, for fund balance with Treasury reconciliations. 3B. Continue the subledger reconciliation project and complete it in a timely manner, communicate results to top key stakeholders, and complete necessary adjustments or restatements (if applicable). 3C. Perform a root cause analysis to identify potential control gaps and ineffective controls in the review of subledger balances to the general ledger. 3D. Communicate the impact of system limitations that contributed to unreconciled balances to relevant management and design and implement effective controls that address relevant risks. 24 Finding 4: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements HUD CPD’s formula grant program accounting continued to depart from GAAP because of its use of the first in, first out (FIFO) method 39 for committing and disbursing obligations. Since 2013, we have reported that the information system used, the Integrated Disbursement Information System (IDIS) Online, a grants management system, was not designed to comply with Federal financial management system requirements. Further, HUD’s plan to eliminate FIFO from IDIS Online was applied only to fiscal year 2015 and future grants and not to fiscal years 2014 and earlier. As a result, budget year grant obligation balances continued to be misstated, and disbursements made using an incorrect USSGL attribute resulted in additional misstatements. Although FIFO has been removed from fiscal year 2015 and forward grants, modifications to IDIS are necessary for the system to comply with FFMIA and USSGL transaction records. The inability of IDIS Online to provide an audit trail of all financial events affected by the FIFO method prevented the financial effects of FIFO on HUD’s consolidated financial statements from being quantified. Further, because of the amount and pervasiveness of the funds susceptible to the FIFO method and the noncompliant internal control structure in IDIS Online, the combined statement of budgetary resources and the consolidated balance sheet were materially misstated. The effects of not removing the FIFO method retroactively will continue to have implications on future years’ financial statement audit opinions until the impact is assessed to be immaterial. IDIS Online’s Accounting for Transactions Departed From GAAP and Accounting Standards CPD’s inadequate budget controls and disregard for USSGL attributes at the transaction level when making commitments and disbursements for CPD’s formula grants as well as CPD’s use of the FIFO method resulted in • A departure from Federal financial accounting standards and GAAP, • Noncompliance with budgetary internal control requirements, and • Noncompliance with the overall conceptual framework established by the Federal financial management laws and guidance issued by the standard setters. 39 The FASAB Handbook defines FIFO as a cost flow assumption. The first goods purchased or produced are assumed to be the first goods sold (FASAB Handbook, Version 13, appendix E, page 30, dated June 2014). In addition, the Financial Audit Manual states that the use of “first-in, first-out” or other arbitrary means to liquidate obligations based on outlays is not generally acceptable (GAO-PCIE (U.S. General Accountability Office- President’s Council on Integrity and Efficiency) Financial Audit Manual, Internal Control Phase, Budget Control Objectives, page 395, F-3). In the context of HUD’s use of this method, the first funds appropriated and allocated to the grantee are the first funds committed and disbursed, regardless of the source year in which grant funds were committed for the activity. 25 During fiscal years 2016 and 2015, $2.7 billion and $4.4 billion, respectively, in disbursements were susceptible to this FIFO method and were reported in HUD’s consolidated financial statements. Also during this time, $2.4 billion and $6.3 billion, respectively, in undisbursed obligations were impacted. These material amounts, which impact the combined statement of budgetary resources and consolidated balance sheet, were not presented in conformity with GAAP. Progress Was Made in Correcting Future Accounting; However, Material Misstatements Will Continue for Several Years Due to Inaction on Fiscal Year 2014 and Older Grants Steps to eliminate the FIFO logic from IDIS Online were stopped in the spring of 2015 because of budget shortfalls. By late fiscal year 2015, HUD had obtained additional funds, and in fiscal year 2016, HUD eliminated the FIFO logic for fiscal year 2015 and later grant years. HUD planned to complete all scheduled upgrades for IDIS Online by May 2017. Although FIFO was removed from fiscal year 2015 and forward grants, additional modifications to IDIS are necessary for the system to comply with FFMIA and the USSGL at the transaction level. Among the remaining work, CPD must ensure that IDIS ties disbursements to specific commitments. In addition, CPD must ensure that IDIS logs the additional information needed to meet internal control requirements and that the system properly handles the return and collection of grant funds. While CPD had taken steps to eliminate the FIFO method for commitments and disbursements on fiscal year 2015 and forward grants, these steps will not be sufficient to eliminate this deficiency as a material weakness and clear the basis for disclaimer reported in the independent auditor’s report for fiscal year 2016 and future independent auditor’s reports. Specifically, since the plan did not address fiscal year 2014 and prior grants, there will continue to be a material amount of funding susceptible to the FIFO logic for several more years. The effects of not removing the FIFO logic retroactively will have implications for future years’ financial statement audit opinions until the impact is assessed to be immaterial. We will continue to work with CPD and OCFO to monitor the progress of HUD’s FIFO elimination plan. During the next fiscal year, we will also continue to ensure that IDIS uses a non-FIFO method to commit and disburse CPD formula grant funds for 2015 grants and forward and that there is an appropriate audit trail available for review. Conclusion We continue to report that the use of the FIFO method (1) departed from Federal accounting standards and (2) was noncompliant with budgetary internal control requirements and the overall conceptual framework established by the Federal financial management laws and guidance issued by the standard setters. Specifically, the use of FIFO by the information system, IDIS Online, made it noncompliant with Federal financial management system requirements because of inadequate budget controls and the misuse of USSGL attributes at the transaction level for CPD’s formula grant disbursements. While steps were underway to remove the FIFO method, these changes applied to fiscal year 2015 and future grants will not be applied retroactively. Additional work is needed to match disbursements to commitments and to make IDIS Online compliant with the USSGL and FFMIA. The effects of not removing the FIFO method 26 retroactively will continue to have implications for future years’ financial statement audit opinions until the impact is assessed to be immaterial. During fiscal year 2016, $2.7 billion in disbursements and $2.4 billion in obligations were susceptible to this FIFO method, which is not in accordance with GAAP. Due to this material amount, the combined statement of budgetary resources and the consolidated balance sheet were not prevented from containing material misstatements. Recommendations Prior-year recommendations regarding this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have no new recommendations in this report. 27 Finding 5: HUD’s Financial Management System Weaknesses Continued in 2016 HUD’s financial system weaknesses remained a material weakness in fiscal year 2016 due to the combined impact of many deficiencies and limitations. While HUD took steps to modernize its financial management system through the transition of key financial management functions to an FSSP in 2016, it encountered significant challenges after implementation that had not been resolved as of September 30, 2016. HUD’s inability to modernize its legacy financial systems and the lack of an integrated financial management system resulted in a continued reliance on different, legacy financial systems with various limitations. Program offices compensated for system limitations by using less reliable manual processes to meet financial management needs. These system issues and limitations inhibited HUD’s ability to produce reliable, useful, and timely financial information. HUD Encountered Significant Challenges With Its Transition to a Shared Service Provider for Financial Management Services HUD experienced significant data quality challenges following the transition of key financial management functions to an FSSP with release 3 of the New Core Project on October 1, 2015. 40 Specifically, HUD had unresolved data conversion errors and inaccurate funds management reports and lacked a fully functional data reconciliation process. In addition, HUD’s NCIS performance was not adequately monitored, tracked, or measured, and controls over processing errors within Oracle Federal Financials were routinely bypassed. Data conversion errors complicated the analysis and monitoring of balances for funds control purposes and increased the risk of invalid spending transactions and inaccurate financial reporting. Additionally, the dilution and deferral of key requirements and system testing enabled significant data quality issues to go unnoticed and unaddressed until after the implementation of New Core, release 3. HUD officials did not adequately meet the significant business-user requirement that system-generated listings of program obligations and expenditures be reconciled to trial balance- general ledger data in a timely manner. As a result, key data extracts were provided in an unusable manner, and key audit procedures were delayed while both HUD and OIG personnel worked to resolve data quality issues. Despite the presence of impactful issues, HUD did not resolve issues, improve data, or report quality weaknesses before the go-live date and did not move the implementation date in response to unresolved issues with a potentially adverse impact on the production environment. 41 40 New Core was HUD’s financial system modernization program, initiated in 2013, that involved migrating financial management capabilities to an FSSP, with expected benefits including reduced legacy system costs, improved data, and remediated audit deficiencies. 41 Audit Report 2016-DP-0004, HUD Rushed Implementation of Phase 1, Release 3, of the New Core Project, issued September 20, 2016 28 HUD’s efforts to modernize its financial management systems continued to be hindered by weaknesses in implementing key IT management practices. 42 On November 4, 2015, HUD’s Deputy Secretary stated that HUD would not develop additional capabilities as part of the New Core program. As a result, HUD will continue executing program transactions with expensive and inefficient legacy financial systems that were to be replaced during the New Core Project. Additionally, the FSSP increased the cost of HUD’s financial accounting process and operations. HUD’s Financial Systems Lacked Key Functionality Several of HUD’s financial systems used to support significant balances on the financial statements lacked key functionality. This deficiency prevented HUD from relying on the data output provided and reporting key financial statement balances in accordance with GAAP. Ginnie Mae did not have systems in place to adequately record and account for the loan accounting and processing of activity in its defaulted issuers’ portfolio. Ginnie Mae remained unable to support key financial statement line items related to its nonpooled loans portfolio acquired from defaulted issuers. Ginnie Mae’s challenges come from its lack of a financial system (or systems) capable of recording loan-level transaction details in compliance with GAAP accounting requirements. Material weaknesses related to Ginnie Mae’s nonpooled loans portfolio, approximately $4.2 billion and $5.4 billion, as of September 30, 2016, and September 30, 2015, remained unresolved as of September 30, 2016. Ginnie Mae did not have an accounting system to account for and track servicing costs at a loan level. As a result, it was reliant on third-party master subservicer data, which we found unreliable because of completeness and accuracy weaknesses. We concluded that Ginnie Mae failed to adequately establish and maintain accounting systems to manage and control the loan accounting and processing of the activities related to its defaulted issuers’ portfolios. Refer to the relevant material weaknesses and associated recommendations for additional details.43 System configuration issues within the budgetary accounting module of the GFAS application prevented Ginnie Mae from automating its contract obligation process. In fiscal year 2015, we reported that system configuration and posting logic deficiencies in the GFAS budgetary module resulted in inaccurate budgetary account balances. In fiscal year 2016, Ginnie Mae corrected a number of these issues; however, the system still could not accurately account for contract obligations. Consequently, Ginnie Mae manually calculated key USSGL account balances and made adjustments to its third quarter statement of budgetary resources totaling $222 million. In fiscal year 2015, this manual calculation and adjustment process resulted in a $46.2 million error. This manual process was inefficient and noncompliant with FFMIA requirements related to the application of the USSGL at the transaction level. Additionally, we noted issues regarding the segregation of duties within GFAS. Specifically, accounting personnel had inappropriate access to multiple roles that should be separated to maintain effective internal control. 42 GAO, GAO-16-656, July 2016, Financial Management Systems: HUD Needs to Address Management and Governance Issues That Jeopardize its Modernization Efforts; http://www.gao.gov/assets/680/678727.pdf 43 Audit Report 2016-FO-0001, Audit of the Government National Mortgage Association’s Financial Statements for Fiscal Years 2015 and 2014, issued November 13, 2015 29 Ginnie Mae’s budgetary accounting module was implemented with incomplete system requirements and inadequate user acceptance testing. In addition, the completeness and accuracy of data migration were insufficiently validated before deployment into the production environment, and while Ginnie Mae and its contractors had worked to identify and resolve these system issues, correcting the issues was time consuming and difficult. Despite spending a great deal of resources, 2 years after implementation, these issues had not been resolved. Updates to IDIS remained in process and continued to hinder CPD’s ability to properly account for formula grant transactions in accordance with GAAP and comply with FFMIA. CPD uses IDIS to manage its formula grant programs. While CPD had made progress in addressing the noncompliant application of FIFO to grants initiated during 2015 and going forward, funding constraints delayed further remediation and compliance with accounting standards and FFMIA. See further discussion of this issue in the related material weakness.44 Emergency Homeowner’s Loan Program data in HUD’s Loan Accounting System were not reliable. In prior years, 45 we reported that EHLP data in LAS was not reliable because of system and process internal control weaknesses. Specifically, EHLP loan data initially entered into LAS were inaccurate and incomplete, the data correction process was ineffective, and loan-level transaction details in LAS were lost during a database rebuild effort. For fiscal year 2016, the EHLP data in LAS remained unreliable and did not support the loans receivable balances in the general ledger. HUD did not have a working property inventory system in place. HUD did not have a property management system in place to record transactional details during fiscal year 2016. HUD decommissioned its legacy property management system in fiscal year 2016 after being unable to remediate technical issues caused by a lapsed maintenance contract that had impeded system functionality since 2012. The Office of Administration was working with OCIO to populate its new automated property management application hosted by the Federal Aviation Administration. Legacy procurement applications that did not comply with financial system requirements could not be decommissioned due to longstanding data migration challenges. As of September 30, 2016, HUD reported that three Office of the Chief Procurement Officer (OCPO) procurement systems, the HUD Procurement System (HPS), Small Purchase System (SPS), and HUD Integrated Acquisition Management System (HIAMS), were not substantially compliant with FFMIA. These systems have been replaced, and OCPO needs to perform procurement closeout actions in HPS and HIAMS and validate SPS data before decommissioning. HUD hoped to complete decommissioning for these three systems during fiscal year 2017. 44 Finding 4: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the Financial Statements 45 Audit Report 2015-DP-0004, Loan Accounting System, issued December 9, 2014 30 HUD Did Not Have Financial Systems in Place To Meet Financial Management Needs In addition to weaknesses and limitations associated with HUD’s financial systems, HUD did not have systems in place to meet other financial management needs. HUD lacked an effective cost accounting system. In fiscal year 2006, GAO reported 46 that HUD’s financial systems did not have the functionality to provide managerial cost accounting across its programs and activities. HUD lacked an effective cost accounting system that was capable of tracking and reporting the costs of its programs in a timely manner to assist in managing its daily operations. This lack of functionality resulted in the lack of reliable and comprehensive managerial cost information on HUD’s activities and outputs. This deficiency made HUD unable to produce reliable, cost-based performance information. Despite being within the scope of the New Core program, there were no plans to implement this core financial system capability as of fiscal year 2016. PIH’s manual cash management processes did not allow recognition of financial transactions or timely adjustments to PHA disbursements. PIH’s cash management process was not automated. Under the cash management process, PIH manually determines the amount PHAs are holding (PIH prepayment on HUD’s balance sheet) and the amount that it should offset to follow cash management requirements. This process is conducted through the use of complex, unprotected Excel spreadsheets that include extracted data as of a point in time from multiple systems and tracking logs for more than 2,200 PHAs. PIH lacked a system to track these amounts in real time as the disbursements and expenses occurred, resulting in (1) increased risk of error, (2) untimely recognition of accounting events in HUD’s general ledger and financial statements, 47 and (3) delayed transition of excess funds from PHAs to HUD to comply with Treasury and OMB cash management requirements.48 HUD’s lack of a system to account for the Section 108 and 184 loan guarantee programs contributed to its inability to support related general ledger balances. While HUD had moved certain recording of Section 108 and 184 loan guarantee programs into Oracle, daily loan guarantee activity was still recorded through manual journal vouchers. A historical lack of compliant loan guarantee systems over the years contributed to HUD’s inability to support key general ledger balances with subledger data or supporting documentation. Because of this deficiency, there were discrepancies in HUD’s accounts for loan guarantee liabilities, foreclosed-on property, unpaid obligations, and the memorandum accounts used to track the status of its loan guarantee authority. Without a financial system to record detailed program transactions, HUD could not adequately monitor its loan guarantee programs. Conclusion Complete and reliable financial information is critical to HUD’s ability to accurately report on the results of its operations to both internal and external stakeholders. During fiscal year 2016, 46 GAO-06-1002R, Managerial Cost Accounting Practices, dated September 21, 2006 47 Finding 2 - HUD’s Assets and Liabilities Were Misstated and Not Adequately Supported 48 Finding 12 - HUD Did Not Comply With Treasury Financial Manual Rules on Cash Management or 2 CFR Part 200 31 system limitations and weaknesses continued to contribute to the possibility that a material misstatement of HUD’s financial statements would not be prevented or detected and corrected in a timely manner. Until these weaknesses are fully remedied, HUD’s ability to produce reliable, useful, and timely financial information needed for accountability, performance reporting, and decision making will remain a departmental material weakness. Therefore, we will continue to monitor HUD’s progress in addressing our concerns in this area. Recommendations Prior-year recommendations regarding this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have the following new recommendations. We recommend that the Office of the Chief Financial Officer 5A. Establish standard operating procedures to capture the process involved with the transfer of accounting data to Oracle from HUDCAPS through NCIS. Procedures should include measures to ensure that information is processed completely, accurately, and in a consistent and reperformable manner to allow for timely review. 5B. Adequately document key internal control processes and control activities in place for the HUDCAPS, NCIS, and Oracle interface, including but not limited to Oracle posting models, and ensure that they are readily available for review. 32 Significant Deficiencies Finding 6: HUD’s Financial Management Governance Was Ineffective HUD’s financial management governance remained ineffective during 2016. HUD’s transition to an FSSP for financial management services was punctuated by operational issues that were exacerbated by a lack of mature financial management governance practices. Additionally, as we have reported in prior-year audits, HUD did not have reliable financial information for reporting and continued the use of its outdated legacy financial systems. Weaknesses in program and component internal control that impacted financial reporting were able to develop in part due to a lack of financial management governance processes. As a result, there were many deficiencies in HUD’s internal controls over financial reporting, resulting in misstatements on the financial statements and noncompliance with laws and regulations. Recommendations From an Independent Organizational Assessment of HUD OCFO To Improve HUD’s Financial Management Governance Remained Unimplemented While we have been reporting on HUD’s financial management governance weaknesses since fiscal year 2013, during fiscal year 2015, HUD took steps to address weaknesses in its financial management governance by contracting with the National Academy of Public Administration (NAPA) for an organizational assessment of financial management at HUD. The assessment was designed to identify risks associated with the transition of its accounting functions to a shared service provider and, in part, to address concerns previously identified by OIG. NAPA made three high-level recommendations, concluding that HUD should 1. Improve financial management oversight and governance, 2. Address concerns associated with the transition to the FSSP, and 3. Strengthen the finance workforce. 49 During the 2015 financial statement audit, OIG followed up with HUD management to determine HUD’s progress in addressing the NAPA study recommendations and noted weaknesses in HUD’s process for tracking recommendations from separate evaluations, such as those performed by NAPA, and the associated management actions. HUD’s lack of evaluation and corrective action plans in response to the NAPA recommendations contributed to this weakness.50 The NAPA study also supported the longstanding OIG recommendation that HUD establish a Chief Financial Officer (CFO) Council to enhance its financial governance structure. While HUD had historically resisted recommendations to create a senior management council, updated 49 Department of Housing and Urban Development, Office of Chief Financial Officer, Organizational Assessment, March 19, 2015. http://napawash.org/images/reports/2015/HUD_OCFO_Study_Final_Report.pdf 50 Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014 Consolidated Financial Statements Audit, November 23, 2016 33 OMB Circular No. A-123 recently changed the establishment of a senior management council from a best practice to a requirement. While HUD stated that it was finalizing plans for an entitywide oversight group, such a group was not in place during fiscal year 2016. However, this is an important step toward addressing HUD’s significant financial management governance weaknesses. The Lack of a Policy and Procedure Framework Hindered HUD’s Transition to a Federal Shared Services Provider for Financial Management Services As noted above, the NAPA study team also recommended that HUD take action to address concerns related to HUD’s impending transition to an FSSP for financial management services. HUD’s transition to an FSSP was hindered by governance weaknesses, including outdated or incomplete accounting, financial management, and internal control policies and procedures. We noted a pervasive lack of governance documentation during this year’s audit that worsened issues related to HUD’s transition to an FSSP. GAO’s recent work also cited governance weaknesses in HUD’s financial management that we have reported on for a number of years. 51 GAO identified a lack of documented policies to ensure the quality and consistency of program evaluations, echoing OIG’s concerns regarding the inconsistent performance and lack of or untimely completion of management reviews and risk assessments, which remained unaddressed as discussed later in this finding. 52 Additionally, GAO reported on HUD’s financial systems modernization efforts and concluded that HUD’s management and governance weaknesses must be addressed to enable HUD to effectively modernize its financial systems. 53 Information and Communication Were Inadequate We have also attributed the cause of HUD significant deficiencies and material weaknesses to a lack of adequate information and communication among key groups. Specifically, program office accounting policies and procedures were, at times, developed without adequate OCFO input due to broad delegations to program office personnel. HUD has delegated key financial management functions, including the review and approval of vouchers, reviews of unliquidated obligations, and various budgetary accounting functions. However, we have found that program office decisions made without adequate subject-matter expert input can overlook key considerations, including compliance with accounting regulations or best practices. We have attributed the root cause of significant deficiencies and material weaknesses identified in our audits to inadequate consideration of key accounting and financial rules and regulations. For example, we have noted that weak collaboration between OCFO and HUD components and 51 Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014 Consolidated Financial Statements Audit, November 23, 2016 52 GAO-16-497, Actions Needed to Incorporate Key Practices into Management Functions and Program Oversight, http://www.gao.gov/assets/680/678551.pdf 53 GAO-16-656, HUD Needs to Address Management and Governance Weaknesses That Jeopardize Its Modernization Efforts, http://www.gao.gov/assets/680/678727.pdf 34 program offices have contributed to material weaknesses and significant deficiencies cited in our financial statement audit reports. 54 CPD’s budgetary accounting for grants. The material weakness associated with CPD’s budgetary accounting for grants, 55 which contributed to our 2013 qualified opinion and our 2014 and 2015 disclaimer of opinion, occurred within the environment of substantial delegation and deferral to program office priorities. This deficiency occurred because OCFO was not involved in the development of the mixed financial system (IDIS Online) to ensure that it complied with FFMIA and GAAP. This deficiency will exist for several years because the programing changes made to IDIS Online will be on a prospective basis for fiscal years 2015 going forward and not apply to prior-year grant funds. As of September 30, 2016 and 2015, approximately $2.4 billion and $6.3 billion, respectively, in undisbursed obligations had been impacted. PIH cash management. As we first reported during the 2013 financial statement audit, 56 OCFO was not consulted when PIH implemented its cash management process in fiscal year 2012. Further, as PIH’s cash management process has evolved, HUD’s OCFO has not taken an active role in accounting for it. Specifically, HUD’s OCFO did not review PIH’s estimation process to value the MTW PHA portion of the PIH prepayment or record receivables determined through the PIH cash management process. As a result, $201.2 million in receivables was not recognized on the financial statements, $41 million in repayment agreements was not recorded for most of the year, and the PIH prepayment was understated by $33.1 million. While an automated system would assist both OCFO and PIH in properly monitoring and accounting for this process, the manual process could be improved through stronger governance. We previously recommended that PIH implement a system to automate the process. However, as of the date of this report, HUD had not provided an adequate management decision on how it planned to address this recommendation. This recommendation was referred to the Deputy Secretary for a decision on March 31, 2015. As of fiscal yearend, the Deputy Secretary had not provided a decision on the referral. Indian Housing Block Grant Investments. HUD did not properly account for approximately $260.1 million 57 in advanced payments to its IHBG grantees for investment because OCFO was unaware that payments were being advanced to IHBG grantees. This condition occurred because OCFO did not regularly communicate with program offices to identify and evaluate the impact on financial reporting of program events through the use of a senior assessment council or comparable team. After we identified this issue during the fiscal year 2015 financial statement audit, OCFO disagreed but was unable to provide a justification based on generally accepted accounting standards. In addition, program offices and OCFO reported that they did not have the systems to capture the information needed for reliable financial reporting. Although not having 54 Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014 Consolidated Financial Statements Audit, November 23, 2016 55 Refer to finding 4 for more detail. 56 Audit Report 2014-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and 2012 (Restated) Financial Statements, issued December 16, 2013 57 This estimate is based on our review of SF-425s as of December 31. 2015, and June 30, 2016. SF-425s for September 30, 2016, were not available in time for this report. 35 adequate systems may hinder HUD’s ability to record these prepayments, it does not exempt HUD from accurate financial reporting. Ginnie Mae’s Financial Governance Weaknesses Continued In fiscal year 2016, despite improvements, Ginnie Mae failed to maintain a governance framework that allowed appropriate policies, people, systems, and controls to ensure the reliability and integrity of Ginnie Mae’s financial and accounting information. This failure in governance was the underlying cause of the problems cited in the Ginnie Mae financial statement audit report. 58 Ginnie Mae failed to (1) adequately identify, analyze, and respond to changes in the control environment and risk associated with the acquisition of a multi-billion-dollar servicing portfolio; (2) adequately establish accounting policies, procedures, and accounting systems to manage and control the loan accounting and processing of the activities related to its defaulted issuers’ portfolio; and (3) adequately oversee the implementation of the budgetary accounting module in its financial system to ensure accurate reporting of budgetary activity. This condition occurred because of insufficient internal controls to manage the risks associated with business decisions and changes in its business environment. As a result, serious financial reporting deficiencies occurred at Ginnie Mae, which impacted HUD consolidated financial reporting. These governance weaknesses contributed to Ginnie Mae’s inability to produce auditable financial statements. To address these issues, oversight is needed from OCFO to ensure that the policies and guidance it provides are properly implemented. HUD Did Not Implement and Maintain Adequate Accounting and Financial Systems The CFO Act states that the responsibilities of an agency chief financial officer include developing and maintaining adequate accounting and financial systems and implementing agency asset management systems, including systems for cash management, debt collection, and property and inventory management and control. We continued to report a material weakness related to HUD’s financial management system and noncompliance with FFMIA as discussed in finding 5 and appendix C. To implement and maintain financial systems in accordance with CFO Act requirements, OCFO and other departmental organizations will need to collaborate effectively, address governance weaknesses, and remediate financial system issues. Management Control Reviews Were Not Performed During fiscal year 2016 HUD did not conduct any routine or timely management control reviews (MCR)59 for its program areas as required by HUD Handbook 1840.1. We reported in the prior fiscal year that although MCRs were conducted for two program areas, they were not performed routinely across all program areas as required by HUD guidance.60 We recommended that HUD revise its MCR policies and procedures to include clearer and more specific requirements, 58 Audit Report 2016-FO-0001, Audit of the Government National Mortgage Association’s Financial Statements for Fiscal Years 2015 and 2014, Restated, issued November 14, 2015 59 An MCR is a detailed evaluation of the complete system of management controls in a functional area. Such a review will produce extensive documentation of controls and will include the testing of most if not all controls. 60 Audit Report Number 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015, page 31 36 including accountability for nonperformance. 61 OCFO stated that this matter had been put on hold due to additional review by new management within the OCFO. Inconsistent performance of MCRs may prevent HUD from achieving its internal control monitoring goal of detecting conditions that may adversely affect the achievement of program objectives. This inconsistency decreased the potential for HUD to achieve the intended results of its programs and administrative functions by minimizing risks of fraud, waste, abuse, and mismanagement of funds. It also could decrease the reliability of HUD’s financial reporting and its ability to comply with applicable laws and regulations. For example, MCRs provide a basis for the HUD Secretary to report annually to the President and Congress, as required by the Federal Managers’ Financial Ingrity Act (FMFIA), on the adequacy of management controls within HUD. Insufficient performance and monitoring of this process for all of HUD’s program offices could prevent the Secretary from having an adequate basis when reporting on FMFIA. HUD Was Not Addressing Internal Control Deficiencies in a Timely Manner HUD was not addressing internal control deficiencies in a timely manner in accordance with internal control requirements and OMB Circular A-50, Audit Followup. The timely remediation of identified control deficiencies is a key element of the monitoring component outlined in GAO’s Green Book, Standards for Internal Control in the Federal Government. Specifically, we noted that as of September 30, 2016, 56 of 93, or 60 percent, of OIG recommendations from prior-year financial statement audit reports were past the agreed-upon dates for final action. Additionally, we noted that as of September 30, 2016, management had not established action plans for 17 additional recommendations, a significant increase from only two recommendations without action plans as of September 30, 2015. Additionally, as of June 2016, 58 percent (63 of 108) of GAO recommendations made to HUD in fiscal years 2012 through 2015 had not been fully implemented. To improve internal controls, HUD must address deficiencies in a timely manner. Financial Management Weaknesses Necessitated Frequent Restatements HUD’s financial management governance weaknesses resulted in many financial statement errors that required the frequent performance of restatements. For the third consecutive year, HUD will need to restate financial statements to correct errors. Errors in financial statements can result from mathematical mistakes, mistakes in the application of accounting principles, or oversight or misuse of facts that existed at the time the financial statements were prepared. Recent restatements included restatements of HUD’s 2014 financial statements to correct errors related to Ginnie Mae accounting and the 2013 financial statements to correct material misstatements related to accounting for PIH prepayments and CPD’s accrual of grantee expense liabilities. In the current year, HUD is performing a restatement to correct errors related to the improper closing of USSGL accounts that caused overstatements and understatements of 61 Audit Report Number 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015, recommendation 6J: Revise policies and procedures to ensure that MCRs are routinely monitored and completed for all program areas and establish a timeframe for completion of the MCR reports. Further, HUD should ensure that an escalation process is included to address untimely completion of the MCR process. 37 HUD’s apportioned and unapportioned balances. Frequent restatements to correct errors can undermine public trust and confidence. Additionally, the late notification of the restatements, at times, limited our ability to adequately review and validate the accuracy of accounting adjustments. Conclusion Deficiencies in HUD’s financial management governance continued during 2016. The challenges associated with the transition to ARC financial management services and Oracle Federal Financials were made worse by unaddressed weaknesses in HUD’s governance. Recommendations Prior-year recommendations remained unimplemented and can be found in the Followup on Prior Audits section of this report. We have the following new recommendation. We recommend that the Deputy Chief Financial Officer 6A. Establish a framework for financial policy development and review of policy and procedures that defines roles and responsibilities and provides reasonable assurance regarding the effectiveness of related controls. 38 Finding 7: Weaknesses in HUD’s Administrative Control of Funds System Continued We have reported on HUD’s administrative control of funds in our audit reports and management letters since fiscal year 2005. HUD continued to not have a fully implemented and complete administrative control of funds system that provided oversight of both obligations and disbursements. Our review noted instances in which (1) the Office of Multifamily Housing Programs did not follow HUD’s administrative control of funds; (2) funds control plans were out of date or did not reflect the controls and procedures in place with the transition to an FSSP; (3) program codes were not included in funds control plans and funds control documentation; and (4) OCFO staff processed accounting changes without proper review, approval, and sufficient supporting documentation. These conditions existed because of (1) decisions made by HUD OCFO, (2) failures by HUD’s allotment holders to update their funds control plans and notify OCFO of changes in their obligation process before implementation, (3) a lack of compliance reviews in the current year, and (4) a lack of policies and procedures requiring documentation of system accounting changes. As a result, HUD could not ensure that its obligations and disbursements were within authorized budget limits and complied with the Antideficiency Act (ADA). The Office of Multifamily Housing Programs Did Not Comply With the Administrative Control of Funds Policies and Procedures HUD’s Office of Multifamily Housing Programs did not ensure that it complied with OCFO’s administrative control of funds policies and procedures 62 in administering its Section 8 project- based rental assistance program. It (1) implemented substantial changes to the Section 8 project- based program obligation process in fiscal year 2011 without OCFO’s approval 63 and (2) could not provide the appropriate obligating documents as stated in its 2011 funds control plan to support that obligations and disbursements complied with legal authorization and contract requirements.64 This deficiency was reported in our prior-year audit report, 65 and the Office of Multifamily Housing Programs agreed to implement changes. During our fiscal year 2015 audit, the Office of Multifamily Housing Programs provided OCFO a funds control plan for its review. However, as part of HUD’s fiscal year 2016 Process Improvement for Funds Control Plans approach, OCFO was no longer reviewing changes to the 62 HUD’s policies require OCFO to review and approve funds control plans to ensure that internal controls for processing obligations and disbursements comply with OMB Circular A-11, Budget Execution Manual, requirements. Controls should provide evidence of government officials’ authorization for each transaction in which program funds are used, preventing or minimizing ADA violations at all levels of the budget process. 63 Under Section 902 of the CFO Act, the agency chief financial officer is charged with overseeing all financial management activities relating to the programs and operations of the agency; developing and maintaining an integrated agency accounting and financial management system, including financial reporting and internal controls; and directing, managing, and providing policy guidance and oversight of agency financial management personnel, activities, and operations. 64 The housing assistance payments contract renewal, along with the notification of funding, is required for authorizing the project’s continued participation and for authorizing the obligation of funds the first year. 65 Audit Report 2015-FO-0002, Interim Report on HUD’s Internal Controls Over Financial Reporting, issued December 8, 2014 39 preexisting funds control plans. Therefore, this weakness continued in fiscal year 2016 since HUD was in a transitioning period to a new funds control structure and no updates were being accepted by OCFO for existing funds control plans. Additionally, the interim funds control documentation did not address Multifamily Housing Programs process changes. In fiscal year 2016, we found that 60 obligations and 78 disbursements from samples of 93 obligations and 101 disbursements, or 71 percent of the total transactions tested, were not supported with proper obligating documentation as prescribed in the latest approved housing control of funds requirements. These obligation and disbursement transactions totaled $137.7 million and $21.9 million, respectively. HUD’s Funds Control Documentation Did Not Properly Include Significant Business Processes Completed by Its Federal Shared Service Provider We previously reported that all of HUD’s funds control plans were not updated in a timely manner. This condition continued in fiscal year 2016, as HUD was transitioning to a new funds control structure. OCFO requires allotment holders to recertify annually that internal controls to administer funds have not changed and submit updated plans before implementing changes. However, we noted the following: • HUD’s funds control policies were not revised for salary and expense transactions processed in ARC’s Oracle financial system. As a result, there were inconsistencies in the 33 salary and expense funds control plans in the ARC standard operating procedures. Salaries and expenses receive annual appropriations of $1.7 billion. • There was no traceability from the standard operating procedures established in the HUD Guidance on Funds Control for Business Processes document to the appropriation funds used for obligation incurred and disbursement transactions. Specifically, there was no documentation of fund, program code, or program class to restrict funds accordingly. • The funds control plan for the Office of the Chief Human Capital Officer had not been updated since its reorganization and renaming from the Office of Administration in 2009. As a result, the plan referenced divisions and offices that no longer existed. • The funds control plans for the Section 184 Loan Guarantee program were inconsistent with the procedures in use. The Indian Housing Loan Guarantee, or the Section 184 program, did not have documentation of internal controls over funds. The funds available can subsidize a total loan principal, up to $1.190 billion, until spent. The revision process of Section 184 funds control plans was not accepted by OCFO during the interim period; therefore, documentation of funds control did not exist for the current year. Revisions to these plans were in process during fiscal year 2016. These conditions existed because in October 2015, HUD transitioned to ARC for financial management services. This change resulted in the replacement of HUDCAPS with Oracle Federal Financials as the official system of record for all general ledger accounts and budgetary resources for HUD. As part of this transition, OCFO issued HUD’s fiscal year 2016 Process 40 Improvement for Funds Control Plans approach, and the Fiscal Year 2016 Funds Control Plans and Handbook Project memorandum on October 9, 2016, to outline the funds control requirements. According to the memorandum, OCFO did not require the revision of plans to address Oracle financial reporting and the funds control business process for transactions processed by ARC, HUD’s FSSP. Specifically, OCFO management did not require the budget execution and funds control procedures of transactions processed directly to Oracle as a part of the migration to be reflected in HUD’s funds control plans. Instead, OCFO prepared HUD’s Guidance on Funds Control for Business Processes document, which documents ARC’s funds control procedures, for the program offices’ use. This document became a procedural guide for the business processes performed by ARC and served as a standard operating procedure manual, outlining the transactions that occur in the Oracle financial reporting system. It was not intended to supersede the existing funds control policies implemented by HUD and was to be used in combination with existing funds control plans. However, this document’s control structure conflicted with the existing funds control plans due to key procedures, such as the allocation of funds to program offices, which did not reflect the budget execution procedures adopted with ARC. Further, critical financial reporting elements of program code and program class within the ARC Cam1 Code 66 were not transparent in the funds control documentation to provide accountability to the financial system of record. Lastly, the procedures identified in the document did not provide traceability to the applicable funds or program office transactions and accountability to the responsible officials. Further, HUD’s allotment holders did not update their funds control documentation or notify the CFO in a timely manner after changes occurred. HUD Handbook 1820.2, REV-5, states that an allotment holder must immediately advise the CFO of any changes to its funds control plan during the fiscal year. Administrative changes to the funds control plans must be communicated in writing, including the precise timing of any changes, to the persons or positions authorized to initiate, approve, and process actions that commit, obligate, or spend funds. OCFO attested that the Delegation of Authority document ensures accountability of responsible officials and traceability to the corresponding funds during the transition. However, there was no inclusion of responsible officials for salary and expense transactions, and the responsible officials identified for budget execution were not designated authority at the fund level. Another factor leading to the out-of-date funds control documentation was OCFO’s lack of oversight and monitoring of the program offices’ compliance with their funds control plans in prior years. The CFO Act states that the responsibilities of an agency chief financial officer include directing, managing, and providing policy guidance and oversight of all agency financial management personnel, activities, and operations. Due to the lack of oversight and monitoring, OCFO was not aware that changes within the program offices were going unreported and, therefore, could not correct the behavior. 66 The Oracle financial system includes the account flex field for the line of accounting. In fiscal year 2016, key changes to the accounting classification structure included that the program class and program code were combined into one field, called “Cam 1” in Oracle. 41 During fiscal year 2013, OCFO’s Funds Control Assurance Division began performing reviews of program office compliance with the funds control plans and completed its first year of a 5- year cycle in fiscal year 2014. However, HUD’s transition to a new funds control business structure in 2016 delayed the completion of compliance reviews throughout the year. Notably, HUD was developing new policies and procedures for completing compliance reviews, which were not completed until September 2016. Not All HUD Programs Had Proper Funds Control Documentation Our review of HUD’s funds control plans found 102 program codes that were not documented in a funds control plan. HUD’s program codes are used to identify funds obligated and spent for specific programs and activities in its financial systems. In our prior-year audit, we reported that 112 program codes were not included in funds control plans. We recommended that OCFO ensure that the program codes are properly approved and included in a funds control plan. In fiscal year 2016, we determined that 10 program codes were properly included in a funds control plan; however, the recommendation was not fully addressed by OCFO because there were 102 program codes without a funds control plan. HUD was not in compliance with OMB Circular A-11, section 150, Administrative Control of Funds, which states that the purpose of an agency’s funds control system is to restrict both obligations and expenditures from each appropriation of fund account to the lower of the amount apportioned by OMB or the amount available for obligation or expenditure in the appropriation or fund account. Additionally, HUD Handbook 1830.2, REV-5, Administrative Control of Funds, states that proper execution of a funds control plan should provide reasonable assurance that obligations and expenditures will not exceed the authorized limits of the allotted funds. It also states that funds control plans must contain detailed information for the program line item or other activity included in the allotment, broken down to the lowest level of any corresponding assignment of funds, and list the hierarchy of accounting codes associated with each funded activity covered in the allotment to show how funded activities are controlled and rolled up to the allotment level as a required element of a funds control plan. HUD did not have documented internal controls over the obligation and disbursement of all of its funds. As a result, the agency could not monitor the internal controls to ensure that they functioned effectively. There was no traceability from the standard operating procedures established in the HUD Guidance on Funds Control for Business Processes document to the appropriation funds used for obligation incurred and disbursement transactions. The interim documentation did not include fund, program code, or program class to restrict funds accordingly. This condition caused HUD to lose traceability of transactions with the corresponding authority and program law. CFO Systems Division Did Not Document Changes to the Accounting Data During our review in 2015, we found instances in which the OCFO Systems division made changes to accounting data that resulted in unsupported general ledger transactions. In fiscal year 2016, we found that this condition continued, and as a result, we could not validate these 42 transactions’ compliance with the program funds control process and consistency with Federal accounting standards. OCFO did not have policies and procedures in place requiring documentation, review, and approval for changes to its financial data as required by Treasury guidance and internal control standards. OCFO Systems reversed transactions from fund 86 16 0163 using table updates in HUDCAPS to report them in fund 86 16-17 0163 after passage of the fiscal year 2016 appropriations bill; however, there was no evidence of supervisory review and approval of the adjustments in accordance with Treasury Financial Manual, volume I, part 2, chapter 5100. 67 In a sample of disbursement and collection transactions, we identified five items for which HUD had no journal vouchers, SF 1166 (Voucher and Schedule of Payments), or other supporting documentation readily available. The five items sampled totaled $335 million in disbursements. Additional analysis of the disbursements made from fund 86 16 0163 provided that 12,513 transactions of $692.5 million were reversed and moved to fund 86 16-17 0163. HUD’s budgetary accounts showed that 70,384 transactions totaling $4.2 billion in accounts 4801, 4901, and 4902 were reversed and moved to fund 86 16-17 0163 as well. The adjusting transactions were made with no effective internal control over financial reporting and, therefore, increased the risk of errors and unauthorized adjustments to HUD’s financial data. Conclusion HUD did not have a fully implemented and complete administrative control of funds system during fiscal year 2016. The interim funds control approach established as a result of HUD’s transition to ARC created an inconsistent internal control structure for restricting the obligation and expenditure of funds. The inconsistencies among the multiple pieces of funds control documentation did not ensure accountability or traceability to the policies and procedures governing budget execution, obligation, and expenditure of funds. Additionally, limited funds control of salary and expense transactions processed in ARC’s Oracle financial system created an environment for unrestricted obligations and disbursement of funds. As a result, HUD did not have adequate assurance that its obligations and disbursements complied with applicable laws, limitations, and ADA requirements In addition, processing disbursements before the documented point of legal obligation may lead to ADA violations. Statistically projecting our results for the multifamily Section 8 rental housing assistance disbursements in fiscal year 2016, we can be 95 percent confident that at least $6.89 billion in obligations and $7.64 billion in disbursements were processed without properly authorized supporting documentation. As a result, we were not able to validate multiple obligation and disbursement samples to determine whether obligations incurred and disbursements made were properly approved by the authorized official with the correct projects, number of units, rent rates, and amount allocated. 67 Treasury Financial Manual, volume I, part 2, chapter 5100, Supplement FBWT [Fund Balance With Treasury], Reconciliation Procedures: IV Policy, Adjustments: An agency may not arbitrarily adjust its FBWT account. Only after clearly establishing the causes of errors and properly documenting those errors should an agency adjust its FBWT account balance. If an agency must make material adjustments, the agency must maintain supporting documentation. This will allow correct interpretation of the error and its corresponding adjustment. 43 Lastly, effective internal control over accounting data changes remained weak. Therefore, there was an increased risk of errors and unauthorized adjustments to HUD’s financial data. There was no supporting documentation for the reversal of transactions, which consisted of an absolute value of $1.385 billion in disbursements and $8.4 billion affecting multiple budgetary accounts. 68 OCFO did not have policies and procedures in place requiring documentation, review, and approval for changes to its financial data as required by Treasury guidance and internal control standards. Recommendations Prior-year recommendations regarding this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have five new recommendations in this report. We recommend the Deputy Chief Financial Officer 7A. Finalize and implement the funds control policies and procedures for the business processes completed by ARC, including salary and expense transactions, and ensure traceability to the program funds, adopting the policies for budget execution, obligation, and expenditure of funds. 7B. Monitor each program office’s compliance with the established funds control policies by reviewing and approving funds control documentation revisions and annual certifications in a timely manner. 7C. Ensure that each program office maintains current reporting elements in its funds control documentation, including the fund, program code, and program class, to provide traceability to the Oracle financial system and the transaction source. 7D. Ensure that the roles and responsibilities are defined and documented by position for those individuals authorized in the funds control process. 68 Absolute value of $692.5 million reversed out of 86 16 0163 + absolute value of $692.5 million entered into 86 16-17 0163 = $1.385 billion; absolute value of $4.2 billion reversed out of 86 16 0163 + absolute value of $4.2 billion entered into 86 16-17 0163 = $8.4 billion 44 Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations Deficiencies in HUD’s process for monitoring its unliquidated obligations and deobligating balances tied to invalid obligations continued to exist. Specifically, some program offices did not complete their obligation reviews in a timely manner, and we discovered $204.4 million 69 in invalid obligations not previously identified by HUD. We discovered another $93.4 million 70 in obligations that were inactive, 71 potentially indicating additional invalid obligations. We also discovered $34.6 million in obligations that HUD determined needed to be closed out and deobligated during the fiscal year that remained on the books as of September 30, 2016. We attributed these deficiencies to ineffective monitoring efforts and the inability to promptly process contract closeouts. Lastly, we noted that as of September 30, 2016, HUD had not implemented prior-year recommendations to deobligate $100.5 million in funds. As a result, HUD’s unpaid obligation balances on the statement of budgetary resources were potentially overstated by $432.9 million. CPD Obligations Were Inactive or Expired As of September 30, 2016, we noted inactive or expired CPD obligations in the following program areas: (1) Homeless Emergency and Rapid Transition to Housing – Continuum of Care (Hearth CoC), (2) Emergency Solutions Grants (ESG), and (3) Neighborhood Stabilization Program (NSP) grants. We attributed this condition primarily to the lack of an adequate closeout policy, deadlines, and resources to perform closeout activities in a timely manner. As a result, funds remained obligated for grants that no longer had a bonafide need, and HUD’s unliquidated obligation balance was overstated on its consolidated statement of budgetary resources. Hearth CoC. Grants were not closed within the 90-day period after the expiration date required by the program’s funds control plans and the Code of Federal Regulations (CFR). The Office of Special Needs Assistance Programs (SNAPS) did not implement or enforce policies and procedures to ensure that expiring contracts were closed within the 90-day period. We identified 3,121 contracts, which expired between July 1, 2015, and June 30, 2016, that were not closed within the 90-day period, and remaining undisbursed obligation balances of approximately $151.7 million had not been recaptured and reallocated to be used to further the purposes of the program or returned to Treasury. In fiscal year 2015, the Office of Policy Development and Coordination (OPDC) was created to focus on grant closeouts and audit responses for CPD programs, starting with homeless assistance grants. OPDC and SNAPS were piloting automated processes to improve the closeout of expired grants and the recapture of any remaining funds. HUD was also working to assign clear roles and responsibilities to OPDC and SNAPS and to train field office staff. HUD believes these tasks will enable SNAPS to more regularly 69 $151.7 million in homeless assistance funds, $18 million in ESG funds, and $34.7 million in housing obligations 70 $86.4 million in Ginnie Mae funds and $7 million in NSP funds 71 We define an obligation as inactive if a disbursement has not been made within a reasonable amount of time. This time varies based on program area and applicable criteria. 45 track the financial status of its grants as well as the field offices’ efforts to comply with policies and procedures to recapture the unspent funds on expired contracts. While SNAPs worked diligently to close out and recapture remaining funds on expired grants identified in prior-year audit reports, the field offices continued to be overwhelmed with running multiple fiscal year funding competitions simultaneously. ESG. Grants were not closed within the 90-day period after the 24-month expenditure deadline as required by the CFR. We identified 1,365 contracts, which expired between June 2, 2012, and June 30, 2016, that were not closed within the required timeframe. In addition, the remaining undisbursed obligations of approximately $18.1 million had not been recaptured. Of this amount, only nine contracts, with a total of about $68,000 in undisbursed obligations, were marked for deobligation during HUD’s annual review of open obligations for fiscal year 2016, leaving 1,356 expired contracts totaling $17,986,109 remaining open that could potentially represent invalid obligations. SNAPS had not established procedures to specifically address the closeout and recapture of undisbursed obligations after the 24-month expenditure deadline for ESG contracts. Instead of recapturing funds on expired contracts, the office chose to implement other requirements or sanctions for grantees that had not complied with the 24-month expenditure deadline which is allowed per 24 CFR 576.501. SNAPS required that noncompliant grantees submit and comply with proposals that included planned actions and timelines to implement corrective actions. NSP 1 and 3. Grantees continued to spend grant funds from their line of credit despite the passing of expenditure deadlines in 2013 and 2014 established in the Federal Register. The expenditure deadlines were set based on the needs assessment for the program and to address what Congress described as emergency conditions. Despite the expenditure deadlines, HUD decided to allow grantees to continue to spend program funds beyond the expenditure deadline if they had spent an amount equal to at least 100 percent of the their initial allocation of NSP funds by their expenditure deadline date. Those that did not meet this requirement were subject to other corrective actions but not necessarily the recapture of remaining funds, and they were allowed to continue to spend their program allocation. However, we found 16 open NSP grants with no disbursements from their grant balance or program income since 2014 with remaining grant balances totaling approximately $7 million. This condition occurred because (1) some grantees no longer had an adequate pool of NSP-eligible foreclosed-on or abandoned properties in their target areas, which decreased spending opportunities; (2) CPD had inadequate resources to oversee NSP, which impacted its ability to monitor obligations and expenditure deadlines, pursue closeout efforts, and enforce corrective actions; and (3) CPD lacked closeout deadlines. 72 72 CPD considers a grantee ready for program closeout once all applicable administrative actions and all required work of the Federal award have been completed by the non-Federal entity. CPD’s closeout guidance states that 46 Ginnie Mae’s Obligation Balance Contained Invalid Obligations Based on our review of Ginnie Mae’s unpaid undelivered orders, 20 contracts totaling $72.8 million were inactive. 73 Three of these contracts totaling $64.6 million were for mortgage servicers that no longer serviced Ginnie Mae loans,74 and the contracting officer confirmed that they should be closed and deobligated. The other 17 small contracts with a remaining balance of $8.2 million also appeared to have ended since there was no recent activity 75 on Ginnie Mae’s contract activity report. In addition to these invalid obligations, Ginnie Mae did not record a deobligation in its financial system for a contract that had been closed by OCPO in its procurement system totaling $13.6 million. This condition occurred because Ginnie Mae did not have a formal process in place to review its contracts and inform HUD’s OCPO of contracts that need to be closed and deobligated. Once the contracts were closed, HUD’s OCPO did not have a formal process to provide the information to Ginnie Mae for financial recording. For example, Ginnie Mae could not deobligate $13.6 million on a contract that HUD’s OCPO said it closed because OCPO could not locate the signed contract and had not provided it to Ginnie Mae. These steps are necessary because HUD’s procurement system and Ginnie Mae’s financial system do not interface with one another. When contracts and other agreements are completed or terminated, the remaining obligation balances become invalid. Therefore, if these obligations are not deobligated, HUD’s obligation balance on the statement of budgetary resources is overstated. These invalid obligations overstated HUD’s unliquidated obligation balance by $86.4 million. Housing Obligations Were Inactive or Expired As of September 30, 2016, we noted $22,075,052 in Section 235-236 funds, $12,261,389 in Section 202-811 funds, and $384,125 in project-based Section 8 funds that were identified to be deobligated but were not. HUD did not adequately monitor and deobligate unliquidated balances from these obligations, resulting in the unpaid obligation balance on HUD’s statement of budgetary resources being potentially overstated by $34,720,566 million. See table 4. grantees may continue to spend their remaining line of credit funds following expenditure deadlines with the objective of satisfying the closeout criteria as quickly as possible. 73 We consider an obligation inactive when there has been no activity in 1 year. 74 The period of performance on these contracts ended December 15, 2011, September 3, 2014, and February 28, 2015. 75 We considered activity after June 30, 2015 to be recent. 47 Table 4 Invalid housing obligations $ # Section 235-236 $22,075,052 709 Section 202-811 12,261,389 53 Project-based Section 8 384,125 23 Total 34,720,566 785 Program Offices Did Not Complete Their Deobligation Certifications in a Timely Manner and Did Not Complete Deobligations Identified During the Departmental Review The annual departmentwide obligation review and certification process is an essential part of HUD’s internal controls over its funding and accurate financial reporting. This review gives OCFO assurance that its fiscal yearend obligation balance is valid and accurately valued. To ensure adequate time for the deobligation of any invalid obligations by the end of the fiscal year, OCFO required program offices to review and certify their obligations by June 24, 2016. A number of program offices completed their review and certified their obligations after the deadline. As a result, offices may be unable to process deobligations before the end of the fiscal year due to insufficient time. In addition, several offices did not complete the deobligation of the invalid obligations they identified. During the fiscal year 2016 review, offices marked 2,115 obligations with remaining balances of $63.1 million for deobligation. Of these, 1,141 obligations with remaining balances of $34.6 million were not closed out and deobligated by the end of the fiscal year. 76 We attributed HUD’s inability to process all of the closeouts and deobligations by the end of the fiscal year to delayed certifications and a lack of monitoring of obligations throughout the year. Several HUD program offices relied on the annual OCFO-coordinated open obligations review to assess all of their obligations and deobligate any invalid obligations. As we have reported in prior years, while the OCFO-coordinated review is an important internal control, it was not designed to be the sole control over open obligations because (1) the period for review and deobligation is limited and (2) only obligations above the predetermined threshold 77 are required to be reviewed. As a result, HUD’s unpaid obligation balances on the statement of budgetary resources were overstated by $34.6 million. HUD was working to close and deobligate these obligations, and the associated funding should be recaptured during fiscal year 2017. Prior-Year Recommendations Had Not Been Implemented We noted that as of September 30, 2016, prior-year recommendations regarding deobligation amounts of $100.5 million were outstanding. Therefore, HUD’s unpaid obligations on the 76 Refer to Appendix B – Departmentwide Obligation Review – Schedule of Recommended Deobligations 77 The threshold to be included in the open obligations review for administrative and program obligations is $23,000 and $243,000, respectively 48 statement of budgetary resources related to prior-year unimplemented recommendations were overstated by $100.5 million. See table 5. Table 5 Office Program $ Housing Project-based Section 8 $52.5 million Housing Section 235-236 36.2 million Housing Section 202-811 1.3 million CPD Homeless assistance 10.5 million Total: 100.5 million Conclusion HUD’s processes for (1) monitoring the validity and need for its unliquidated obligations and (2) timely closeout of expired grants continued to not be fully effective during fiscal year 2016. We identified $297.8 million tied to expired or inactive obligations or grants that had not completed the closeout process. Additionally, HUD did not close out all of the obligations identified as invalid by the end of the fiscal year. This condition resulted in $34.6 million in invalid obligations remaining on HUD’s books at yearend. In total, HUD’s unliquidated obligation balance on the statement of budgetary resources was potentially overstated by $332.4 million. We also noted that as of September 30, 2016, HUD had not implemented prior- yearrecommendations of $100.5 million, which also caused a potential overstatement on the statement of budgetary resources. Recommendations We recommend that the Principal Deputy Assistant Secretary for Community Planning Development 8A. Close out and deobligate the remaining balances on 3,121 expired homeless assistance contracts of $151,719,152. Further, deobligate $10,996,784 in 234 program obligations marked for deobligation during the departmentwide open obligations review. 8B. Review the status of the remaining balances on 1,356 expired ESG contracts totaling $17,986,109 and determine whether these balances should be recaptured. 8C. Work with the Office of Policy Development and Coordination to issue and implement procedures to address undisbursed obligations on contracts after the 24-month expenditure period for the ESG program. 8D. Prescribe a deadline date for closeout of NSP for rounds 1 and 3. 8E. Research grants with no drawdown activity and if a bonafide need no longer exists, close out and deobligate remaining balances on the 16 grants with no drawdown activity totaling $6,966,585. 49 We recommend that the Principal Deputy Assistant Secretary for the Office of Housing-Federal Housing Commissioner 8F. Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $18,290,686 in 307 administrative obligations and $3,420,032 in 202 program obligations marked for deobligation as of September 30, 2016. 8G. Review and if necessary deobligate the 785 expired or inactive Section 235-236, Section 202-811, and Project Based Section 8 projects totaling $22,075,052, $12,261,389, and $384,125, respectively. We recommend that the Chief Information Officer 8H. Deobligate the $83,501 in 124 administrative obligations marked for deobligation during the departmentwide open obligations review. We recommend the Chief Human Capital Officer 8I. Deobligate the $360,907 in 125 administrative obligations marked for deobligation during the departmentwide open obligations review. We recommend that the Chief Administrative Officer 8J. Deobligate the $152,211 in 108 administrative obligations marked for deobligation during the departmentwide open obligations review. We recommend that the Assistant Secretary for Fair Housing and Equal Opportunity 8K. Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $384,703 in 27 administrative obligations and $234,619 in 6 program obligations marked for deobligation as of September 30, 2016. We recommend that the Assistant Secretary for Field Policy and Management 8L. Deobligate the $85,782 in 5 administrative obligations marked for deobligation during the departmentwide open obligations review. We recommend that HUD’s Chief Procurement Officer 8M. Research the $13.6 million deobligation recorded in HIAMS for the Bank of New York Mellon and if it was executed, provide the signed contract to Ginnie Mae for recording in its general ledger. 50 8N. Implement a formal process to provide Ginnie Mae with all of the documentation it needs to record deobligations as soon as they are recorded in PRISMTM. We recommend that Ginnie Mae’s Senior Vice President, Office of Management Operations, 8O. Implement a formal process to periodically review obligations and when necessary, contact OCPO to execute deobligations. 8P. Review the contracts totaling $72.8 million to determine validity and if no longer needed, forward to HUD’s procurement office for closure and deobligation. We recommend that Ginnie Mae’s Chief Financial Officer 8Q. Record the deobligations provided by OCPO totaling as much as $86.4 million for the contracts identified during our review. Additionally, Ginnie Mae should deobligate the $587,505 in three administrative obligations marked for deobligation during the departmentwide open obligations review. 51 Finding 9: HUD’s Computing Environment Controls Had Weaknesses HUD’s computing environment, data centers, networks, and servers provide critical support to all facets of its programs, mortgage insurance, financial management, and administrative operations. In fiscal year 2016, we audited application controls over NCIS, which exchanges data between the financial systems ARC Oracle Financials and HUD. We found that some access controls within NCIS were not effective and some of the application security documentation was inaccurate. These weaknesses occurred because of limited resources to perform the required tasks. As a result, some contractors had inappropriate access to sensitive budget and general ledger financial transactions. Further, inaccurate security documentation could lead to inappropriate decisions. In addition, although HUD had taken action to address information system control weaknesses reported in prior years, several of those weaknesses remained. Without adequate general and application controls, there was no assurance that financial management applications and the data within them were adequately protected. Some Access Controls Within NCIS Were Not Effective Some access controls within NCIS were not effective. Specifically, excessive privileges were granted to two contractors in violation of the concept of least privilege. 78 These users were granted the authority to access production data when their job functions did not require them to have that level of access. They were also authorized to use the default admin user account within Oracle for NCIS. The default admin user account was assigned to one user but was manually transferred to another when the assigned user was unavailable. By default, this account had full admin rights, which provided the contractor full control of the workspace. NCIS audit logs for the end user and security administration functions provided information only on user logins and whether they were successful or failed. There was no documentation on the actions that the user took with these elevated privileges. Additionally, the Developer Activity by User log, a log mentioned within the NCIS system security documentation, was not provided to OCFO personnel that performed reviews of the audit logs and did not contain details regarding the actions taken by the user. Also, NCIS audit logs for the database did not contain detailed information on the actions the user took. Due to limited resources within HUD, excessive privileges were granted to contractor personnel that fully understood and could monitor the newly developed application. NCIS audit logs were created for the initial functionality of the application. The number and significance of the transactions processed through NCIS were increased with the implementation of release 3 of the New Core Project, and the audit log functionality was not modified to address the additional risks associated with a larger number of financially significant transactions resulting from these changes. 78 The principle of least privilege requires that users be granted the most restrictive set of privileges (or lowest clearance) needed to perform authorized tasks (that is, users should be able to access only the system resources needed to fulfill their job responsibilities). 52 The excessive access privileges granted to these contractors provided them inappropriate access to sensitive budget and general ledger financial transactions and gave them the ability to access the financial data, providing them with the ability to intentionally or accidentally delete or modify the data. These users also had the ability to modify user accounts, which could lead to the unauthorized granting of access to HUD users or contractor personnel. Allowing both contractors to use the default admin user ID left HUD unable to definitively track actions to one individual in accordance with policy. Audit logs provide the ability to maintain a record of system, application, and user activity. In conjunction with the appropriate tools and procedures, audit logs can assist in detecting security violations, performance problems, and application flaws. Without appropriate audit logs, HUD did not have a mechanism in place to track and associate user and system activity to events. Due to inadequate logs over the security administration function, HUD was unable to determine when or whether access modifications had been made or whether any actions taken were authorized. Some of the New Core Interface Solutions’ Security Documentation Was Inaccurate Some of the NCIS application security documentation was inaccurate. We identified the following examples of instances in which system documentation was not updated to reflect the current application. • The NCIS system security plan (SSP) stated that NCIS’ Oracle database generates table- level audit logs, which automatically capture changes to table data, such as account creation, modification, disabling, and termination actions. The NCIS security testing and evaluation documentation, dated August 2015, stated that testing of the audit logs for the end user and security administrator contained information regarding who performed the action and when the action was completed. Our assessment of the end user and security administrator audit logs found that only user login information was maintained in the log. • The NCIS SSP contained inaccurate information regarding the level of access provided to the security administration function. The SSP stated that the security administrator role was forced to use the workspace administrator access level to perform the security function level due to the design of the application and that this level of access gave the security administrator access to the development environment. This security weakness was reported as an issue with release 1 of NCIS. A plan to correct the item was created, and the issue was resolved in January 2015; however, the deficiency was reported in the current SSP. • The NCIS SSP contained inaccurate information regarding the functionality of the application. The system description detailed the transfer of data between HUD and ARC; however, the description related to the processing that the system did for New Core, release 1, functionality and not release 3. The description detailed the transfer of travel transactions between the applications. These data are no longer transferred between the applications. 53 • The NCIS SSP identified five user roles for the application, while the NCIS Operations and Maintenance Manual identified eight user roles. The eight user roles identified in the NCIS Operations and Maintenance Manual, updated to reflect release 3.1 functionality, were consistent with the levels of access granted on the user access listing. This condition occurred because OCFO did not enforce documentation requirements. OCFO has continually made significant system modifications to the NCIS application since its implementation in October 2014. The NCIS application was a significant part of the implementation of a new core financial management system. Since the SSP established and documented the security controls, it was supplemented by the assessment report, and the plan of actions and milestones was the documentation that management reviewed. Inaccurate information within this document could lead to inappropriate decisions. Some Windows Servers 2008 User Accounts Were Not Adequately Managed Some Windows Server 2008 user accounts were not adequately managed. We identified 31 user accounts that did not require a password to sign on. The accounts were still active and had not been disabled. According the OCIO, the accounts were inactive legacy accounts that existed on the local servers, but no longer existed on the domain controller. The accounts were carried forward during the upgrade from Windows 2003 to 2008. Inactive user accounts that remain enabled can be an attractive target for attackers. This is because an inactive user account can be leveraged to get access to resources without being noticed since it is a valid account that no longer has an owner. Consequently, usage most likely would not be noted. When we brought this issue to OCIO’s attention, steps were immediately taken to remove these accounts from the local servers. Information System Control Weaknesses Were Previously Identified in HUD’s Loan Accounting System LAS is based on a commercial-off-the-shelf product and was implemented in August 2006. LAS is a mixed financial system that performs the direct loan-servicing activities required to support HUD’s Section 202 Housing for the Elderly and Handicapped Loan Program, Section 201 Flexible Subsidy Program, Section 236 Excess Rental Income Program, Green Retrofit Program, and EHLP. The system maintains the loan amortization schedules, generates the monthly interest amounts due and principal amounts due, and applies collections to the interest and principal amounts due, and all excess amounts are recorded in the project-loan suspense account. In an audit conducted in fiscal year 2014, 79 we found that the EHLP data within LAS were incomplete and inaccurate. Specifically, (1) the loan data in LAS were incomplete, (2) the loan data initially entered into LAS were inaccurate, and (3) the process used by HUD to correct the data for the HUD direct loan portion of the program may not result in accurate data. We found that controls over the data transfer process for EHLP loan data were not secure. While a secure Web site was established for the fiscal agents and States to send EHLP loan information to the Office of Housing and OCFO, the fiscal agent and State grantees, which administered the 79 2015-DP-0004, Review of the Loan Accounting System, issued December 9, 2014 54 program, were not required to transmit data via the secure Web site. In addition, controls to lock out a user after three failed login attempts were not implemented. We found that data changes were not adequately controlled in LAS and determined that some access controls within LAS were not effective. Specifically, (1) the user recertification process did not ensure that all users were included, (2) formal procedures for granting and removing user access were not always followed, (3) excess privileges were granted to two users, and (4) audit logs were not reviewed. Our audit revealed that the LAS configuration management plan was outdated and that documentation for application interfaces with LAS was not consistent and technical details required to operate the interfaces was not included in the documentation. We followed up on the status of these weaknesses during fiscal year 2016. HUD took actions to address the weaknesses identified with the process to make data changes, the configuration management plan, access controls, the data transfer process, the review of audit logs, and the revision of the user interface documentation. HUD continued to address the weaknesses identified related to the EHLP data. These actions were scheduled to be completed during fiscal year 2016 but are still in process. HUD expected to complete the corrective actions during fiscal year 2017. Information System Control Weaknesses Were Previously Identified in the IBM Mainframe The IBM mainframe houses many of HUD’s applications used to facilitate day-to-day operations. The mainframe includes communication functionalities on multiple platforms that provide information exchange services between users and applications. It permits authorized HUD users to access data maintained on multiple applications and integrate the data into other applications or process the information in its current form. In addition, the mainframe acts as a gateway for authorized external organizations and agencies to access HUD-maintained data. Major financial applications that operate on the IBM platform include (1) HUDCAPS, (2) the Single Family Insurance Claims Subsystem, and (3) the Tenant Rental Assistance Certification System. Our review in fiscal year 2015 found 80 that HUD did not ensure that information system controls over the IBM mainframe fully complied with Federal requirements and its own security policies. Specifically, 1. User accounts on the IBM mainframe were not properly managed. Members of the Help Desk had access to a powerful system utility when they had no business need for it. Additionally, two users had update privileges to datasets that were part of the IBM mainframe’s security application. These users had no business purpose for modifying these datasets. Users had these unnecessary privileges in their profiles because reviews of user access to the IBM mainframe did not include reviewing the user accounts to determine whether they followed the policy of least privilege. This failure to follow 80 2016-DP-0001, Fiscal Year 2015 Review of Information System Controls in Support of the Financial Statements Audit, issued November 13, 2015. This was a limited distribution report due to the sensitive nature of the information reported, and was, therefore, not made available to the public. 55 HUD’s IT security policy increased the risk that sensitive information could be exploited by malicious individuals, system integrity could be compromised, and data could be corrupted or disclosed. 2. Existing vulnerabilities were not reported in system security documentation. This condition occurred because of an oversight by HUD’s IT support contractor. Failure to properly document open findings in risk assessments and security authorization documentation presents an inaccurate risk profile for the information system. We followed up on the status of these weaknesses during fiscal year 2016. Eleven of the twelve recommendations were addressed during the fiscal year. HUD planned to resolve the remaining recommendation during the second quarter of fiscal year 2017. Information System Control Weaknesses Were Previously Identified in HUD’s Intranet General Support System In an audit conducted in fiscal year 2014, 81 we reviewed controls over HUD’s Intranet general support system. We found that OCIO did not have documentation that sufficiently defined the segregation of duties or procedures for evaluating compliance with the segregation of duties for users with above-read access to the Intranet general support and its interconnected systems. We also found that security management documentation was not always complete, accurate, or current. Not all security management program documents were updated to reflect current conditions; some information on HUD’s IT security Web site was outdated, inaccurate, or unavailable; and minor applications did not have valid authorizations to operate. We followed up on the status of these weaknesses during fiscal year 2016. HUD had taken action to correct segregation of duties and security management weaknesses and planned to address the one open recommendation during the second quarter of fiscal year 2017. Conclusion HUD’s computing environment provides critical support to all facets of its program, mortgage insurance, financial management, and administrative operations. During fiscal year 2016, as in prior years, we continued to identify information systems control weaknesses that could negatively affect HUD’s ability to accomplish its assigned mission, protect its data and IT assets, fulfill its legal responsibilities, and maintain its day-to-day functions. As a result, we continue to report a significant deficiency for HUD’s computing environment. 81 2015-DP-0005, Fiscal Year 2014 Review of Information Systems Controls in Support of the Financial Statements Audit, issued February 24, 2015 56 Recommendations We recommend that the Office of the Chief Financial Officer 9A. Remove access granted to developer contractor personnel to the production database. 9B. Prohibit developer user ID sharing and create an additional user ID for system administration within the developer environment. 9C. Establish audit logs that track user activity for the security administration functions and once established, ensure that they are monitored in accordance with policy. 9D. Establish audit logs that track user activity for privileged users within the production environment and once these logs are established, ensure that they are monitored in accordance with policy. 9E. Review and update the NCIS documentation to reflect the current state of the system and ensure that the most recent documents are made available to the users. 9F. Establish and implement procedures to ensure that the updated documentation remains current. 57 Compliance With Laws and Regulations In fiscal year 2016, we found instances in which HUD did not ensure that transactions were executed in accordance with laws governing the use of budget authority and with other laws and regulations that could have a direct and material effect on the financial statements and any other laws, regulations, and governmentwide policies identified in OMB audit guidance. 58 Finding 10: HUD’s Financial Management System Did Not Comply With the Federal Financial Management Improvement Act In fiscal year 2016, we noted a number of instances of FFMIA noncompliance within HUD’s financial management system. HUD’s continued noncompliance was due to New Core Project implementation challenges and a reliance on a number of legacy financial systems. HUD Did Not Always Comply With FFMIA FFMIA, section 803(a), requires chief financial officer agencies to establish and maintain financial management systems that comply substantially with (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the USSGL at the transaction level. FFMIA also requires agencies and their auditors to determine annually whether an agency’s financial management system (including primary or general ledger accounting systems and subsidiary or “mixed” systems) complies with those requirements. As of September 30, 2016, we noted instances in which HUD did not comply with the three section 803(a) elements of FFMIA. We tested compliance with FFMIA in accordance with OMB Circular No. A-123, Appendix D, Compliance with the Federal Financial Management Improvement Act of 1996. 82 HUD also concluded that the agency and its financial management system did not comply with each element of FFMIA. Refer to table 6 for details. Table 6 Compliance with Section 803(a) elements of FFMIA Agency Auditor Lack of compliance Lack of compliance 1. System requirements noted noted Lack of compliance Lack of compliance 2. Accounting standards noted noted 3. USSGL at transaction Lack of compliance Lack of compliance level noted noted As of Septemer 30, 2016, HUD reported noncompliance with the requirements of FFMIA. For areas of FFMIA noncompliance, each agency must identify remediation activities that are planned and underway, describing target dates and offices responsible for bringing systems into compliance with FFMIA.83 Refer to HUD’s 2016 agency financial report for additional details. 82 OMB Memorandum M-13-23 (OMB Circular A-123, appendix D) (September 20, 2013, accessed October 22, 2016); http://www.whitehouse.gov/sites/default/files/omb/memoranda/2013/m-13-23.pdf 83 OMB Circular A-136, Revised (October 7, 2016, accessed October 22, 2016); https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a136/a136_revised_2016.pdf 59 In addition, when auditors disclose a lack of compliance with one or more of the section 803(a) requirements, FFMIA requires that auditors provide additional details regarding the noncompliance. 84 Refer to appendix C for additional details. As the combined impact of HUD’s system limitations expands beyond the scope of the updated FFMIA framework, the system flaws identified as instances of FFMIA noncompliance are further described in the Internal Control section of this report as deficiencies contributing to a related material weakness. (See Finding 5 – Financial Management System Weaknesses.) Conclusion HUD’s financial management system did not comply with FFMIA as of September 30, 2016. Specifically, we noted instances in which HUD did not comply with the three section 803(a) elements of FFMIA. Recommendations There are no new recommendations in this area. 84 OMB Bulletin 15-02, Audit Requirements for Federal Financial Statements (August 4, 2015, accessed October 22, 2016); https://www.whitehouse.gov/sites/default/files/omb/bulletins/2015/15-02.pdf 60 Finding 11: HUD Continued To Not Comply With the HOME Investment Partnership Act HUD continued to not comply with section 218(g) of the HOME Investment Partnership Act (also known as the HOME Statute) regarding grant commitment requirements. HUD’s misinterpretation of the plain language in the Act, the implementation of the cumulative method and the FIFO technique, and the current recapture policies continued to result in HUD’s noncompliance with HOME Statute requirements. As a result, HUD continued to incorrectly permit some jurisdictions to retain, commit, and disburse HOME Investment Partnerships Program grant funds beyond the statutory deadline. HUD will continue to be noncompliant with related laws and regulations until the cumulative method is no longer used to determine whether grantees meet commitment deadlines required by the HOME Statute. Allowing grantees to disburse funds from commitments made outside the 24-month statutory period may have caused HUD to incur improper payments. HUD Policies Did Not Comply With the HOME Statute The HOME Statute required HUD to establish a HOME Investment Trust Fund for each participating jurisdiction (grantee), with a line of credit that included the grantee’s annual allocation. The Statute also required each grantee to place all of its annual allocation’s funds under a binding commitment within 24 months after it received its line of credit. Failure to do so would result in the grantee’s losing its right to draw any funds that were not placed under binding commitment within the 24 months and required HUD to make such reductions and reallocate the funds as soon as possible. HUD implemented a flawed process, called the cumulative method, to determine a grantee’s compliance with the requirements of section 218(g) of the Statute and determine the amount to be recaptured and reallocated with section 217(d). HUD measured compliance with the commitment requirement cumulatively, disregarding the allocation year used to make the commitments. Further, as discussed in finding 4 of this report, HUD also implemented the FIFO method to commit HOME program funds, which made it difficult to determine which commitments were made during the 24-month period. We continued to find this FIFO method to be a departure from Federal GAAP. Our audit results indicated that the use of a noncumulative method would result in a number of grantees that would not meet the 24-month commitment deadline, resulting in grant funds that could possibly have been recaptured and reallocated. We determined the commitment status, based on a noncumulative approach, for 460 grantees for the 2014 annual allocation commitment requirement and noted that 301 grantees had met the commitment requirement based on HUD’s cumulative method but did not meet the requirement based on OIG’s noncumulative method. We also noted that 46 grantees did not meet the requirement based on either method. This discrepancy resulted in a total net difference of $97 million, which should have been recaptured and reallocated if HUD had used the noncumulative calculation and grantees did not provide evidence to support commitments that were not entered into IDIS Online. 61 Use of the Cumulative Method May Have Caused Improper Payments During the fiscal year 2015 audit, 85 we determined that grantees that should have been considered noncompliant with the HOME Statute under the noncumulative method had disbursed approximately $950,000 from the commitments they made after their 24-month commitment deadline expired. We believe that the $950,000 disbursed from commitments outside the 24-month statutory period meets the criteria of an improper payment. According to OMB Circular A-123, appendix C, an improper payment is any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. We made recommendations during the fiscal year 2015 financial statement audit to (1) implement a payment recapture audit for the HOME program, specifically, to identify and recapture improper payments made as a result of the continued use of the cumulative method and include the HOME program in the next annual improper payment risk assessment, and (2) ensure that the impact of the cumulative method to meet commitment deadlines is included in the risk assessment process to evaluate the susceptibility to significant improper payments. However, as of September 30, 2016, we had not reached an agreement with OCFO on these recommendations. As a result, they were referred to the Deputy Secretary for a decision on September 20, 2016. Changes To Eliminate the Cumulative Method Were Underway In fiscal year 2013, CPD agreed to implement changes to IDIS Online to eliminate the FIFO method for fiscal year 2015 CPD formula grants (including the HOME program) beginning September 30, 2014. CPD stated that once the applicable changes were made to the HOME regulations and IDIS Online, HUD would stop using the cumulative method for determining compliance with the HOME 24-month commitment requirement for fiscal year 2015 grants and forward. In doing so, CPD would comply with section 218(g) of the HOME Statute for grants obligated after the system changes are implemented. Despite our position to have changes applied prospectively as well as retroactively, CPD decided that compliance with the 24-month statutory commitment requirement for funds obligated before the system and regulatory changes would still be determined on a cumulative basis. For funds obligated after the system and regulatory changes, compliance would be determined on a grant-specific basis. In fiscal year 2015, steps to eliminate the FIFO logic and cumulative method from IDIS Online were stopped due to budget shortfalls. By late fiscal year 2015, HUD was able to authorize the additional funds to restart the project and as of September 30, 2016, planned to complete all deliverables by May 2017. Among the remaining work, modifications to IDIS are still necessary for the system to comply with FFMIA and the USSGL at the transaction level, which includes ensuring that IDIS Online ties disbursements to specific commitments for the HOME program. 85 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015 62 Conclusion Among the remaining work left to complete in the FIFO elimination plan, CPD must ensure that IDIS ties disbursements to specific commitments for the HOME program so that compliance with the HOME Statute can be made on a grant-by-grant basis. However, because the changes will be implemented only for fiscal year 2015 grants and forward, HUD will continue to be noncompliant with the HOME Statute until the cumulative method is no longer used to determine whether commitment deadlines required by the Statute are met by the grantees. As a result, we will continue to report that HUD is noncompliant with related laws and regulations until the cumulative method is no longer used. Recommendations Prior-year recommendations regarding this finding remained open and can be referred to in the Followup on Prior Audits section of this report. We have no new recommendations in this report. 63 Finding 12: HUD Did Not Comply With Treasury Financial Manual Rules on Cash Management or 2 CFR Part 200 Since the implementation of its cash management policies in fiscal year 2013, PIH has made significant progress toward compliance with Treasury Financial Manual rules on cash management. 86 However, despite considerable efforts by HUD’s Office of Housing Voucher Programs, PHAs continued to maintain Federal cash in excess of their immediate disbursement need for extended periods. Specifically, MTW PHAs held between $432.4 million and $466.5 million for most of the fiscal year and even after offsets performed in August and September 2016, held $212 million in excess of their immediate disbursement needs. Further, PHAs accumulated $168.3 million from January to June 2016 and most likely accumulated additional excess funds from July through September, 87 all of which had not been offset as of September 30, 2016. These conditions occurred because HUD lacked an automated system and real-time expense data needed to fully implement its cash management policies. Since PHAs maintained these funds in excess of immediate disbursement need for extended periods and were unable to quickly offset the funds against future disbursements, HUD did not comply with Treasury’s cash management regulations 88 or 2 CFR Part 200, 89 increasing the risk of funds being susceptible to fraud, waste, and abuse. PIH’s Cash Management Process Did Not Offset Excess Accumulations in a Timely Manner PIH’s cash management process continued to be primarily manual, which did not allow for offsets of excess accumulations in a timely manner. 90 For example, HUD provided non-MTW PHAs $159.8 million in excess funding from October to December 2015 but did not offset it until 5 to 7 months later (May, June, and July 2016). HUD also identified $168.3 million 91 in 86 Before fiscal year 2013, HUD provided housing assistance payments to its PHAs that far exceeded PHAs’ need and did not have a process in place to offset excess funding. To address this problem, PIH implemented the following cash management polices: (1) determine future disbursement based on previous need, (2) perform quarterly cash reconciliations and offset excess funding as it is identified, and (3) offset amounts that accumulated before the implementation of these new processes. 87 PIH had not completed a reconciliation to determine the accumulations from July through September; however, historically, the reconciliations have identified overpayments; therefore, it is likely that additional amounts accumulated during this period. 88 Treasury Financial Manual, Vol. 1, Part 4A, Section 2045.10, Cash Advances Establishing Procedure for Cash Advances, section 3, states, “It is the responsibility of grantor agencies to monitor the cash management practices of their recipient organizations to ensure that Federal cash is not maintained by them in excess of immediate disbursing needs. Agencies must establish systems and procedures to assure that balances are maintained commensurate with immediate disbursing needs, excess balances are promptly returned to the Treasury; and advance funding arrangements with recipient organizations unwilling or unable to comply are terminated.” 89 Regulations at 2 CFR 200.305 state, “For non-Federal entities other than States, payments methods must minimize the time elapsing between the transfer of funds from the United States Treasury or the pass-through entity and the disbursement by the non-Federal entity.” The regulations further state, “Advance payments to a non-Federal entity must be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash requirements of the non-Federal entity in carrying out the purpose of the approved program or project.” 90 See finding 5 for more information on the manual process and system limitations. 91 $141.4 in excess funding for non-MTW provided from January to June and $26.924 million in excess funding provided to MTW PHAs from April to June 64 excess funding for non-MTW and MTW PHAs provided between January and June 2016 but had not offset it against future disbursements as of September 30, 2016. Completion of cash reconciliations to identify excess accumulations and the performance of offsets against future disbursements were delayed because it took a significant amount of time for PIH to determine how much PHAs spent and how much should be offset due to the manual nature of the process. Without an automated system that provides real-time expense information and automatically calculates offsets, the cash reconciliation process will continue to delay the completion of excess accumulation offsets. As discussed in finding 5, we previously recommended that PIH implement a system to automate the process. However, as of the date of this report, HUD had not provided an adequate management decision on how it planned to address this recommendation. This recommendation was referred to the Deputy Secretary for a decision on March 31, 2015. As of the end of fiscal year 2016, a decision had not been provided. MTW PHAs Held Excess Funds for Most of the Fiscal Year, and the Transition to HUD Reserves Was Not Complete Before fiscal year 2016, PIH transitioned precash management 92 accumulation from non-MTW PHAs; however, it had not transitioned any precash management accumulations from MTW PHAs. At the end of fiscal year 2015, PHAs reported that they were holding $466.5 million in Housing Choice Voucher program funds under the MTW program and $432.4 million as of March 31, 2016. PIH reviewed these balances to verify that PHAs reported correctly and planned to offset $251 million of the $432.4 million validated as excess funding. However, PIH could not offset the full amount in fiscal year 2016 and offset $218.2 million in August and September 2016. PHAs spent another $2.2 million, leaving $212 million in excess funds being held at the PHAs as of September 30, 2016. PIH also planned to offset $32.9 million in October, November, and December 2016, leaving a remaining balance of $179.2 million held at PHAs. 93 While this is an important step toward achieving compliance with Treasury’s cash management rules, HUD remained noncompliant because (1) the offsets could not be performed until August and September 2016, resulting in MTW PHAs holding excessive funding for most of the fiscal year, and (2) PIH did not transition the full amount it had identified as excess. Offsets totaling $218.1 million could not be performed until August and September 2016 because it took considerable time and effort to validate MTW PHA balances, which were self-reported because (1) HUD had not previously tracked these amounts and (2) MTW PHAs are allowed to comingle housing assistance payment funding with other MTW funds, making it difficult to determine excess Housing Choice Voucher program funding. PIH could not offset the full amount because (1) the original planned disbursements were not large enough to cover the full amount and (2) PHAs disputed that the remaining balance of $179.2 million could be offset. PHAs disputed $179.2 million of the balance they initially reported as of March 31, 2016, because they stated that they had upcoming expenses, owed money to other programs, or needed 92 PIH implemented cash management in 2013 using the policies noted in footnote 1. For MTW PHAs, PIH implemented the first step but had not offset excess funding that accumulated before the change in its disbursement policies. 93 At the time of this report, we could not confirm whether the offsets had been performed. 65 to keep a portion of the reserve based on the appropriation language. 94 While PIH stated that it did not agree that the appropriations language allowed PHAs to keep a portion of the reserve, it did not transition the full amount for PHAs that used this reasoning to contest the planned offset. Without a system to track expense information in real time, it is difficult for HUD to validate MTW excess funds and contested balances. Conclusion PIH’s Office of Housing Voucher programs had made significant progress in coming into compliance with Treasury’s cash management rules. However, since the cash management process is still primarily manual, PHAs maintained Federal cash in excess of their immediate disbursement need for extended periods. Specifically, MTW PHAs held between $432.4 million and $466.5 million in funds in excess of their immediate disbursement needs for most of the fiscal year and still held $212 million as of September 30, 2016. Further, PHAs accumulated $168.3 million from January to June 2016 and most likely accumulated additional funding from July through September, 95 none of which had been offset as of September 30, 2016. Since PHAs maintained these funds in excess of immediate disbursement need for extended periods, HUD did not comply with Treasury’s cash management regulations 96 or 2 CFR Part 200, 97 and funds remained at risk of fraud, waste, and abuse. Without an adequate system to perform the cash management process, HUD’s ability to identify and offset excess accumulations will continue to be delayed and be at risk for noncompliance with Treasury’s cash management rules. Recommendations Several prior-year recommendations regarding this finding for the Housing Choice Voucher program remained open and can be referred to in the Followup on Prior Audits section of this report. In addition to the prior-year findings, we have the following new recommendation. 94 In reference to the MTW agreements, the Consolidated Appropriations Act, 2016 (Public Law 11-113) stated, “…agreements shall prohibit any statutory offset of any reserve balances equal to 4 months of operating expenses. Any such reserve balances that exceed such amount shall remain available to any such agency for all permissible purposes under such agreement unless subject to statutory offset.” While PIH is “offsetting reserves,” these are not real offsets because the money is still available to the PHA; it is just maintained at HUD. The offsets in the appropriation language regard offsets in which the money is sent back to the Treasury. PIH agreed with this interpretation. 95 PIH had not completed a reconciliation to determine the accumulations from July through September; however, since the reconciliations reveal overpayments, it is likely that additional amounts accumulated during this period. 96 Treasury Financial Manual, Vol. 1, Part 4A, Section 2045.10, Cash Advances Establishing Procedure for Cash Advances, section 3, states, “It is the responsibility of grantor agencies to monitor the cash management practices of their recipient organizations to ensure that Federal cash is not maintained by them in excess of immediate disbursing needs. Agencies must establish systems and procedures to assure that balances are maintained commensurate with immediate disbursing needs, excess balances are promptly returned to the Treasury; and advance funding arrangements with recipient organizations unwilling or unable to comply are terminated.” 97 Regulations at 2 CFR 200.305 state, “For non-Federal entities other than States, payments methods must minimize the time elapsing between the transfer of funds from the United States Treasury or the pass-through entity and the disbursement by the non-Federal entity.” The regulations further state, “Advance payments to a non-Federal entity must be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash requirements of the non-Federal entity in carrying out the purpose of the approved program or project.” 66 We recommend that the Assistant Secretary for Public and Indian Housing 12A. Complete any outstanding validation reviews and transition back as much as $168.3 million in Housing Choice Voucher program funding from PHAs. 67 Finding 13: HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010 HUD OIG’s Improper Payments Elimination and Recovery Act (IPERA) audit 98 found that HUD did not comply with IPERA in fiscal year 2015 because it did not conduct its annual risk assessment in accordance with OMB guidance or meet its annual improper payment reduction target. Specifically, HUD did not assess all low-risk programs on a 3-year cycle or consider all nine required risk factors, making the review incomplete and noncompliant with section 3(a)(3)(B) of IPERA. HUD also failed to meet or exceed the annual improper payment reduction targets for its high-priority program, Rental Housing Assistance Programs (RHAP), causing noncompliance with section 3(a)(3)(E) of IPERA. This is the third year in a row that HUD did not comply with IPERA. Additionally, we found that information published in the agency financial report (AFR) did not meet the reporting requirements of OMB Circular A-136, significant improper payments in HUD’s RHAP continued, and HUD’s improper payment estimate and methodology for RHAP continued to have deficiencies during fiscal year 2015. HUD Did Not Perform Risk Assessments in Accordance With OMB Guidance HUD did not (1) assess all low-risk programs on a 3-year cycle and (2) consider all nine required risk factors. Beginning in 2006, OCFO determined that programs with expenditures of $40 million or less would be removed from the scope of the risk assessment because it did not believe any of HUD’s programs were susceptible to having an error rate in excess of 25 percent. 99 We identified two programs that had not had a risk assessment performed because their expenditures did not reach $40 million in a given year. We also identified one Ginnie Mae program that had never been assessed. Additionally, OCFO could not provide evidence that its risk assessment considered all of the required risk factors, and the risk assessment report was incomplete in documenting its consideration of five of the nine required risk factors. HUD Did Not Meet Its Fiscal Year 2015 Improper Payment Reduction Target on Its Rental Housing Assistance Programs For fiscal year 2015, HUD’s improper payment target rate for RHAP was 3.1 percent, but the improper payment rate realized was 4.01 percent. HUD’s continued inability to address the root causes of its RHAP improper payments and implementation of OIG’s previous audit recommendations remain the fundamental reason why it did not meet its fiscal year 2015 reduction targets. HUD’s Scope and Disclosure for Payment Recapture Audits Were Incomplete The scope and disclosure of HUD’s agencywide payment recapture audit plan were incomplete. Specifically, HUD lacked support to show that all of its programs and activities that spent $1 million or more during the fiscal year were either considered for payment recapture audits or 98 Audit Report 2016-FO-0005, Compliance With the Improper Payments Elimination and Recovery Act, issued May 13, 2016 99 25 percent of $40 million = $10 million 68 excluded based on cost-benefit considerations. In fiscal year 2015, HUD submitted its justification and cost-benefit analysis for the programs for which it determined a payment recapture audit would not be cost effective to OMB. The justification and cost-benefit analysis were incomplete because they were done on a program office level and not on an individual program and activity level as required. Additionally, HUD failed to disclose a complete list of the programs excluded from its payment recapture audit plan, along with its justification and analysis for excluding them, in its fiscal year 2015 AFR. This disclosure was required under OMB Circular A-123, appendix C, part I, section (D)(6). HUD’s Improper Payment Estimate and Reporting for Its High-Priority Program Remained a Concern HUD’s RHAP improper payment estimate reported in the fiscal year 2015 AFR may not be accurate. Specifically, our concerns were based on HUD’s incorrect billing error adjustment made in fiscal year 2015 and HUD’s continued reporting of a combined RHAP improper payment rate instead of separate improper payment rates for each of the three RHAP components. Both issues were repeat findings from previous audits. In response to one of our prior-year audit recommendations, HUD attempted in fiscal year 2015 to adjust the billing error for inflation, but HUD staff incorrectly adjusted it by only 1 year and used the incorrect percentage to make the adjustment. HUD continued to report a combined improper payment rate for the three components of RHAP in the AFR, which may have masked increases in the improper payment rate for one or more of the components. OMB Circular A-123, appendix C, prohibits agencies from grouping programs or activities in a way that masks significant improper payment rates. We have reported on this issue in prior audit reports. Recommendations to separate the rates by program remained unimplemented. HUD Did Not Fully Comply With Reporting Requirements HUD’s reporting for supplemental measures, corrective actions, accountability, and the root cause category matrix in its fiscal year 2015 AFR did not fully comply with the reporting requirements of OMB Circular A-136. Additionally, HUD did not identify or report high-dollar overpayments for RHAP in compliance with Executive Order 13520. This noncompliance occurred because HUD was in the process of addressing our prior-year audit recommendations regarding the reporting of improper payments for deceased tenants, accountability, supplemental measures, and corrective actions. Additionally, HUD did not keep up with changes in OMB guidance regarding the reporting of high-dollar overpayments. These conditions occurred because although OCFO developed and implemented the “IPERIA AFR Requirements Checklist” to help ensure that improper payment reporting in the fiscal year 2015 AFR was complete and complied with OMB Circular A-136 requirements, there were issues with the implementation of the checklist. Additionally, HUD was in the process of determining how it would obtain the information necessary to report on high-dollar overpayments for RHAP. Significant Improper Payments in Rental Housing Assistance Programs Continued An improper payment is any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable 69 requirements. HUD’s RHAP, consisting of (1) Public Housing Operating Subsidy, (2) Section 8 Housing Choice Voucher and Modern Rehabilitation, and (3) multifamily owner-administered project-based programs, continued to report significant amounts of improper payments. OMB Circular A-123, appendix C, 100 defines significant improper payments as gross annual improper payments in the program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year reported or (2) $100 million (regardless of the improper payment percentage of total program outlays). HUD’s most recent contracted quality control study 101 for fiscal year 2015 estimated that program administrator error contributed to gross improper payments of $183.3 million in public housing, $400.8 million in Section 8 Housing Choice Voucher and Modern Rehabilitation, and $163.8 million in multifamily owner-administered project-based programs. Improper payments due to tenants’ intentionally not reporting income amounted to $155.8 million in Public Housing Operating Subsidy, $243.2 million in Section 8 Housing Choice Voucher and Modern Rehabilitation, and $145.4 million in multifamily owner-administered project-based programs. HUD also performed billing studies in fiscal year 2016 and estimated that improper payments due to billing errors were $270.7 million for its multifamily owner-administered project-based programs and $138.9 million in its PHA-administered programs, including public housing and Section 8 Housing Choice Voucher and Modern Rehabilitation. In total, HUD made an estimated $1.7 billion in improper payments during fiscal year 2015. Conclusion HUD did not comply with IPERA for fiscal year 2015 because it did not (1) conduct its annual risk assessment in accordance with OMB guidance and (2) meet its annual improper payment reduction target. Additionally, HUD’s reporting on improper payments did not comply with reporting requirements. As a result, HUD officials and other users of the AFR, including Congress and OMB, did not have a complete and accurate picture of HUD’s improper payments and recovery efforts for use in policy-making decisions. If HUD does not address its noncompliance with IPERA, it will continue to miss opportunities to prevent, identify, and recover improper payments. Recommendations Recommendations were included in a separate OIG audit report. Therefore, no recommendations are reported here. 100 Requirements for Effective Estimation and Remediation of Improper Payments 101 FY [fiscal year] 2015 Quality Control for Rental Assistance Subsidy Determinations, issued August 31, 2016. This report was produced for HUD by ICF International. The study was based on analyses of a statistical sample of tenant files, tenant interviews, and third-party documents verifying income. 70 Scope and Methodology We are required by the Chief Financial Officers Act of 1990, as amended by the Government Management Reform Act of 1994 and implemented by OMB Bulletin 15-02, Audit Requirements for Federal Financial Statements, to audit HUD’s principal financial statements, which consist of the consolidated balance sheets as of September 30, 2016 and 2015 (restated); the related consolidated statements of net cost, changes in net position, and combined statement of budgetary resources for the fiscal years then ended; and the related notes to the financial statements. We considered internal controls over financial reporting by obtaining an understanding of the design of HUD’s internal controls, determined whether these internal controls had been placed into operation, assessed control risk, and performed tests of controls to determine our auditing procedures for the purpose of expressing an opinion on the principal financial statements. We also evaluated the internal controls in place at HUD’s FSSP, ARC, to determine whether the FSSP’s internal controls could be relied upon. We tested compliance with selected provisions of applicable laws, regulations, and government policies that may materially affect the consolidated principal financial statements. The tests performed were not to provide assurance on these internal controls, and, accordingly, we do not provide assurance or an opinion on such controls. We did not evaluate the internal controls relevant to operating objectives as broadly defined by FMFIA. We limited our internal controls testing to those controls that are material in relation to HUD’s financial statements. Because of limitations inherent in any internal control structure, misstatements may occur and not be detected. We also caution that projection of any evaluation of the structure to future periods is subject to the risk that controls may become inadequate because of changes in conditions or that the effectiveness of the design and operation of policies and procedures may deteriorate. Our consideration of the internal controls over financial reporting would not necessarily disclose all matters in the internal controls over financial reporting that might be significant deficiencies. We noted certain matters in the internal control structure and its operation that we considered to be significant deficiencies under OMB Bulletin 15-02. We considered HUD’s internal controls over required supplementary stewardship information reported in HUD’s fiscal year 2016 AFR by obtaining an understanding of the design of HUD’s internal controls, determined whether these internal controls had been placed into operation, assessed control risk, and performed limited testing procedures as required by the American Institute of Certified Public Accountants and U.S. Auditing Standards, AU-C, Section 730, Required Supplementary Information. The tests performed were not to provide assurance on these internal controls, and, accordingly, we do not provide assurance or an opinion on such controls. With respect to internal controls related to performance measures to be reported in management’s discussion and analysis and HUD’s fiscal year 2016 AFR, we obtained an 71 understanding of the design of significant internal controls relating to the existence and completeness assertions. We performed limited testing procedures as required by AU-C, Section 730, Required Supplementary Information, and OMB Bulletin 15-02, Audit Requirements for Federal Financial Statements. Our procedures were not designed to provide assurance on internal controls over reported performance measures, and, accordingly, we do not provide an opinion on such controls. To fulfill these responsibilities, we • Examined, on a test basis, evidence supporting the amounts and disclosures in the consolidated principal financial statements; • Assessed the accounting principles used and the significant estimates made by management; • Evaluated the overall presentation of the consolidated principal financial statements; • Obtained an understanding of internal controls over financial reporting (including safeguarding assets) and compliance with laws and regulations (including the execution of transactions in accordance with budget authority); • Tested and evaluated the design and operating effectiveness of relevant internal controls over significant cycles, classes of transactions, and account balances; • Tested HUD’s compliance with certain provisions of laws and regulations; governmentwide policies, noncompliance with which could have a direct and material effect on the determination of financial statement amounts; and certain other laws and regulations specified in OMB Bulletin 15-02, including the requirements referred to in FMFIA; • Considered compliance with the process required by FMFIA for evaluating and reporting on internal controls and accounting systems; and • Performed other procedures we considered necessary in the circumstances. Under standards issued by the American Institute of Certified Public Accountants, a deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis. A significant deficiency is a deficiency or a combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. A material weakness is a deficiency or combination of deficiencies in internal controls, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis. Our work was performed in accordance with generally accepted government auditing standards and OMB Bulletin 15-02. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 72 Followup on Prior Audits Not included in the recommendations listed after each finding are recommendations from prior- year reports on HUD’s financial statements that have not been fully implemented based on the status reported in the Audit Resolution and Corrective Action Tracking System. Specifically, we identified 93 unimplemented recommendations from prior-year reports, dating back to the audit of the fiscal years 2010 and 2009 financial statements. Fifty-six of the unimplemented recommendations were overdue for final action as of the date of this report (17 recommendations did not have final action target dates because an agreed-upon action plan had not been determined at the time of this report). Each of these open recommendations and its status is shown below. Followup on prior audits Audit Program Final action target report- Open recommendations office date rec # Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, 2016-FO- 0003 2016- Evaluate the IHBG investment process and FO- OCFO implement a proper accounting treatment in N/A 0003- accordance with Federal GAAP. 002-A Work with the Office of Native American 2016- Programs to calculate the amounts advanced to FO- OCFO grantees and restate HUD’s financial statements to N/A 0003- recognize the prepayments on the financial 002-B statements. Develop standard operating procedures for 2016- routinely obtaining information on grantee FO- OCFO investment activity and accurately reporting N/A 0003- amounts in HUD’s general ledger and financial 002-C statements. 2016- Establish a process to track the amount HUD owes FO- to PHAs to cover prepayment shortages and PIH N/A 0003- provide the information to OCFO so that it can be 002-D properly recognized as accounts payable. 2016- Develop a tracking function for the payments FO- advanced to IHBG recipients to facilitate financial PIH N/A 0003- reporting and monitoring compliance with grant 002-E time restrictions. 73 2016- Assign adequate resources to identify and resolve FO- Ginnie incorrect transactions in GFAS so that the system 3/21/2-17 0003- Mae can be used for reliable financial reporting of 004-A Ginnie Mae’s budgetary resources. 2016- FO- Ginnie Promptly complete all reconciliation processes to 3/21/2-17 0003- Mae determine the root causes of incorrect balances. 004-B Based on root causes identified, make necessary 2016- adjustments to the system configurations in GFAS FO- Ginnie to ensure proper and accurate budgetary resource 3/21/2-17 0003- Mae reporting that complies with FFMIA and OMB A- 004-C 11. 2016- Review user roles in GFAS and assign additional FO- Ginnie staff to ensure that proper segregation of duties is 3/21/2-17 0003- Mae maintained. 004-D Evaluate the weaknesses identified by NAPA, as 2016- well as OCFO’s disagreement with those FO- OCFO weaknesses and recommendations, and identify 7/31/2018 0003- what corrective actions will be taken and when 006-A those actions will be taken. Develop a process to ensure that issues and recommendations from all evaluations and audits, including those performed by third parties like 2016- NAPA, are adequately documented and tracked FO- and properly evaluated by senior management to OCFO N/A 0003- ensure that HUD’s FMFIA structure remains 006-B compliant. HUD should also ensure that corrective actions are agreed upon and responsibility for implementing corrective actions is appropriately delegated. Develop procedures to provide oversight of OCPO 2016- procurement activities to ensure that those with FO- OCFO financial accounting and reporting impact are N/A 0003- properly captured and reflected in HUD’s 006-C financial statements. 2016- Review projects and acquisitions to determine FO- whether the proper accounting treatment was OCFO N/A 0003- applied and determine whether corrections to 006-D HUD’s financial statements are needed. 74 Contact all other HUD program offices to determine whether any other programs authorize 2016- or are aware of grantees holding funds in advance FO- OCFO of their immediate disbursement needs and N/A 0003- determine financial statement impact on and 006-E compliance with Treasury cash management requirements of any found. 2016- Distribute the workload among available FO- accountants when staff is unavailable to ensure OCFO 8/31/2016 0003- that all cash reconciliations are performed in a 006-F timely manner. Ensure that standard operating procedures for IGT activity are updated, to include reconciling IGT balances for all transactions required by the 2016- Federal Intragovernmental Transactions FO- OCFO Accounting Policies Guide included in the 8/31/2016 0003- Treasury Financial Manual 2-4700. HUD should 006-G also include procedures to promptly reconcile, research, and resolve differences identified in the Treasury quarterly scorecard. Provide training on IGT reporting to ensure that 2016- responsible staff is sufficiently trained to allow FO- OCFO reconciliations to be promptly performed and N/A 0003- differences identified to be identified, researched, 006-H and resolved in a timely manner. Ensure that the agency’s key IGT point of contact 2016- is responsible for overseeing and coordinating FO- OCFO efforts with component entities to ensure that N/A 0003- Treasury quarterly scorecard differences are 006-I promptly researched and resolved. Revise policies and procedures to ensure that MCRs are routinely monitored and completed for 2016- all program areas and establish a timeframe for FO- OCFO completion of the MCR reports. Further, HUD 3/17/2017 0003- should ensure that an escalation process is 006-J included to address untimely completion of the MCR process. Develop policies and procedures to ensure that any data changes and accounting adjustments 2016- processed by OCFO Systems staff that impact the FO- general ledger are sufficiently documented, OCFO N/A 0003- identifying a description of the event, the 007-A preparers of the adjustment, the approving officials of the adjustment, and dates when adjustments occurred. 75 Close out and deobligate the remaining balances on 2,308 expired homeless assistance contracts of $104,347,996. HUD should also deobligate 2016- $3,602,342 in 102 program obligations marked for FO- deobligation during the departmentwide open CPD 3/16/2017 0003- obligations review. Lastly, HUD should review 008-A the 57 obligations with remaining balances of $188,176 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Develop and implement a monitoring plan to review outstanding disaster grant activity to ensure that the expenditure rates are consistently 2016- tracked and evaluated and that there are specific FO- CPD criteria to identify slow-moving projects. The N/A 0003- procedures should include a process to follow up 008-C and recommend corrective actions for the slow- moving projects identified, to include recapturing funds if necessary. Design and implement a policy to ensure that reconciliations of expenditure activity between HUD’s financial management systems and DRGR 2016- [Disaster Recovery Grant Reporting system] are FO- CPD periodically performed for all active disaster grant N/A 0003- balances to ensure that expenditure activity is 008-D accurate in DRGR. The policy should also include procedures for followup and resolution of identified differences. Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $19,634,263 in 209 2016- administrative obligations and $2,224,807 in 24 FO- program obligations marked for deobligation as of Housing 3/9/2017 0003- September 30, 2015. Additionally, HUD should 008-E review the 225 obligations with remaining balances of $285,024 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Review and if necessary deobligate the 228, 477, 2016- and 29 expired or inactive project-based Section 8, FO- Housing Section 235-236, and Section 202-811 projects 2/3/2017 0003- totaling $52.5 million, $36.2 million, and $1.3 008-F million, respectively. 76 Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $430,942 in 44 2016- administrative obligations and $135,957 in 2 FO- program obligations marked for deobligation as of OCIO 12/31/2016 0003- September 30, 2015. Additionally, HUD should 008-H review the 17 obligations with remaining balances of $1,486,191 and close out and deobligate amounts tied to obligations that are no longer valid or needed. 2016- Review the 216 obligations with remaining FO- balances totaling $1,506,233 and close out and CAO 5/21/2017 0003- deobligate amounts tied to obligations that are no 008-J longer valid or needed. 2016- Deobligate $140,165 in 41 administrative and FO- $125,166 in 3 program obligations marked for FHEO 12/8/2016 0003- deobligation during the departmentwide open 008-K obligations review. 2016- Review the 20 obligations with remaining FO- balances of $77,807 and close out and deobligate EEO 3/22/2017 0003- amounts tied to obligations that are no longer 008-L valid or needed. 2016- Review the seven administration obligations with FO- remaining balances of $115,035 and close out and OCFO 3/18/2017 0003- deobligate amounts tied to obligations that are no 008-N longer valid or needed. 2016- Deobligate the $587,198 in eight administrative FO- Ginnie obligations marked for deobligation during the 3/21/2017 0003- Mae departmentwide open obligations review. 008-O 2016- Implement a payment recapture audit for the FO- HOME program, specifically to identify and OCFO N/A 0003- recapture improper payments made as a result of 012-A the continued use of the cumulative method. Include the HOME program in the next annual 2016- improper payment risk assessment and ensure that FO- the impact of the cumulative method to meet OCFO N/A 0003- commitment deadlines is included in the risk 012-B assessment process to evaluate the susceptibility to significant improper payments 2016- Complete any outstanding validation reviews and FO- PIH transition back as much as $466.5 million in 9/30/2021 0003- Housing Choice Voucher program funding from 013-A 77 MTW PHAs and $41 million from non-MTW PHAs. Interim Report on HUD’s Internal Controls Over Financial Reporting, 2015-FO-0002 Continue to work with CPD’s information 2015- technology services contractor and OCFO to FO- ensure that all three phases of the plan to bring CPD 1/31/2017 0002- IDIS into compliance with GAAP and applicable 001-A Federal system requirements are completed as scheduled. 2015- Reinstate cash reconciliations as soon as possible FO- and transition as much as $423 million that PIH 12/31/2038 0002- accumulated in PHA NRAs during fiscal year 002-B 2014. 2015- Reclassify prepayments to accounts receivable FO- once PIH determines the amount of the OCFO 8/1/2016 0002- prepayment that PIH cannot offset because PHAs 002-H have insufficient funds. 2015- Validate grants payable estimates and any FO- CPD assumptions used to produce the estimates against 9/30/2017 0002- subsequent grantee reporting. 003-F Incorporate into their grants payable accrual 2015- estimation methodologies steps to appropriately FO- CPD validate grant accrual estimates and assumptions 10/2/2015 0002- used to produce the estimates against subsequent 003-G grantee reporting. Work with the Office of Multifamily Housing 2015- Programs to evaluate its obligation process for the FO- OCFO Section 8 project-based program to ensure that it 8/31/2016 0002- complies with HUD, OMB, and GAO legal 005-C requirements to have a legal point of obligation. Work with OCFO to revise the funds control plans 2015- for the Section 8 project-based programs to ensure FO- Housing that the obligation process in place is sufficient to 5/6/2016 0002- support a legally binding point of obligation and is 005-E reviewed and authorized by designated officials. 2015- Review the status of the 2,743 expired contracts, FO- which make up the $119.9 million in Homeless CPD 3/16/2016 0002- Assistance funds; close out the contracts; and 006-A recapture the excess funds. 78 Deobligate $174,168 in 5 administrative obligations and $9,920,926 in 308 program 2015- obligations marked for deobligation during the FO- departmentwide open obligations review. CPD 10/1/2015 0002- Additionally, review the 72 obligations with 006-B remaining balances totaling $313,419 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $4,988,326 in 613 2015- administrative obligations and $6,395,922 in 79 FO- program obligations marked for deobligation as of Housing 3/23/2016 0002- September 29, 2014. Additionally, review the 269 006-E obligations with remaining balances totaling $19,624,446 and close out and deobligate amounts tied to obligations that are no longer valid or needed. 2015- Deobligate the 76 expired or inactive Sections 202 FO- Housing and 811 and project-based Section 8 projects 3/4/2016 0002- totaling $3,458,166. 006-F Deobligate all obligations marked for deobligation during the departmentwide open obligations review, including as much as $3,561,042 in 64 2015- administrative obligations marked for deobligation FO- OCIO as of September 29, 2014. Additionally, review 3/6/2016 0002- the 171 obligations with remaining balances 006-J totaling $19,730,791 and close out and deobligate amounts tied to obligations that are no longer valid or needed. Deobligate $89,237 in 46 administrative obligations marked for deobligation during the 2015- departmentwide open obligations review. FO- CAO Additionally, review the 199 obligations with 7/17/2016 0002- remaining balances totaling $4,146,234 and close 006-O out and deobligate amounts tied to obligations that are no longer valid or needed. Deobligate $785 in one administrative obligation marked for deobligation during the 2015- departmentwide open obligations review. FO- OCFO Additionally, review the six obligations with 4/29/2016 0002- remaining balances totaling $332,888 and close 006-S out and deobligate amounts tied to obligations that are no longer valid or needed. 79 Deobligate $5,210 in two administrative obligations and $109,500 in one program 2015- obligation marked for deobligation during the FO- departmentwide open obligations review. FHEO 12/16/2015 0002- Additionally, review the 17 obligations with 006-U remaining balances totaling $26,711 and close out and deobligate amounts tied to obligations that are no longer valid or needed. 2015- Periodically reconcile balances with OCIO FO- OCFO subsidiary records and research and resolve any 3/31/2016 0002- identified differences. 007-D Increase efforts to quickly complete outstanding 2015- front-end risk assessments and coordinate with FO- CPD OCFO to finalize the review and approval process 4/8/2016 0002- even in the absence of policies and procedures 007-F with specific deadlines in this area. 2015- Develop a subsidiary system to accumulate the FO- capitalized cost and related depreciation expense CIO 3/31/2016 0002- for each software project under development or 007-I placed into production. 2015- Enhance communication to appropriately identify FO- Ginnie mixed systems and include them in the inventory 3/6/2016 0002- Mae of financial systems. 009-A 2015- Add the Integrated Pool Management System, FO- Ginnie Unclaimed Funds System, and Reporting and 3/6/2016 0002- Mae Feedback System to the inventory of FFMIA 009-B financial and mixed systems. 2015- FO- Implement a periodic review process to OCFO 4/8/2016 0002- independently evaluate system classifications. 009-C Additional Details To Supplement Our Report On HUD’s Fiscal Years 2013 and 2012 (Restated) Financial Statements, 2014-FO-0003 Develop and implement a detailed remediation action plan to ensure that grant management systems eliminate the FIFO methodology in its 2014- entirety. The plan should (1) explain how the FO- CPD budget fiscal year-TAFS for each accounting 9/30/2014 0003- transaction (project and activity setup, 001-A commitment, disbursement, etc.) will be recorded, remain constant, and be maintained, (2) reference Federal system requirements and criteria, and (3) 80 include resources, specific remedies, and intermediate target dates necessary to bring the financial management system into substantial compliance. 2014- Establish controls within the system, which FO- CPD provide an audit trail of the use of the funds by the 9/30/2014 0003- budget fiscal year-TAFS. 001-B Provide oversight of CPD’s system implementation or modification to ensure that Federal financial management accounting standards are embedded into the system so that the 2014- information transferred from grant management FO- OCFO systems to HUD’s core financial systems comply 10/30/2015 0003- with these standards, are recorded in HUD’s 001-C consolidated financial statements in accordance with Federal GAAP, and ensure that compliant administrative control of funds for its formula grant programs is established. 2014- Transition the PHA NRA excess funds, which are FO- as much as $643.6 million as of June 30, 2013, to PIH 12/31/2038 0003- HUD’s control as soon as possible to safeguard 002-A the program resources. 2014- Implement a cost-effective method for automating FO- the cash management process to include an PIH N/A 0003- electronic interface of transactions to the standard 002-C general ledger. Review the cash management process to identify 2014- all financial events to be recognized in accordance FO- OCFO with GAAP. Establish procedures to account for 4/8/2015 0003- the cash management activity in a timely manner 002-E in compliance with GAAP. 2014- Ensure that PIH’s automation of its cash FO- OCFO management process complies with Federal 12/31/2015 0003- financial management requirements. 002-G 81 Design and Implement a loan guarantee system that complies with the Guaranteed Loan System 2014- Requirements. Ensure that the implemented loan FO- OCFO guarantee system should be integrated with 12/31/2015 0003- HUD’s financial management systems and be 003-A included in its financial management system plans. Establish an appropriate accounting and financial 2014- reporting governance structure within OCFO with FO- the appropriate level of accounting, experience, OCFO 3/11/2015 0003- and training to support the size and complexity of 004-G HUD’s and its component entities’ financial reporting requirements. 2014- Enforce already existing internal control FO- OCFO procedures to ensure proper supervision over 10/1/2014 0003- accounting for Section 8 FAF receivables. 006-C Perform a thorough analysis of outstanding FAF 2014- receivables and fiscal year 2013 collections to FO- ensure that the receivables accurately represent the OCFO 3/4/2015 0003- amounts owed to HUD, including but not limited 006-D to positive confirmations of outstanding receivable balances with the trustees. 2014- Review the status of these 1,855 expired contracts, FO- CPD which make up $50.9 million; close out the 9/30/2016 0003- contracts; and recapture the excess funds. 008-A 2014- Complete the closeout of any remaining CDBG-R FO- CPD and HPRP grants and forward all grant closeout 9/30/2014 0003- agreement certifications to OCFO for recapture. 008-B Deobligate $14,425,629 tied to 238 program obligations marked for deobligation during the 2014- departmentwide unliquidated obligations review. FO- CPD Additionally, OCFO should review the 93 4/3/2015 0003- obligations with remaining balances totaling 008-C $316,935 and close out and deobligate amounts tied to obligations that are no longer valid. 82 Deobligate $12,755,325 tied to 165 administrative obligations and $2,734,967 tied to 25 program obligations marked for deobligation during the 2014- departmentwide unliquidated obligations review. FO- Housing Additionally, the Office of Housing should review 4/2/2015 0003- the 429 obligations with remaining balances 008-D totaling $5,764,905 and close out and deobligate amounts tied to obligations that are no longer valid. 2014- Research and deobligate at least $9.3 million tied FO- Housing to the 115 inactive and/or expired Section 202/811 4/2/2015 0003- funding lines. 008-E 2014- FO- Review and deobligate at least $26 million tied to Housing 4/2/2015 0003- 215 inactive and/or expired Section 8 obligations. 008-F Deobligate the $1,419 tied to three administrative obligations marked for deobligation during the 2014- departmentwide unliquidated obligations review. FO- OCFO Additionally, OCFO should review the 42 12/31/2014 0003- obligations with remaining balances totaling 008-K $3,115,954 and close out and deobligate amounts tied to obligations that are no longer valid. Design and implement a policy to ensure that reconciliations between the subsidiary ledgers (supporting records) and the obligation balances in 2014- the general ledger (controlling accounts) are FO- OCFO periodically performed for all HUD 4/1/2015 0003- appropriations. The policy should also address the 008-M follow-up and clearance of identified differences and the responsibilities for the preparers and reviewers. Work with the program offices to determine the ARRA funds that were not spent by September 2014- 30, 2013; implement the manual process FO- identified; and recapture, to the extent permitted OCFO 10/17/2014 0003- by law, the unspent ARRA funds and return them 008-N to Treasury, including at least $4.7 million and $2.6 million in unspent grant funds for the CDBG- R and HPRP programs, respectively. 2014- Deobligate $7,263,662 tied to 178 administrative FO- OCIO obligations marked for deobligation during the 2/13/2015 0003- departmentwide unliquidated obligations review. 008-O 83 Develop and implement procedures to routinely 2014- evaluate the assistance and administrative FO- obligation balances for the HUD-administered and PD&R 4/6/2015 0003- SSS subcategories of EHLP to determine whether 011-E a valid need still exists and if not, deobligate those balances. Make changes to IDIS Online, which will require grantees to specifically identify the grant 2014- allocation year to which the commitment should FO- be assigned and include the commitment dates. CPD 10/30/2015 0003- The system should also allow HUD to ensure that 015-A commitments made during overlapping allocations and periods are counted toward only 1 year’s compliance requirements. Stop using the cumulative method and the 2014- deadline compliance report for determining FO- compliance with the 24-month commitment CPD 10/30/2015 0003- requirement in the HOME Investment Partnership 015-B Act and use only the commitment made within the 24-month period to determine compliance. In accordance, with the GAO legal decision and 2014- opinion, take steps to identify and recapture funds FO- CPD that remain uncommitted after the statutory 10/30/2015 0003- commitment deadline and reallocate such funds in 015-C accordance with the Act. 2014- Recapture funds from allocations during the 24- FO- month overlapping period only for grantees that CPD 10/30/2015 0003- do not comply with the 24-month commitment 015-D requirement. Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and 2011 Financial Statements, 2013-FO-0003 Develop and implement formal financial 2013- management policies and procedures to require an FO- annual evaluation by OCFO and applicable OCFO 11/29/2013 0003- program offices of all allowance for loss rates and 003-C other significant estimates currently in use to ensure appropriateness. Develop internal controls to review field office compliance more frequent than every 4 years, 2013- especially when findings have been identified in FO- CPD the past, and to ensure that action plans operate 3/31/2016 0003- effectively and have addressed the deficiencies 004-B noted so that noncompliance is not repeated during the next quality management review. 84 2013- Review the status of these expired contracts, FO- which make up the $50.6 million, and recapture CPD 10/18/2013 0003- excess funds for the contracts that have not been 006-A granted extensions. 2013- Review the 270 obligations with remaining FO- balances totaling $432,147 and close out and CPD 9/30/2014 0003- deobligate amounts tied to obligations that are no 006-B longer valid or needed. Additional Details To Supplement Our Report on HUD’s Fiscal Years 2011 and 2010 Financial Statements, 2012-FO-0003 Review the status of each of its homeless 2012- assistance contracts that make up the $32 million FO- CPD OIG identified as excess funding and recapture 2/6/2013 0003- excess funds for expired contracts, which have not 002-B been granted extension. The Office of Housing report on income discrepancies at the 100 percent threshold level as a supplemental measure; assign staff to review the deceased single-member household and income 2012- discrepancy reports at least quarterly and follow FO- up with owners and management agents (O-A) Housing 4/30/2016 0003- listed on these reports; and include in the contract 005-B between HUD and O-As a provision for improper payments that requires O-and resolve in a timely manner income discrepancies, failed identity verifications, and cases of deceased single- member households. Additional Details to Supplement Our Report on HUD’s Fiscal Years 2010 and 2009 Financial Statements, 2011-FO-0003 2011- Cease the changes being made to IDIS for the FO- HOME program related to the FIFO rules until the CPD 6/15/2015 0003- cumulative effect of using FIFO can be quantified 001-A on the financial statements. 2011- Change IDIS so that the budget fiscal year source FO- CPD is identified and attached to each activity from the 6/15/2015 0003- point of obligation to disbursement. 001-B Cease the use of FIFO to allocate funds (fund 2011- activities) within IDIS and disburse grant FO- payments. Match outlays for activity CPD 6/15/2015 0003- disbursements to the obligation and budget fiscal 001-C source year in which the obligation was incurred, and in addition, match the allocation of funds 85 (activity funding) to the budget fiscal year source of the obligation. Include as part of the annual CAPER [consolidated annual performance and evaluation 2011- report], a reconciliation of HUD's grant FO- CPD management system, IDIS, to grantee financial 6/15/2015 0003- accounting records on an individual annual grant 001-D basis, not cumulatively, for each annual grant awarded to the grantee. Review the 510 obligations which were not 2011- distributed to the program offices during the open FO- obligations review and deobligate amounts tied to OCFO 10/31/2011 0003- closed or inactive projects, including the $27.5 002-C million we identified during our review as expired or inactive. Review the status of each of its Homeless 2011- Assistance contracts that makes up the $97.8 FO- CPD million OIG identified as excess funding and 3/16/2012 0003- recapture excess funds for expired contracts, 004-A which have not been granted extensions. 86 Appendixes Appendix A Schedule of Funds To Be Put to Better Use Recommendation Funds to be put to number better use1 8A $162,715,936 8B 17,986,109 8E 6,966,585 8F 21,710,718 8G 34,720,56 8H 83,501 8I 360,907 8J 152,211 8K 619,322 8L 85,782 8Q 86,987,505 12A 168,300,000 Totals 500,689,142 1/ Recommendations that funds be put to better use are estimates of amounts that could be used more efficiently if an OIG recommendation is implemented. These amounts include reductions in outlays, deobligation of funds, withdrawal of interest, costs not incurred by implementing recommended improvements, avoidance of unnecessary expenditures noted in preaward reviews, and any other savings that are specifically identified. 87 Appendix B Departmentwide Obligation Review – Schedule of Recommended Deobligations HUD’s departmentwide unliquidated obligation review – invalid obligations identified by HUD but not deobligated as of 9/30/16 Administrative Program Total Program office obligations obligations # $ # $ # $ Housing 307 18,290,686 202 3,420,032 509 21,710,718 CPD 234 10,996,784 234 10,996,784 FHEO 27 384,703 6 234,619 33 619,322 Ginnie Mae 3 587,505 3 587,505 OCHCO 125 360,907 125 360,907 Admin 108 152,211 108 152,211 FP 5 85,782 5 85,782 OCIO 124 83,501 124 83,501 Total 102 699 19,945,295 442 14,651,435 1,141 34,596,730 * Immaterial differences in totals due to rounding OCHCO – Office of the Chief Human Capital Officer FHEO – Office of Fair Housing and Equal Opportunity DEEO – Office of Departmental Equal Employment Opportunity PD&R – Office of Policy Development and Research 102 Differences due to rounding 88 Appendix C Federal Financial Management Improvement Act Noncompliance, Responsible Program Offices, and Recommended Remedial Actions This appendix provides details required under FFMIA reporting requirements. We noted instances in which HUD’s systems did not substantially comply with FFMIA requirements. Specifically, we noted instances of substantial noncompliance with (1) Federal financial system requirements, (2) Federal accounting standards, and (3) the USSGL at the transaction level. The details about non-FFMIA-compliant systems, responsible parties, primary causes, and HUD’s intended remedial actions are included in the following sections. Systems That Do Not Comply With Federal Financial Systems Requirements New Core Interface Solution NCIS does not comply with Federal financial system requirements. Specifically, NCIS does not capture or record required general ledger account transaction information to enable traceability between program accounts and the general ledger. NCIS is a custom-developed system owned by HUD and hosted by Oracle Managed Cloud Services. NCIS performs the extract, transform, and load functions as well as a variety of error- processing, reconciliation, and interface file management functions to support the interface of HUD systems with ARC’s systems. OCFO is responsible for NCIS. While NCIS is a key interchange between legacy systems and ARC’s Oracle Federal Financials, it is not a long-term interface solution, and HUD can compensate for existing weaknesses with efforts to establish and improve manual reconciliation procedures. HUD Procurement System, Small Purchase System, and HUD Integrated Acquisition Management System As of September 30, 2016, HUD reported that three OCPO procurement systems, HPS, SPS, and HIAMS, were not substantially compliant with FFMIA. These systems have been replaced; however, OCPO needs to perform procurement closeout actions in HPS and HIAMS and validate SPS data before decommissioning. HUD hopes to complete decommissioning for these three systems during fiscal year 2017. Systems That Do Not Comply With Federal Accounting Standards and the U.S. Standard General Ledger Integrated Disbursement and Information System Online The IDIS system does not comply with applicable Federal accounting standards or the USSGL at the transaction level. IDIS is in noncompliance because the system is configured to account for grants using the attribution methodology known as FIFO. While CPD had made progress in addressing this issue, updating the IDIS application to specifically identify grants initiated during 2015 and going forward, funding constraints delayed further remediation and FFMIA compliance. CPD is responsible for IDIS. 89 We previously recommended that HUD modify IDIS to account for grant disbursements by the specific identification method and configure the system to record transactions in compliance with the USSGL. CPD has eliminated the FIFO method of funds attribution from the IDIS Online system for fiscal year 2015 and future grants only. The FIFO method will continue to be used for fiscal year 2014 grants and earlier. Additional changes need to be made to the IDIS system to remediate IDIS’ FFMIA noncompliance. Systems That Do Not Comply With Financial System Requirements, Federal Accounting Standards, and the U.S. Standard General Ledger Ginnie Mae Financial and Accounting System We noted continuing noncompliance with the three elements of FFMIA within Ginnie Mae as of September 30, 2016. During our fiscal year 2014 audit of Ginnie Mae’s financial statements, we were unable to obtain sufficient, appropriate evidence to express an opinion on the fairness of $6.6 billion in nonpooled loan assets from Ginnie Mae’s defaulted issuers’ portfolio. We also noted four material weaknesses and recommendations to Ginnie Mae management. In addition, we noted weaknesses related to the budgetary accounting module of the GFAS application during the course of the 2015 financial statement audit and made recommendations to Ginnie Mae to address these weaknesses. Specifically, because of system configuration issues, large on-top adjustments were needed to reconcile budgetary balances. While progress had been made to remediate GFAS’ FFMIA noncompliance during fiscal year 2016, Ginnie Mae will need to address the remaining issues related to the budgetary accounting module and the four material weaknesses related to loan accounting. 90 Appendix D Auditee Comments and OIG’s Evaluation Ref to OIG Evaluation Auditee Comments Comment 1 Comment 2 Comment 2 Comment 3 91 Ref to OIG Evaluation Comment 4 Comment 5 Comment 6 Comment 7 Comment 8 92 Ref to OIG Evaluation Comment 9 Comment 10 Comment 11 Comment 12 Comment 13 Comment 14 Comment 15 Comment 16 93 94 OIG Evaluation of Agency Comments Comment 1 Progress was made on two material weaknesses, and a third was not resolved, but instead, consolidated with other new findings identified during fiscal year 2016. However, two new material weaknesses were identified during the course of the year, one of which contributed to HUD’s inability to timely complete and deliver final consolidated financial statements and accompanying notes. This material weaknesses could have been identified and remediated by management early in the fiscal year, allowing for the detection and prevention of the errors and issues identified by OIG at third quarter and possibly ensuring timely delivery of final consolidated financial statements and accompanying notes. Comment 2 This year, management disagreed with a number of preliminary assessments and OIG findings and recommendations that were identified and provided to OCFO early in the audit cycle. The primary basis of many of the disagreements cited OIG’s use of “best practice” standards or criteria that HUD believed was optional. HUD’s continued minimization and diminishment of issues throughout the course of the year resulted in inaction and a failure to escalate the need to remediate internal control weaknesses in a timely manner. Consequently, significant delays in the completion and delivery of final consolidated financial statements and accompanying notes occurred and as a result, OIG was compelled to issue a disclaimer of opinion on HUD’s 2016 and 2015 (restated) consolidated financial statements with a primary basis that OIG was unable to audit them in their entirety due to their untimely delivery. In addition, detailed comments regarding substantive and technical comments were not provided to OIG for consideration prior to the issuance of the final report. Comment 3 HUD generally agrees with our finding. While, we agree that implementing a new system and process are challenging and changes were needed, better governance, planning, and established financial management and accounting policy and procedures would have made the transition smoother. Even under the new environment, HUD is reliant on legacy systems and the process is even more complex than prior to the transition because information from the legacy systems must go through a new financial management system, NCIS. We believe that deficiencies cited require more substantive work than what is implied by “fine- tuning” since HUD was unable to timely deliver final consolidated financial statements and accompanying notes, resulting in OIG’s inability to audit them and a disclaimer of opinion. This is indicative of a fundamental problem with HUD’s control and reporting environment. 95 Comment 4 HUD generally agrees with our findings. While we agree that the most significant aspect of this material weaknesses was substantially resolved, there were still errors in its calculation of PIH prepayments and HUD did not properly reclassify amounts to be offset as accounts receivable. In addition, we noted several new deficiencies related to HUD’s accounting for property plant and equipment and non-FHA loan guarantees. Lastly, there has been no progress on the finding related to HUD’s grant accrual estimates and our inability to audit these balances remain. Comment 5 We documented that in July of 2016, HUD initiated an effort to resolve differences between the subsidiary records and general ledger. As consistent with the comment above, OCFO established a subledger project workgroup to resolve the differences with a completion date of September 30, 2016. Although the workgroup was conducting analysis to identify the cause of the reconciling differences and impact on the financial statements, the $29.38 billion balance was not resolved by fiscal year end. We concluded the potential impact of unresolved differences in the subledger and general ledger could be material to the financial statements as a whole. Despite HUD’s efforts and plans to have the differences resolved in the forthcoming months, this is outside the scope of the fiscal year 2016 audit i.e. the differences will not be resolved until fiscal year 2017. Therefore, as of the date of the internal control report, we conclude this finding exists with a potential material impact. We will continue to evaluate HUD’s progress with refining their reconciliation business model during the FY2017 CFS Audit. Comment 6 CPD has previously stated that it is not feasible to estimate and rectify any misaligned values in the financial statements for affected FY14 and prior year grant balances. As a result, CPD elected to remove the FIFO methodology for commitments and disbursements made from FY15 and future grants only. OIG will continue to report that the effects of not removing the FIFO method retroactively will continue to have implications on future years’ financial statement audit opinions until the impact is assessed to be immaterial. Comment 7 Management’s response implicitly reflects agreement with OIG finding 5; the need to resolve legacy system issues, implement systems to meet business needs, and continue to address issues related to the transition to the FSSP. Comment 8 While management did not directly address specific deficiencies, they noted the need for continued work to improve their financial governance structure, citing the establishment of the Financial Management Council as a key step. These efforts are aligned with the actions we have recommended this year and in prior years, including efforts to enhance internal controls and streamline operations. Comment 9 Although OIG noted some improvements in the ARC’s documentation for policies and procedures, the critical financial reporting elements of program code and program class were not transparent in the funds control documentation i.e Process Guidance to provide accountability to the financial system of record. The 96 interim funds control approach did not ensure accountability or traceability to the policies and procedures governing budget execution, obligations and expenditure of funds. The procedures identified in the Process Guidance did not provide traceability to the applicable funds or program office transactions and accountability to the responsible officials. Further, the lack of compliance reviews throughout fiscal year 2016 limited HUD’s ability to monitor and fully implement a complete administrative control of funds system that would ensure oversight of the agency’s obligations and disbursements. We noted compliance review procedures did not begin until August 2016, which did not allot the appropriate amount of time to identify inconsistencies. As of October 1, 2016, HUD did not complete their transition to the funds control matrices and were still operating under the interim funds control structure. HUD’s OCFO office issued a September 30, 2016 memorandum stating that there has been an extension for program offices to submit their matrices to OCFO for approval. OIG concluded that HUD did not make significant progress in completing the transition to the funds control matrix as of September 2016, which was the original completion date. We will continue to evaluate HUD’s progress with full implementation in fiscal year 2017 consolidated financial statement audit. Comment 10 HUD’s response to Finding 8 addresses OIG’s concerns; namely, that HUD will work to improve monitoring of unliquidated obligations. We will evaluate additional procedures and guidelines implemented as part of the fiscal year 2017 consolidated financial statement audit. Comment 11 We will review progress made in this area as part of our fiscal year 2017 audit work. Comment 12 While it doesn’t address the specific instances of FFMIA noncompliance, HUD’s response notes that ongoing development activities should help the department move towards resolving long-standing noncompliance. We will monitor these initiatives and provide timely feedback on the extent to which these projects meet HUD’s stated goals. Comment 13 The comments provided indicates that the continued use of the cumulative method for determining compliance with the HOME Statute was not an ADA violation. However, the noncompliance noted in this finding relates to noncompliance with the HOME Statute, and not ADA. This has been a long standing noncompliance issue which has not been remediated because CPD continues to use the cumulative method for determining compliance for fiscal year 2014 grants and prior. Therefore, noncompliance with the HOME Statute remains. 97 Comment 14 HUD has implemented tracking and monitoring tools, but due to the manual process and not tracking MTW advances in the past, it is still not in compliance with cash management. Comment 15 This finding was placeholder due to the untimely receipt of requested information from the Department. Since the issuance of the draft report, we have received the requested information and concluded that this finding would be removed from the report. Comment 16 Improvements in this area will be assessed as part of OIG’s annual audit of HUD’s compliance with the improper payments and elimination and recovery act of 2010, as amended. 98
Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit
Published by the Department of Housing and Urban Development, Office of Inspector General on 2016-11-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)