oversight

Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated) U.S. Department of Housing and Urban Development Financial Statement Audit

Published by the Department of Housing and Urban Development, Office of Inspector General on 2016-11-15.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

   Office of the Chief Financial Officer,
              Washington, DC
    Additional Details To Supplement Our Fiscal Years
   2016 and 2015 (Restated) U.S. Department of Housing
    and Urban Development Financial Statement Audit




Office of Audit, Financial Audits Division   Audit Report Number: 2017-FO-0003
Washington, DC                                               November 15, 2016
To:            Courtney Timberlake, Deputy Chief Financial Officer, F

                    /signed/
From:          Thomas McEnanly, Director, Financial Audits Division, Washington DC, GAF
Subject:       Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated)
               U.S. Department of Housing and Urban Development Financial Statement Audit




Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) additional details to supplement our audit of HUD’s internal controls over
financial reporting and compliance with applicable laws, regulations, and governmentwide
policy requirements and provisions of contracts and grant agreements.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG Web site. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
202-402-8216.
                    Audit Report Number: 2017-FO-0003
                    Date: November 15, 2016

                    Additional Details To Supplement Our Fiscal Years 2016 and 2015 (Restated)
                    U.S. Department of Housing and Urban Development Financial Statement
                    Audit


Highlights
What We Audited and Why
We are required to audit the consolidated financial statements of the U.S. Department of Housing
and Urban Development (HUD) annually in accordance with the Chief Financial Officers Act of
1990 as amended. This report supplements our independent auditor’s report on the results of our
audit of HUD’s principal financial statements for the fiscal years ending September 30, 2016 and
2015 (Restated) related to HUD’s internal controls and compliance with applicable laws,
regulations, and governmentwide policy requirements and provisions of contracts and grant
agreements.

What We Found
We issued a disclaimer of opinion on HUD’s consolidated financial statements for fiscal years
2016 and 2015 (restated) due to HUD’s inability to deliver principal financial statements for the
fiscal years ending September 30, 2016 and 2015 (Restated) and accompanying notes in a timely
manner. This report provides additional details on five material weaknesses, four significant
deficiencies, and four instances of noncompliance with applicable financial management laws
and regulations. Details of the results of our audit of HUD’s component entities, the Federal
Housing Administration and Government National Mortgage Association (Ginnie Mae), can be
found in separate audit reports.

Primarily, HUD (1) lacked adequate controls over its financial reporting preparation process, (2)
inadequately accounted for assets and liabilities in accordance with GAAP, (3) delayed
completion of significant reconciliations, (4) did not account for the Office of Community
Planning and Development’s formula grant programs’ commitments and disbursements in
accordance with GAAP, and (5) lacked adequate financial management systems to ensure
accurate and reliable financial reporting. These conditions were caused by (1) inadequate
monitoring and rushed implementation of the New Core Project and the transition to a Federal
shared service provider, (2) poor internal controls and oversight of Ginnie Mae’s financial
reporting, and (3) continued weaknesses in HUD’s financial management governance structure.


What We Recommend
We recommend that HUD (1) properly account for all financial transactions in accordance with
GAAP, (2) improve internal controls over the financial reporting process, (3) transition as much
as $168.3 million in excess funding from public housing agencies to HUD-held reserves, and (4)
deobligate $332.4 million in invalid or inactive obligations.
Table of Contents
Background and Objective......................................................................................3

Results of Audit ........................................................................................................4
         Material Weaknesses ........................................................................................................ 4
         Finding 1: Weak Internal Controls Over Financial Reporting Led to Errors and
         Delays in the Preparation of Financial Statements and Notes ...................................... 4
         Finding 2: HUD Assets and Liabilities Were Misstated and Not Adequately
         Supported......................................................................................................................... 11
         Finding 3: Significant Reconciliations Were Not Completed in a Timely Manner . 19
         Finding 4: CPD’s Formula Grant Accounting Did Not Comply With GAAP,
         Resulting in Misstatements on the Financial Statements ............................................ 25
         Finding 5: HUD’s Financial Management System Weaknesses Continued in 2016 28
         Significant Deficiencies ................................................................................................... 33
         Finding 6: HUD’s Financial Management Governance Was Ineffective ................. 33
         Finding 7: Weaknesses in HUD’s Administrative Control of Funds System
         Continued......................................................................................................................... 39
         Finding 8: HUD Continued To Report Significant Amounts of Invalid Obligations
         ........................................................................................................................................... 45
         Finding 9: HUD’s Computing Environment Controls Had Weaknesses ................. 52

Compliance With Laws and Regulations.............................................................58
         Finding 10: HUD’s Financial Management System Did Not Comply With the
         Federal Financial Management Improvement Act ...................................................... 59
         Finding 11: HUD Continued To Not Comply With the HOME Investment
         Partnership Act ............................................................................................................... 61
         Finding 12: HUD Did Not Comply With Treasury Financial Manual Rules on Cash
         Management or 2 CFR Part 200.................................................................................... 64
         Finding 13: HUD Did Not Comply With the Improper Payments Elimination and
         Recovery Act of 2010 ...................................................................................................... 68
Scope and Methodology .........................................................................................71

Followup on Prior Audits ......................................................................................73

Appendixes ..............................................................................................................87
               A. Schedule of Funds To Be Put to Better Use .................................................... 87
               B. Departmentwide Obligation Review – Schedule of Recommended
                  Deobligations ...................................................................................................... 88
               C. Federal Financial Management Improvement Act Noncompliance,
                  Responsible Program Offices, and Recommended Remedial Actions ......... 89
               D. Auditee Comments and OIG’s Evaluation ..................................................... 91
Background and Objective
We are required by the Chief Financial Officers Act of 1990, as amended by the Government
Management Reform Act of 1994 and implemented by Office of Management and Budget
(OMB) Bulletin 15-02, Audit Requirements for Federal Financial Statements, to audit the U.S.
Department of Housing and Urban Development’s (HUD) principal financial statements or select
an independent auditor to do so. The objective of our audit was to express an opinion on the fair
presentation of these principal financial statements.
In planning our audit of HUD’s principal financial statements, we considered internal controls
over financial reporting and tested compliance with selected provisions of applicable laws,
regulations, and government policies that may materially affect the consolidated principal
financial statements. Providing an opinion on internal controls or compliance with selected
provisions of laws, regulations, and government policies was not an objective, and, accordingly,
we do not express such an opinion.
Management is responsible for

•      Preparing the financial statements in conformity with accounting principles generally
       accepted in the United States of America;
•      Establishing, maintaining, and evaluating internal controls and systems to provide
       reasonable assurance that the broad objectives of the Federal Financial Management
       Improvement Act of 1996 (FFMIA) are met; and
•      Complying with applicable laws and regulations.

In auditing HUD’s principal financial statements, we were required by Government Auditing
Standards to obtain reasonable assurance about whether HUD’s principal financial statements
were presented fairly, in accordance with generally accepted accounting principles (GAAP), in
all material respects. We believe that our audit provides a reasonable basis for our disclaimer of
opinion.
This report is intended solely for the use of HUD management, OMB, and Congress. However,
this report is a matter of public record, and its distribution is not limited.




                                                 3
Results of Audit

Material Weaknesses


Finding 1: Weak Internal Controls Over Financial Reporting Led
to Errors and Delays in the Preparation of Financial Statements and
Notes
Internal controls over HUD’s financial reporting process were weak, hindering HUD’s ability to
deliver the yearend financial statements and accompanying notes in a timeframe that allowed for
sufficient OIG audit review. Additionally, Ginnie Mae closed material accounts prematurely.
Finally, HUD performed 2,868 journal vouchers to adjust transactional data in its general ledger,
primarily due to data quality issues. Ineffective governance over HUD’s transition to a Federal
Shared Service Provider (FSSP), Treasury’s Administrative Resource Center (ARC), and Ginnie
Mae’s budgetary accounting created an ineffective financial reporting environment that could not
prevent and detect errors in a timely manner. As a result, (1) we could not audit HUD’s yearend
financial statements and accompanying notes, (2) HUD’s fiscal year 2016 third quarter financial
statement notes contained unsupported balances and errors totaling $477 million, and (3) HUD
had to restate its fiscal year 2015 statement of budgetary resources due to an error with an
absolute value of $2 billion. Further, HUD’s extensive reliance on manual journal vouchers
increased the risk of error in its general ledger and financial statements.

HUD’s Year End Consolidated Financial Statements and Notes Were Not Available For
Audit
In fiscal year 2016, HUD transitioned to a FSSP, ARC, which included the migration of its
general ledger to Oracle Federal Financials and many of its financial reporting processes.
Although HUD worked with ARC prior to implementation, the financial reporting process was
never tested or documented to ensure that Oracle Federal Financials could produce HUD’s
consolidated financial statements and HUD proper notes within required timeframes, which lead
to delays in the delivery of final financial statements and notes.

Despite requests from OIG to provide first and second quarter financial statements and note
disclosures as a means of testing the process, HUD decided to delay preparing financial
statements and notes because they were not required to be reported to OMB until the third
quarter. Once HUD and ARC went through the reporting process to prepare third quarter
statements and notes, they realized that there were many issues that they had not previously




                                                4
identified. 1 Further, HUD did not have standard operating procedures and desk procedures that
(1) clearly outlined roles and responsibilities between HUD, FHA, Ginnie Mae, and ARC at an
individual financial statement component and note disclosure level, (2) detailed steps on how to
prepare the financial statements and notes, and (3) provided an agreed upon timeline for
completion of all steps required to complete consolidated financial statements. This led to
confusion regarding responsibilities and deadlines, causing errors and unsupported data in
HUD’s third quarter notes. These weaknesses were exacerbated by the late notification of
restatements for both of HUD’s component entities, FHA and Ginnie Mae.

HUD’s OCFO decided to implement a new quality control validation review after the
preparation of its year end statements, which identified errors. While HUD’s intention for the
quality control validation review was to ensure the accuracy of its consolidated financial
statements, this internal control procedure should have been implemented as part of HUD’s
complementary controls after the transition to the FSSP.

HUD agreed to provide its final consolidated financial statements and notes to the OIG on
October 31, 2016. However, due to the internal control weaknesses described above, it could not
provide them until November 10, 2016, only three business days prior to the issuance of our
independent auditor’s report on HUD’s consolidated financial statements on November 15, 2016.
Due to the significant delay in delivery of the final statements and notes, we were unable obtain
sufficient appropriate audit evidence to validate their accuracy. Therefore, we were unable to
provide an opinion over HUD’s fiscal year 2016 and 2015 (restated) consolidated financial
statements and notes.

HUD’s Third Quarter Financial Statement Notes Contained Errors or Were Unsupported
As discussed above, we identified several issues as part of our third quarter financial statement
and notes review. First, 11 of the 18 third quarter financial statement note disclosures ARC was
responsible for contained errors and ARC’s RSSI Statement of Net Costs was inaccurate.
Further, the information that ARC did provide was provided too late in the process for HUD’s
OCFO to use for submission to OMB. Since ARC could not use Oracle Federal Financials,
HUD’s system of record, to provide all the financial information HUD needed to prepare its
consolidated note disclosures, HUD used its Hyperion Financial Management System (HFM).
While HFM is a good validation tool to identify potential errors in statements and notes prepared
by ARC, relying on it for note preparation increased the risk of a misstatement in HUD’s
financial statements and note disclosures because (1) it had not been adequately validated for




1
 For example, we noted the following issues at third quarter: 1) Program cylinders in Oracle needed modifications
so that funds could be grouped under the correct program. 2) HUD and ARC had not come to agreement on who
would include eliminations in the note disclosures. 3) Some of the data attributes and formulas used to produce the
notes and Required Supplementary Stewardship Information (RSSI) were incorrect. HUD reported issues with the
consolidation of Ginnie Mae and FHA and “other” identified errors at fourth quarter, but did not provide the
specifics.




                                                          5
accuracy2 and (2) post-closing adjustments could be made in Oracle after the final data load to
HFM.

Due to these deficiencies, we noted the following errors in HUD’s third quarter notes and
disclosures:

         (1) HUD’s Note 30- Reconciliation of Net Cost of Operations to Budget was off by $187
         million compared to HUD’s financial statements, and

         (2) HUD’s Note 28- Apportionment Categories of Obligations Incurred; category A
         versus B obligations and direct versus reimbursable obligations were incorrect by
         approximately $278 million and $12 million, respectively.

In addition to the errors noted above, since ARC could not produce all of the financial statement
information needed for the note disclosures from Oracle Federal Financials, we were not able to
obtain reasonable assurance over all of the lines items in the following notes because they were
prepared using data from HFM and could not be supported with data from HUD’s system of
record (Oracle Federal Financials):

         Note 7-Accounts Receivable
         Notes 22- Total Cost and Earned Revenue by Budget Functional Classification
         Note 23- Expenditures by Strategic Goal
         Note 24- Net Costs of HUD’s Cross-Cutting Programs
         Note 27- Disaster Recovery Relief Efforts
         Note 30- Reconciliation of Net Cost of Operations to Budget


With proper testing and planning, these issues should have been identified and addressed prior to
third quarter reporting. However, since this testing was not performed, all of the issues could not
be resolved in time for third quarter reporting and remained unresolved, which ultimately led to
our disclaimer on HUD’s financial statements and notes.




2
  HFM was previously designed to read and extract HUDCAPS data. For HFM to produce correct financial
statements and notes, it must understand how to read and crosswalk the data loaded into the application based on its
data attributes. Since data attributes and system logic are different in HUDCAPS versus Oracle, testing is needed to
ensure HFM correctly crosswalks the Oracle data to produce accurate financial statements and notes. The financial
statement balances produced by HFM contained differences when compared to Oracle as of the third quarter. If
there are differences at the financial statement level, there is an increased risk that differences exist at the more
granular level.




                                                          6
Ginnie Mae’s Fiscal Year 2015 Statement of Budgetary Resources Contained Material
Errors
During fiscal year 2015, we reported 3 that we were not able to audit Ginnie Mae’s statement of
budgetary resource activity because Ginnie Mae (1) manually adjusted most of its budgetary
accounts,4 (2) lacked proper controls or an adequate audit trail to support its material
adjustments, and (3) did not provide its budgetary resources trial balances and detailed
supporting documentation within the timeframe needed to conduct adequate audit procedures.
This condition occurred because Ginnie Mae’s management did not devote sufficient resources
to ensure the successful implementation of a new budgetary module in its financial system, the
Ginnie Mae Financial Accounting System (GFAS).

We reviewed the material adjustments made in fiscal year 2015 as part of our audit work in fiscal
year 2016 and determined that several of the adjustments were incorrect because they closed
U.S. Standard General Ledger (USSGL) accounts 4700 (commitments), 4610 (allotments), and
4450 (unapportioned authority) before yearend closing. The USSGL requires that agencies close
these accounts in the yearend closing process, not before issuance of its yearend statements. As
a result, HUD’s apportioned and unapportioned authority line items on its fiscal year 2015
statement of budgetary resources were understated and overstated by $1 billion (total absolute
value of $2 billion). Therefore, HUD restated its fiscal year 2015 consolidated statement of
budgetary resources to correct the errors caused by Ginnie Mae.

Ginnie Mae reported that this had always been its closing process and could not explain why its
process deviated from the USSGL. 5 In addition, Ginnie Mae lacked a review process to identify
and reject adjustments that were not in compliance with the USSGL. As reported in fiscal year
2015, the manual calculation to determine the final balances was performed by one staff
member, and the journal vouchers used to adjust the balances did not include sufficient support
for proper supervisory review. Further, while HUD’s Office of the Chief Financial Officer
(OCFO) performed some review of Ginnie Mae’s financial statements, its review would not have
detected these material errors since they were made at the component level.

We attributed this financial reporting error to Ginnie Mae’s weak financial management
governance, which we reported on in fiscal year 2015. 6 Historically, Ginnie Mae has not
prioritized the accounting for its statement of budgetary resources primarily because it is not
included in its stand-alone financial statements. 7 This problem is evidenced by the fact that

3
  Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit
4
  Ginnie Mae adjusted 8 accounts, which affected 10 of the 11 accounts it reported in its status of budgetary
resources in its trial balance. These accounts adjusted made up 98 percent of Ginnie Mae’s total status of budgetary
resources and totaled $20.4 billion.
5
  Ginnie Mae stated that it must have been initiated because the apportionment for the negative subsidy payment is
an estimate that requires adjustment at the end. We agree that this explanation supports an adjustment; however, it
does not explain why the entire 4610 and 4700 accounts were closed to 4450 before yearend.
6
  Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit
7
  Ginnie Mae does not include a statement of budgetary resources in its stand-alone statements because its
statements are issued under the Financial Accounting Standards Board, not the Federal Accounting Standards



                                                          7
Ginnie Mae did not have a system to account for and report its budgetary resources until fiscal
year 2015, 8 in response to an Office of Inspector General (OIG) finding on the subject. Even
then, the module that was implemented within its core financial system was producing incorrect
balances due to insufficient resources allocated by Ginnie Mae management to ensure that the
new module accounted for and reported budgetary resources accurately.

In response to our fiscal year 2015 recommendations, Ginnie Mae hired additional staff in this
area. With an automated system and increased staff, Ginnie Mae is making progress toward
improving the quality of its statement of budgetary resources; however, the effects of its old
process continue to impede its efforts.

HUD’s Reliance on Manual Journal Vouchers Increased Risk
HUD relied heavily on manual journal vouchers in fiscal year 2016 to ensure that its general
ledger and financial statements were accurate. Specifically, HUD used 2,868 journal vouchers
totaling $7.8 trillion to adjust transactional data in its general ledger. 9 While many of these
journal vouchers did not impact amounts at the USSGL account level by fund, they did manually
change transactional data either by (1) adjusting one or more segments of the accounting flex
field 10 or (2) closing accounting flex fields manually to maintain vendor-level detail. 11 Most of
these journal vouchers, which adjusted transactional data totaling $5.8 trillion, were used to
correct data conversion issues that arose from differences in processing requirements between
the HUD Centralized Accounting and Program System (HUDCAPS) and Oracle. 12 Eighty-eight
percent of this $5.8 trillion was to manually close the accounting flex fields that required vendor-
level detail because Oracle’s yearend close process did not roll forward vendor-level information
that was needed to populate HUD’s custom trial balances. The remaining $680 billion in journal
vouchers was used to adjust transactional data to correct misalignments of summary templates
and other issues with HUD’s converted data. We attributed these issues to the rushed
implementation of phase 1, release 3, of the New Core Project. 13 In addition to the data issues,
HUD did not do enough research and preparation to ensure that Oracle Federal Financials could
adequately address its needs.


Advisory Board (FASAB). The Financial Accounting and Standards Board does not require a statement of
budgetary resources.
8
  Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit
9
  This includes both the debits and the credits.
10
   The accounting flex field represents the accounting strip or line of accounting and must be present on every
transaction in Oracle Federal Financials. Segments include fund, budget fiscal year, USSGL, budget objects class,
internal org, cost pool, Cam 1, category B, program, cohort, Cam 2, and Cam 3.
11
   Oracle’s yearend close process did not roll forward vendor-level information that was needed to populate HUD’s
custom trial balances. Therefore, ARC had to manually close the accounting flex fields that required vendor-level
detail.
12
   HUD converted all of its pre-2016 HUDCAPS data into Oracle and used a New Core Interface Solution (NCIS)
interface to convert HUDCAPS data into Oracle data throughout the year. There were issues with the initial
conversion and the activity that was converted from HUDCAPS to Oracle throughout the year.
13
   For further details, see Audit Report 2016-DP-0004, New Core Project: Phase 1, Release 3, Implementation and
New Core Interface Solution Functionality, Finding 1: HUD Rushed Implementation of Phase 1, Release 3, of the
New Core Project.



                                                         8
In addition to the adjustment related to data conversion, HUD adjusted transactional data totaling
(1) $1.7 trillion as part of Oracle’s normal closing process; (2) $16.5 billion to correct
differences identified between its general ledger and its subledgers; (3) $17.3 billion to record
loan balances and loan guarantee limits and subsidy transfers that should have been recorded in
prior years and to resolve discrepancies between HUD’s subsidiary records and general ledger;
(4) $2.7 billion to adjust its budgetary balances to agree with Standard Form (SF)-132; (5) $1.2
billion to adjust its cash balances to agree with those of the U.S. Treasury; (6) $4.7 billion to
account for daily loan activity; and (7) $70.2 billion for items that will always require manual
adjustments, such as grant accruals and eliminations. This extensive use of journal vouchers
complicated the financial reporting process, burdened staff, and increased the risk of error.
Conclusion
HUD’s financial reporting process is complex and time sensitive. The planned transition of this
process to ARC should have included the design and implementation of internal controls to
ensure that errors would be prevented or detected in a timely manner. However, ineffective
oversight of the New Core project and Ginnie Mae’s accounting for budgetary resources allowed
for insufficient controls to exist, causing (1) significant delays in HUD’s year end financial
statements and notes, and (2) errors in HUD’s fiscal year 2015 combined statement of budgetary
resources and fiscal year 2016 third quarter notes. As a result, we could not provide an opinion
over HUD’s fiscal year 2016 and 2015 consolidated financial statements and notes and HUD’s
fiscal year 2015 statement of budgetary resources were restated due to material misstatements
with an absolute value totaling $2 billion. HUD’s financial statements were at additional risk of
error because of the extensive number of journal vouchers used to adjust transactional data in its
general ledger.

Recommendations
We recommend that the Deputy Chief Financial Officer

   1A. Restate HUD’s fiscal year 2015 consolidated financial statements to report the correct
       balances for Ginnie Mae’s unobligated apportioned and unapportioned line items.
   1B. Communicate the reissuance of the fiscal year 2015 financial statements to those
       charged with governance, oversight bodies, funding agencies, and others who rely on or
       are likely to rely on the financial statement(s), as required by OMB Circular A-136.
   1C. Review Ginnie Mae’s accounting policies to ensure that they comply with the USSGL.

   1D. Develop and implement policies and procedures that clearly outline the role and
       responsibilities of both HUD and ARC in the financial statement preparation and review
       process, including a timeline that will ensure compliance with OMB financial reporting
       deadlines and allow sufficient time to be audited.

   1E. Determine which notes cannot be completed in Oracle and develop and implement a
       plan to ensure that these notes can be produced in Oracle.




                                                 9
   1F. Perform user acceptance testing in Oracle to ensure that it can produce all HUD proper
       financial information needed for note preparation within the timeframe required. If it is
       determined that HFM will be used for some portions of the notes, perform user
       acceptance testing to ensure that HFM is reading and crosswalking the Oracle data
       correctly.

   1G. Based on the user acceptance testing, implement any further modifications needed in
       Oracle or HFM to ensure that the notes are populated correctly.

   1H. Prepare first and second quarter financial statements and note disclosures for fiscal year
       2017 and beyond to ensure the early identification of errors or problems in the financial
       reporting process.

   1I. Work with ARC to develop an automatic process for closing accounts that maintains the
       vendor level detail needed to populate HUD’s custom trial balances.

We recommend that Ginnie Mae’s Chief Financial Officer
   1J. Implement controls to ensure that apportionments, allotments, and commitments
       (accounts 4510, 4610, and 4700) are closed to unapportioned authority (account 4450) as
       part of the yearend closing process and not before issuing any of its future financial
       statements.




                                                10
Finding 2: HUD Assets and Liabilities Were Misstated and Not
Adequately Supported
HUD did not properly account for, have internal controls over, or have adequate support for all
of its assets and liabilities. Specifically, (1) the Office of Community Planning and Development
(CPD) did not validate its accrued grant liabilities estimates; (2) HUD’s accounting for its cash
management process did not include the recognition of receivables and payables when incurred
and understated its prepayment balance; (3) HUD did not recognize a prepayment for funds
advanced to its Indian Housing Block Grant (IHBG) grantees used for investment; (4) the
Emergency Homeowners’ Loan Program (EHLP) could not be audited; (5) balances related to
HUD’s loan guarantee programs were not reliable; and (6) HUD did not properly account for its
property, plant, and equipment. These problems occurred because of continued weaknesses in
HUD’s internal controls and a lack of communication between OCFO and the program offices.
As a result, several financial statement line items were misstated or could not be audited as of
September 30, 2016. Specifically, (1) CPD’s accrued grant liabilities estimates could not be
audited; (2) HUD’s Office of Public and Indian Housing (PIH) prepayments and accounts
receivable balances contained errors with an absolute value of approximately $513.9 million 14
and $201.2 million, respectively, and accounts payable were understated by an unknown amount;
(3) HUD’s expenses on its statement of net costs contained errors with an absolute value of
$330.9 million; 15 (4) loans receivable balances for the EHLP could not be audited and were
potentially misstated; (5) balances related to HUD’s loan guarantee programs were misstated by
unknown amounts; and (6) HUD’s $297 million balance for property, plant, and equipment was
not supported.

CPD Did Not Validate Its Accrued Grant Liabilities Estimates
For fiscal years 2016 and 2015, CPD reported accrued grant liabilities of $2.3 billion and $2
billion, respectively. These amounts accounted for 85 percent of HUD’s $2.7 billion total
accrued grant liabilities reported for fiscal year 2016 and 84 percent of $2.4 billion for fiscal year
2015. As we first reported in fiscal year 2014, 16 CPD continued to lack a validation process for
its estimated accrued grant liabilities due to a lack of procedures and relevant grantee reporting.
As a result, it could not ensure that its assumptions and, therefore, its estimates were accurate
and reliable in accordance with the requirements of Federal Accounting Standards Advisory
Board (FASAB) Technical Release 12, Accrual Estimates for Grant Programs. Additionally, we
did not have sufficient time to perform all of the audit procedures we deemed necessary to obtain
sufficient, appropriate audit evidence to form an opinion on CPD’s fiscal year 2016 accrued
grant liabilities because CPD did not have adequate internal controls in place.

We were also unable to obtain all of the supporting documentation necessary for our work on
CPD’s fiscal year 2015 estimates due to delays in obtaining HUD’s disbursement data, as

14
   $513.9million = $260.1 million in prepayments not recorded for IHBG minus $183 million in receivables not
recorded in the Housing Choice Voucher program plus a $70.8 million error in prepayment valuation.
15
   $330.9 million = $260.1 million for IHBG advances that were expensed and $70.8 million due to errors in the
Moving to Work program (MTW) calculation.
16
   Audit Report 2015-FO-0004, Fiscal Years 2014 and 2013 Consolidated Financial Statements Audit, issued March
6, 2015



                                                       11
discussed in finding 5. There were no other compensating audit procedures that could be
performed in the time available to obtain reasonable assurance regarding CPD’s accrued grant
liabilities estimates for fiscal years 2015 and 2016. As a result, we were unable to obtain
sufficient, appropriate audit evidence for CPD’s accrued grant liabilities and could not form an
opinion on CPD’s accrued grant liabilities for fiscal years 2016 and 2015.

CPD was working to develop a statistical sampling plan to validate its estimates and to obtain a
waiver from Paperwork Reduction Act requirements so that it will be able to obtain relevant
information from its grantees. As of September 30, 2016, a validation process had not been
implemented.

HUD Did Not Properly Account for Accounts Receivable, Payables, and Prepayments
Related to PIH’s Cash Management Process in Accordance With GAAP
PIH’s cash management process 17 reconciled HUD’s disbursements with actual expenses
incurred by public housing agencies (PHA) to identify excess funds disbursed that should be
recorded as advances (prepayment) or receivables or funding shortages that should be recorded
as payables. Based on the completed reconciliations, PIH either performed offsets 18 to recover
overpayments or provided additional funding to cover shortages. In fiscal year 2016, HUD also
performed a confirmation process with PHAs to determine how much they were holding and
how much of the excess it could transition back. The amount determined for transition back to
HUD from this process also should have been recorded as a receivable. However, at the time
these accounting events occurred, OCFO did not recognize a receivable or payable or reduce its
prepayment balance by the amount of the receivable in accordance with Statements of Federal
Financial Accounting Standards (SFFAS) 1, Accounting for Selected Assets and Liabilities.

For example, in PIH’s March 31, 2016, confirmation process and June 30, 2016, cash
reconciliation, PIH determined that it overpaid $201.2 19 million to certain PHAs and underpaid
$33.1 million to others. However, OCFO did not recognize these as receivables or payables in
the general ledger or interim financial statements, resulting in (1) $201.2 million in understated
accounts receivable balances, (2) $183 million 20 in overstated prepayment balances, and (3) an
understated accounts payable balance on its September 30, 2016, consolidated balance sheet.
We could not determine the appropriate accounts payable balance as of September 30, 2016,
because HUD did not track additional disbursements made to liquidate the payables. Since the
cash reconciliation was completed several months after the period end, it was likely that the
payable was liquidated before it was determined because of PHAs requesting additional funding


17
   PIH performed cash management reconciliations (quarterly in calendar year 2015 and semiannually in calendar
year 2016) to identify excess accumulations, which were collected through offsets against future monthly Housing
Choice Voucher program disbursements.
18
   When PIH determined that a PHA received a prepayment in excess of its immediate disbursement need, it offset
future disbursements to collect the excess funding provided.
19
   $123.2 million from regular housing assistance payment reconciliation, $18.2 million for admin fee reconciliation,
$26.9 million from MTW housing assistance payment reconciliation, and $32.9 remaining and determined to be
offset from the MTW PIH confirmation process
20
   Only the regular housing assistance payment reconciliation impacts the PIH prepayment: $201.2 million - $18.2
million for admin expenses = $183 million.



                                                          12
to cover the shortages. However, since HUD did not track this process, we cannot be certain of
the payable balance.

HUD did not record receivables or payables because it did not have the necessary information
systems to capture PHAs’ monthly housing assistance payment expenses. 21 As a result, it relied
on PHA-reported expense information, which was not in real time and required HUD
validation. 22 As a result, HUD’s cash management transactions were not recognized when
incurred.

The lack of an automated system and real-time expense information also made it challenging for
HUD to determine its prepayment to Moving to Work program (MTW) PHAs. In fiscal year
2016, PIH spent extensive time and resources to manually determine this balance. While PIH
had made progress with its valuation, we determined that the PIH prepayment contained errors
with an absolute value of $70.8 million because two components of PIH’s calculation were
incorrect 23. First, PIH used “restricted net position” as the beginning balance for four of its
PHAs, as opposed to their “cash and investment balance,” which understated the beginning
balance component by $33.1 million 24 This process is inconsistent with the way it calculated the
balance for the 35 other MTW PHAs and inconsistent with SFFAS 1, which considers all cash
outlays for anticipated expenses to be advances. Second, PIH used disbursement data with
disbursement dates that did not match HUD’s general ledger. This misstated the disbursement
component of HUD’s calculation because it excluded several disbursements totaling $34.6
million and included disbursements that did not occur during that period totaling $3.1 million.

In our fiscal year 2013 report, we recommended that PIH’s cash management process be
automated, and management generally concurred. However, without assurance from senior-level
HUD management, PIH was reluctant to commit to a corrective action plan that involved the
automation of this process. Therefore, as of the date of this report, management had not
provided an agreed-upon action plan for our prior-year recommendations. Recently, PIH
informed us that it was working with the Office of the Chief Information Officer (OCIO) on a
project to replace HUD’s Inventory Management System-PIH Information System (IMS-PIC)
and Voucher Management System, 25 which would change the way HUD disburses its money and
help provide real-time expense information.

21
   See Material Weakness 5 – Financial Management Systems for further detail.
22
   PIH performed these manual calculations outside HUD’s financial systems using Excel spreadsheets and data
from the Financial Assessment Subsystem, HUDCAPS, and the Voucher Management System for approximately
2,200 PHAs.
23
   To calculate the MTW prepayment balance PIH used 3/31/16 PHA confirmed balances and added HUDCAPS
disbursements from April-September and subtracted VMS expenses from April-July expenses and estimated
expenses August- September.
24
   To calculate restricted net position for these four PHAs, PIH subtracted liabilities and a 1-4 month Housing
Choice Voucher program operating reserve from the total cash and investments on hand.
25
   IMS-PIC allows PHAs to electronically submit information to HUD. IMS-PIC is responsible for maintaining and
gathering data about all of PIH’s inventories of PHAs, developments, buildings, and units. HUD’s Voucher
Management System supports the information management needs of PIH’s Housing Choice Voucher program
management functions performed by the Financial Management Center and the Financial Management
Division. This system’s primary purpose is to provide a central system to monitor and manage the PHA’s use of



                                                       13
HUD’s Accounting for Indian Housing Block Grant Prepayments Was Not in Accordance
With GAAP
HUD did not properly account for approximately $260.1 million 26 in advanced payments it made
to its IHBG grantees for investment. In accordance with statutes, HUD authorized grantees to
invest unused IHBG program grant funds for up to 5 years. These grantees must spend the funds
on eligible, affordable housing activities by the 5-year deadline or return the funds to their line of
credit in HUD’s Line of Credit Control System. As of June 30, 2016, 31 grantees authorized to
invest funds had drawn down approximately $260.1 million in grant funds for investment
activities. However, HUD accounted for these funds as disbursements and recorded an expense
on the financial statements. These disbursements did not represent actual expenses because the
grantees had not yet provided goods or services in return. Therefore, they should be recognized
as an advanced payment on HUD’s financial statements in accordance with SFFAS 1.

Initially, HUD did not record these prepayments as advances because OCFO was unaware that
payments were being advanced to IHBG grantees. This condition occurred because OCFO did
not regularly communicate with program offices to identify and evaluate the impact on financial
reporting of program events through the use of a senior assessment council or comparable team.
In fiscal year 2015, we notified OCFO about the advances and the need to properly account for
them. We also recommended that the program office develop a tracking function to facilitate
financial reporting and that the OCFO evaluate the process and work with the program office to
calculate the amounts advanced to grantees. We have not reached a management decision on
these recommendations because OCFO used IHBG program regulations instead of accounting
standards to defend its position on expensing IHBG investments instead of recognizing them as
advances on the financial statements. OCFO stated that it expensed IHBG investments because
program regulations 27 allowed for investment of Federal cash; therefore, the funds were used for
statutory purposes. This position conflicts with SFFAS 1 because it does not consider the timing
of actual expenses, which occur when the grantee provides goods or services, 28 not when it
invests Federal cash. While the grantees are authorized to invest Federal cash, this activity does
not meet the criteria of an expense for financial accounting and reporting purposes.
Additionally, grantees report the balances invested on OMB’s SF-425, 29 which requires them to



vouchers. The Voucher Management System collects PHA data that enable HUD to fund, obligate, and disburse
funding.
26
   This estimate is based on our review of SF-425s as of December 31, 2015, and June 30, 2016. SF-425s for
September 30, 2016, were not available in time for this report.
27
   Regulations at 24 CFR (Code of Federal Regulations) 1000.58 permit IHBG grantees to invest their funding for
up to 5 years.
28
   According to SFFAS 1, “…advances are cash outlays made by a Federal entity to its employees, contractors,
grantees, or others to cover a part or all of the recipients’ anticipated expenses or as advance payments for the cost
of goods and services the entity acquires. Examples include travel advances disbursed to employees prior to
business trips, and cash or other assets disbursed under a contract, grant, or cooperative agreement before services or
goods are provided by the contractor or grantee.”
29
   SF-425 is a Federal financial reporting standard form prescribed by OMB (OMB approval number 0348-0061).
The form is completed by grantees and submitted to the Federal agency. Grantees report their investments on line
10c, Cash on Hand. The instructions for this line item state, “A recipient must compute the amount of Federal Cash
on Hand due to undisbursed advance payments using the same basis that it uses in requesting the advances.”



                                                           14
report advances of Federal cash to the agency. This government document further supports that
these funds are considered advances according to OMB rules.

PIH Repayment Agreements Were Not Recognized in the General Ledger for Most of the
Fiscal Year
Several PHAs owed $41 million to HUD for a variety of reasons and agreed to pay it back
through repayment agreements. Most of these repayment agreements originated before the start
of fiscal year 2016; however, as of June 30, 2016, HUD did not record these as receivables in its
third quarter financial statements, and they were not tracked in a central location and available to
OCFO. On October 6, 2016, PIH provided these repayment agreements to OCFO, and OCFO
recorded these repayment agreements; however, HUD’s internal controls to ensure the
recognition of accounts receivable from repayment agreements failed, allowing this deficiency to
exist for most of the fiscal year. As of the date of this report, PIH and OCFO were working on a
process to ensure that all repayment agreements would be recorded in a timely manner in the
future.

The EHLP Loans Receivable Balance Was Not Auditable
As reported in our fiscal year 2015 audit, 30 loan balances related to the EHLP were incomplete
and unreliable. They continued to be unavailable for audit during our fiscal year 2016 audit.
This condition continued because the loan data in HUD’s systems were not reliable and HUD did
not complete processing corrections from its review of the data in time for inclusion in the fiscal
year 2016 financial statements. As a result, we were unable to perform all of the audit
procedures necessary to obtain sufficient, appropriate audit evidence regarding the accuracy of
loans receivable balances related to the EHLP.

During fiscal years 2015 and 2016, HUD performed a “scrub” of the loan-level detail data for the
7,960 open loans in the EHLP portfolio as a result of differences identified between the National
Service Center’s Single-Family Mortgage Asset Recovery Technology system (SMART), where
the loan files were maintained, with the data in the Loan Accounting System (LAS). We
identified $116 million related to loan records in SMART that were not in LAS. The scrub was
meant to ensure the accuracy and completeness of the EHLP loan data in SMART before
entering the corrected data into LAS. The scrub was completed during fiscal year 2016;
however, adjustments to correct the data were being made as of the end of our fieldwork.
Therefore, the corrected data were not uploaded into HUD’s systems or available for audit by
September 30, 2016.

Balances Related to HUD’s Loan Guarantee Programs Were Not Reliable
On September 15, 2016, HUD’s OCFO provided us with a walkthrough of its efforts in
collaboration with ARC to reconcile and clean up balances related to its loan guarantee
programs. We were informed that discrepancies were identified between (1) guaranteed loan-
level limit carryover balances presented on the SF-132, Apportionment and Reapportionment
Schedule, and what is recorded in HUD’s financial systems; (2) the subsidiary records and


30
 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015



                                                     15
Oracle for the guaranteed loan level used and guaranteed principal outstanding general ledger
accounts; (3) general ledger tie points in the program and financing accounts, (4) Oracle and the
subsidiary records in the deferred revenue general ledger account, (5) Oracle and the subsidiary
records in the foreclosed property general ledger account, and (6) Oracle and the subsidiary
records when subsidy and obligation balances were looked at by cohort. Adjustments had been
made to address some of the identified discrepancies; however, as of September 30, 2016, HUD
and ARC were researching and resolving additional discrepancies.

As of September 30, 2016, eight journal entries, with a total impact of $17.3 billion, 31 had been
processed to correct identified discrepancies. Four of these journal entries, with a total impact of
$16.4 billion, were made to record loan guarantee authority levels that were not recorded in
fiscal year 2015. The other adjustments were made to record subsidy transfers that were not
recorded in prior years, clear abnormal balances, and bring tie points between the program and
financing accounts into agreement. HUD and ARC identified an additional $20.4 million in
adjustments that had not been made as of September 30, 2016, and they continued to analyze the
trial balances for the loan guarantee programs to identify any additional adjustments to reconcile
and clean up HUD’s accounts.

Our review of trial balances for HUD’s loan guarantee programs as of September 30, 2016,
identified $8.8 million in discrepancies between undelivered orders – obligations, unpaid in the
program accounts, and unfilled customer orders without advance in the financing accounts.
These discrepancies existed because HUD did not have policies and procedures or the proper
financial systems in place to account for and track its loan guarantee programs before fiscal year
2016. As a result, HUD’s loan guarantee balances, including its loan guarantee liability,
foreclosed property, unpaid obligations, and memorandum accounts used to track the status of
loan guarantee authority were not reliable.

HUD’s Property, Plant, and Equipment Were Not Adequately Supported and Could Not
Be Audited
HUD’s accounting for its property, plant, and equipment did not comply with Federal accounting
standards. The following deficiencies were identified and remained outstanding as of September
30, 2016:

       Inadequate subsidiary ledger for internal use software and commercial-off-the-shelf software
       licenses: HUD’s capitalized cost of internal use and commercial-off-the-shelf software
       licenses were not supported by an adequately detailed subsidiary ledger. A list of internal
       use software projects with an estimated cost of $254.3 million did not have adequate support
       for the underlying transactions. Additionally, $8 million in estimated costs for the
       development and implementation of the New Core Interface Solution (NCIS) software was
       not included. Lastly, HUD had not analyzed its inventory of commercial-off-the-shelf
       software licenses to determine the capitalized cost.




31
     Absolute value of all debits and credits



                                                   16
     Inadequate subsidiary ledger for property, plant, and equipment: Approximately $1.5
     million of HUD’s property, plant, and equipment related to furniture and equipment could
     not be audited because the subsidiary ledger was unreliable and incomplete. In addition, we
     found at least $5 million in furniture and equipment purchases that were misclassified as
     expenses and had been excluded from the subsidiary records since 2014.

     Unrecorded reporting of leasehold improvements: Remodeling projects, totaling at least
     $15.5 million, to renovate the HUD headquarters cafeteria, lobby, and auditorium were not
     properly accounted for. In addition, $46 million in energy-saving improvements occurring in
     2011 was not capitalized, including the $46 million liability incurred to finance the project.

Overall, HUD’s controls over (1) accounting for internal use and commercial-off-the -shelf
software licenses; (2) accounting for small and large acquisitions of furniture and equipment; (3)
safeguarding property and equipment against waste, loss, unauthorized use, or misappropriation;
and (4) accounting for leasehold improvements were not effective. Communication and
information sharing among OCFO, OCIO, the Office of Administration, and administrative and
contracting officers throughout HUD were weak and in some cases, nonexistent. Additionally,
HUD had been unable to produce a complete and accurate property inventory for a number of
years due to system issues and resource constraints, which we reported on in our prior-year
audit.32 HUD planned to use the Facilities Acquisition Management Enterprise System
(FAMES) going forward; however, it was not functional for fiscal year 2016. The effort to
interface FAMES with HUD’s procurement system (PRISMTM) has been hampered by the
inability to obtain technical information related to data locations, formats, and interfacing
protocols. While the FAMES development team continues to pursue development of these
interfaces, ARC already maintains a project cost module that is directly interfaced with Oracle
Federal Financials, HUD’s general ledger, which HUD is not using as part of the shared services
provided by ARC.

As a result, the $297 million property, plant, and equipment balance reported on HUD’s
consolidated balance sheet could not be relied upon. Additionally, the Office of Administration
lacked effective controls over property for which it is accountable and may be unable to
accurately report government assets that have been lost, stolen, or damaged as required by
Government Performance and Results Act and General Services Administration regulations.

Conclusion
HUD did not account for all of its assets and liabilities in accordance with GAAP or have
adequate internal controls over them. CPD did not have a validation process in place for the
estimates of its accrued grant liabilities. As a result, we were unable to obtain sufficient,
appropriate audit evidence for CPD’s fiscal years 2016 and 2015 accrued grant liabilities.
Therefore, we could not form an opinion on CPD’s accrued grant liabilities for fiscal years 2016
and 2015. OCFO did not have a function in place to facilitate communication with the program
offices and enable it to evaluate financial events or financial systems that impact financial


32
 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015



                                                     17
reporting. Therefore, HUD did not account for prepayments, receivables, and payables in its PIH
programs in accordance with GAAP. Specifically, (1) HUD’s PIH prepayments and accounts
receivable contained errors with an absolute value of approximately $513.9 million and $201.2
million, respectively; (2) HUD’s expenses on its statement of net costs contained errors with an
absolute value of$330.9 million; 33 and (3) HUD’s accounts payable were understated by an
unknown amount. Balances related to the EHLP could not be audited due to data integrity
issues, and balances in accounts related to HUD’s loan guarantee programs had discrepancies
and were not reliable. Finally, HUD’s $297 million balance for property, plant, and equipment
was not supported and could not be audited.

Recommendations
Several prior-year recommendations regarding the CPD accrued grant liabilities; Housing Choice
Voucher program; IHBG; and property, plant, and equipment portions of this finding remained
open and can be referred to in the Followup on Prior Audits section of this report. We have the
following new recommendations.

We recommend that the Deputy Chief Financial Officer

       2A. Continue working with ARC and complete the reconciliation and cleanup efforts for
           balances related to HUD’s loan guarantee programs.

       2B. Ensure that approved funds control plans and procedures to properly record loan
           guarantees are in place at the program offices.

       2C. Work with the Office of the Chief Administration Officer to establish control activities
           (that is, procedures) to completely and accurately record internal use software, leasehold
           improvement, and property acquisition transactions and enable compliant financial
           reporting.

       2D. Evaluate whether using existing Oracle accounting modules and ARC business
           processes to account for fixed assets and internal use software will be more cost
           effective and beneficial for HUD operations.

We recommend that the Chief Information Officer

       2E. Work with the OCFO to establish controls that ensure the timely communication of
           internal use and commercial-off-the-shelf software license acquisition activity and data.

We recommend that the Chief Administrative Officer

       2F. Work with OCFO to develop control activities that address risks related leasehold
           improvement and property acquisition data completeness and accuracy.


33
     $330.9 million = $260.1 million for IHBG advances that were expensed and $70.8 million due to errors in the
      MTW PIH prepayment calculation.



                                                           18
Finding 3: Significant Reconciliations Were Not Completed in a
Timely Manner
Material differences between subsidiary ledgers and the general ledger were not resolved, and
sufficient evidence to support financial statement line items was not maintained. Further, OCFO
did not complete required cash reconciliations or intragovernmental reconciliations in a timely
manner. In fiscal year 2016, HUD began using an FSSP for financial reporting but failed to
define (1) roles and responsibilities between HUD and the FSSP and (2) policies and procedures
for completing key reconciliations of material financial statement line items. HUD’s policies
and procedures were not effective. The lack of these internal controls increased the risk of a
material misstatement occurring in the financial statements and the potential of material
misstatements being undetected by management.

HUD’s Subsidiary Ledgers Were Not Reconciled to the General Ledger
As of September 30, 2016, HUD was unable to reconcile material differences between subsidiary
ledgers and the general ledger or provide sufficient evidence to support material financial
statement line items. The differences were originally identified in March 2016; however,
research on the material differences did not begin until July 11, 2016. HUD was researching
$29.38 billion in subsidiary ledger to general ledger differences that could not be supported. The
$29.38 billion in differences included $27.21 billion in differences in unliquidated obligations
that were included in HUD’s program accounting system but not in the general ledger. The
remaining $2.17 billion primarily represents differences in unliquidated obligation balances,
accounts receivable, advances, liability for nonentity assets, loan guarantee liability, and account
receivable allowance for loss. Refer to table 1 below.




                                                 19
                                                    Table 1
                                             Reconciling differences
                                                 (as of September 30, 2016)
                                                                                                      Current
                                        Description
                                                                                                  difference total
 Unliquidated obligations (0164)                                                                  $27,208,789,932
 Unliquidated obligations (all other funds)                                                           663,963,583
 Advances                                                                                             626,037,159
 Loan guarantee liability                                                                             294,925,122
 Liability for nonentity assets not reported on statement of custodial activity                       245,695,701
 Account receivable allowance                                                                           98,458,414
 Accounts receivable                                                                                    67,122,492
 Other 34                                                                                             170,741,372
 Total                                                                                             29,375,733,775

HUD did not have effective controls implemented to ensure that source documentation was
adequately maintained to support subsidiary ledger application or end user computing
application balances in accordance with Principle 10 of the U.S. Government Accountability
Office’s (GAO) Green Book. 35 Additionally, HUD did not have effective controls in place to
prevent or detect differences between subsidiary ledgers-end user application balances and the
general ledger. HUD’s previous information technology (IT) environment was insufficient and
resulted in manual processes to develop subsidiary ledgers. However, the high risks associated
with manual processes has contributed to the unsupportable balances because manually prepared
subsidiary ledgers are not always easily located or readily available for review. This is one of
the challenges HUD is experiencing in its efforts to reconcile general ledger balances to
subledger information.

In July of 2016, HUD initiated an effort to resolve differences between the subsidiary records
and general ledger. OCFO established a subledger project workgroup to resolve the differences
with a completion date of September 30, 2016. Although the workgroup was conducting
analysis to identify the cause of the reconciling differences and impact on the financial
statements, the $29.38 billion balance was not resolved by fiscal yearend.

34
   Other includes 14 general ledger accounts contributing to the total differences between the subledger and the
general ledger. We concluded that the individual differences were immaterial to the financial statements; however,
the total amount should be included in the total difference. The accounts include (1) loan interest receivable, (2)
fixed assets, (3) accounts payable, (4) deferred credit fees, (5) advances from others, (6) disbursements in transit, (7)
interest payable, (8) accrued funded payroll, (9) liability for deposit accounts, (10) unfilled customer orders, (11)
foreclosed property, (12) foreclosed property allowance, (13) other debt, and (14) liability for clearing account.
35
   Principle 10: Design Control Activities requires that internal control be clearly documented and financial records
be properly managed and maintained. Specifically, 10.03: Design of Appropriate Types of Control Activities
requires that transactions be promptly recorded to maintain their relevance and value to management in controlling
operations and making decisions, which is applicable to the entire process or life cycle of a transaction.
Additionally, management should design control activities so that all transactions are completely and accurately
recorded. Management clearly documents internal control and all transactions and other significant events in a
manner that allows the documentation to be readily available for examination.



                                                             20
Reconciliations of Significant Account Balances Were Delayed for Part of the Year
OCFO’s Accounting Monitoring and Analysis Division did not perform required cash
reconciliations in a timely manner or have a reconciliation process that included verifying
HUD’s monthly reports to Treasury. Additionally, HUD did not perform intragovernmental
transaction (IGT) reconciliations for fiduciary and nonfiduciary transactions for part of the fiscal
year. In our prior-year audit, we reported on these internal control deficiencies related to the
performance of reconciliations for cash and IGT fiduciary and nonfiduciary transactions. We
recommended that OCFO (1) distribute the workload among available accounts to ensure that all
cash reconciliations are performed in timely manner and (2) ensure that there is proper oversight
for ensuring that IGT differences are promptly researched and resolved. In fiscal year 2016, we
determined that these recommendations had not been addressed by OCFO and the deficiencies
remained.

       Cash reconciliations were not performed for all reporting periods. During our review of
       cash reconciliation status reports for the first 6 months of fiscal year 2016, we found that
       cash reconciliations were performed more than 60 days after the end of the applicable
       month. The number of appropriations impacted varied from 19 to 60 per month.
       Additionally, reconciliations for 15 of the appropriations were consistently not performed
       for a 5-month period from October 2015 to February 2016.

       This condition resulted from management’s not ensuring that roles and responsibilities
       for performing cash reconciliations were communicated and understood after the
       transition to an FSSP at the beginning of the fiscal year. There were no implemented
       policies and procedures that explained and defined the roles and responsibilities or
       processes for reconciling HUD’s fund balance with Treasury. Additionally, management
       did not ensure that all staff accountants had the proper system access before the transition
       to the reports necessary for completing the cash reconciliations to be run.

       As of March 31, 3016, the financial impact of the 15 appropriations for which
       reconciliations were not performed had a fund balance with Treasury totaling $37.8
       billion, of which $36.7 billion resided in four funds. Additionally, fund 86X0162 had a
       $3.1 billion unreconciled difference that occurred in October, which was not resolved
       until after the first quarter of the fiscal year. Refer to table 2 for additional details for
       cash reconciliations not performed in the first 5 months of 2016. Unresolved differences
       compromise the reliability of the fund balance with Treasury balances and Treasury’s
       published financial reports.




                                                  21
                                   Table 2
           Fund balance with Treasury balances for 15 appropriations
        (cash reconciliations were not performed within 60 days for the first 5 months)

                                 Fund balance with
      Appropriation                Treasury as of                     Fund count
                                  March 31, 2016
0162                             $21,579,230,505.51                                       10
0192                               6,420,688,522.84                                        9
0205                               3,862,079,151.83                                        9
0304                               4,871,702,292.92                                       10
Material fund subtotal            36,733,700,473.10                                       38
0176                                 170,004,273.28                                        9
0193                                  10,867,895.58                                        1
0203                                   4,726,294.30                                        1
0218                                 145,798,017.73                                        3
0235                                  28,707,777.60                                        2
0305                                   5,927,336.01                                        1
0344                                 256,845,918.64                                        1
0349                                 467,033,781.95                                        5
3875                                  11,755,333.46                                        2
3885                                  -1,092,433.47                                        1
4015                                   9,912,963.60                                        1
Total                             37,844,187,631.78                                       65

  Intragovernmental balances reconciliations were not performed for part of the year.
  HUD did not perform required intragovernmental transaction reconciliations, including
  HUD’s fiduciary investments and borrowings with Treasury’s Bureau of Fiscal Service
  and nonfiduciary reconciliations for transfers of budget authority and transfers of assets
  among Federal agencies, including Treasury’s General Fund, for the first quarter 2016.
  Since the fiduciary reconciliations were not performed, there were unsupported
  differences for (1) $10.7 million for investments, (2) $53.6 million for borrowings with
  Treasury, and (3) $41.4 million for buy-sell transactions among Federal agencies, such as
  HUD’s trading partners. These differences were reported in HUD’s scorecard for the
  first quarter 2016 and were included in the total difference amount of $434.80 million.
  Refer to table 3 for the dollar value differences by the IGT subcategories included in the
  scorecard.




                                               22
                                               Table 3
                                   HUD IGT scorecard differences
                     General fund                             Quarter 1, 2016
                     Nonentity                                 $208.9 million
                     Other general fund RCs 36                    0.1 million
                     IGT                                      Quarter 1, 2016
                     Investments                                 10.7 million
                     Borrowings                                  53.6 million
                     Benefits: Office of Personnel Management                     9.4 million
                     Buy-sell                                                  41.4 million
                     Transfers                                                110.7 million
                     Grand total                                            434.80 million

         Further, the Accounting Monitoring and Analysis Division did not provide the
         appropriate review and formulate corrective action plans for differences identified among
         trading partners. As a result, HUD could not provide evidence of research and resolution
         efforts for reconciling IGT differences reported on the agency’s quarterly consolidated
         IGT scorecard issued by Treasury. 37

         This condition occurred due to undefined responsibilities between OCFO’s Accounting
         Monitoring and Analysis Division and the FSSP at the start of the fiscal year after the
         transition to the FSSP. Additionally, OCFO’s IGT reconciliation procedures were not
         updated to reflect the roles and responsibilities of the FSSP for assisting the Accounting
         Monitoring and Analysis Division with reconciling differences reported on HUD’s
         scorecard.38

Conclusion
HUD had significant unreconciled differences between subsidiary ledger records and the general
ledger totaling $29.38 billion. There was a lack of effective controls to ensure that source
documentation properly supported general ledger balances. The inability to detect and correct
financial statement errors in a timely manner impeded the ability of stakeholders to evaluate
program performance and program personnel to effectively manage budgets, which increased the
risk to the reliability of HUD’s financial statements.


36
   As defined within Treasury Financial Manual, volume I, part 2, chapter 4700, reciprocal category (RC) is a set of
reclassified financial statement Federal line items or a grouping of USSGLs. The set is used to perform eliminations
at the governmentwide level.
37
   Fiscal Service has established a set of performance metrics and scorecards to help identify and resolve root causes
of IGT differences. The scorecards are at a governmentwide and agency-specific level and are sent to significant
entities within 90 calendar days after the end of a quarter. The scorecard will focus on differences by trading
partner, IGT subcategory, USSGL account, and reciprocal category. Fiscal Service will monitor the quarterly
scorecards to assess how well agency corrective actions resolve problematic areas.
38
   HUD’s scorecard includes FHA, Ginnie Mae, and HUD amounts combined.



                                                          23
Additionally, HUD’s reconciliations were not completed in a timely manner for its fund balance
with Treasury and the intragovernmental transactions of fiduciary and nonfiduciary balances.
OCFO’s inability to implement policies and procedures that explained the roles and
responsibilities or processes for reconciling these significant account balances led to unresolved
differences for part of fiscal year 2016. The weak internal control activities provided the
potential for misstatement of the closing balances with Treasury, inaccurate financial activity
reported to Treasury, and material differences going undetected.

HUD’s failure to implement timely and effective reconciliation processes for significant line
items increased the risks of fraud, waste, and mismanagement of funds; affected the
Government’s ability to effectively monitor budget execution; and affected the ability to
accurately measure the full cost of the Government’s programs.

Recommendations
Prior-year recommendations regarding the IGT reconciliations from this finding remained open
and can be referred to in the Followup on Prior Audits section of this report. We have four new
recommendations in this report.

We recommend that the Deputy Chief Financial Officer

    3A. Develop and implement standard operating procedures, including descriptions of roles
        and responsibilities, for fund balance with Treasury reconciliations.

    3B. Continue the subledger reconciliation project and complete it in a timely manner,
        communicate results to top key stakeholders, and complete necessary adjustments or
        restatements (if applicable).

    3C. Perform a root cause analysis to identify potential control gaps and ineffective controls
        in the review of subledger balances to the general ledger.

    3D. Communicate the impact of system limitations that contributed to unreconciled
        balances to relevant management and design and implement effective controls that
        address relevant risks.




                                                 24
Finding 4: CPD’s Formula Grant Accounting Did Not Comply
With GAAP, Resulting in Misstatements on the Financial
Statements
HUD CPD’s formula grant program accounting continued to depart from GAAP because of its
use of the first in, first out (FIFO) method 39 for committing and disbursing obligations. Since
2013, we have reported that the information system used, the Integrated Disbursement
Information System (IDIS) Online, a grants management system, was not designed to comply
with Federal financial management system requirements. Further, HUD’s plan to eliminate
FIFO from IDIS Online was applied only to fiscal year 2015 and future grants and not to fiscal
years 2014 and earlier. As a result, budget year grant obligation balances continued to be
misstated, and disbursements made using an incorrect USSGL attribute resulted in additional
misstatements. Although FIFO has been removed from fiscal year 2015 and forward grants,
modifications to IDIS are necessary for the system to comply with FFMIA and USSGL
transaction records. The inability of IDIS Online to provide an audit trail of all financial events
affected by the FIFO method prevented the financial effects of FIFO on HUD’s consolidated
financial statements from being quantified. Further, because of the amount and pervasiveness of
the funds susceptible to the FIFO method and the noncompliant internal control structure in IDIS
Online, the combined statement of budgetary resources and the consolidated balance sheet were
materially misstated. The effects of not removing the FIFO method retroactively will continue to
have implications on future years’ financial statement audit opinions until the impact is assessed
to be immaterial.

IDIS Online’s Accounting for Transactions Departed From GAAP and Accounting
Standards
CPD’s inadequate budget controls and disregard for USSGL attributes at the transaction level
when making commitments and disbursements for CPD’s formula grants as well as CPD’s use
of the FIFO method resulted in

•   A departure from Federal financial accounting standards and GAAP,
•   Noncompliance with budgetary internal control requirements, and
•   Noncompliance with the overall conceptual framework established by the Federal
    financial management laws and guidance issued by the standard setters.



39
   The FASAB Handbook defines FIFO as a cost flow assumption. The first goods purchased or produced are
assumed to be the first goods sold (FASAB Handbook, Version 13, appendix E, page 30, dated June 2014). In
addition, the Financial Audit Manual states that the use of “first-in, first-out” or other arbitrary means to liquidate
obligations based on outlays is not generally acceptable (GAO-PCIE (U.S. General Accountability Office-
President’s Council on Integrity and Efficiency) Financial Audit Manual, Internal Control Phase, Budget Control
Objectives, page 395, F-3). In the context of HUD’s use of this method, the first funds appropriated and allocated to
the grantee are the first funds committed and disbursed, regardless of the source year in which grant funds were
committed for the activity.




                                                           25
During fiscal years 2016 and 2015, $2.7 billion and $4.4 billion, respectively, in disbursements
were susceptible to this FIFO method and were reported in HUD’s consolidated financial
statements. Also during this time, $2.4 billion and $6.3 billion, respectively, in undisbursed
obligations were impacted. These material amounts, which impact the combined statement of
budgetary resources and consolidated balance sheet, were not presented in conformity with
GAAP.

Progress Was Made in Correcting Future Accounting; However, Material Misstatements
Will Continue for Several Years Due to Inaction on Fiscal Year 2014 and Older Grants
Steps to eliminate the FIFO logic from IDIS Online were stopped in the spring of 2015 because
of budget shortfalls. By late fiscal year 2015, HUD had obtained additional funds, and in fiscal
year 2016, HUD eliminated the FIFO logic for fiscal year 2015 and later grant years. HUD
planned to complete all scheduled upgrades for IDIS Online by May 2017.
Although FIFO was removed from fiscal year 2015 and forward grants, additional modifications
to IDIS are necessary for the system to comply with FFMIA and the USSGL at the transaction
level. Among the remaining work, CPD must ensure that IDIS ties disbursements to specific
commitments. In addition, CPD must ensure that IDIS logs the additional information needed to
meet internal control requirements and that the system properly handles the return and collection
of grant funds.

While CPD had taken steps to eliminate the FIFO method for commitments and disbursements
on fiscal year 2015 and forward grants, these steps will not be sufficient to eliminate this
deficiency as a material weakness and clear the basis for disclaimer reported in the independent
auditor’s report for fiscal year 2016 and future independent auditor’s reports. Specifically, since
the plan did not address fiscal year 2014 and prior grants, there will continue to be a material
amount of funding susceptible to the FIFO logic for several more years. The effects of not
removing the FIFO logic retroactively will have implications for future years’ financial statement
audit opinions until the impact is assessed to be immaterial.

We will continue to work with CPD and OCFO to monitor the progress of HUD’s FIFO
elimination plan. During the next fiscal year, we will also continue to ensure that IDIS uses a
non-FIFO method to commit and disburse CPD formula grant funds for 2015 grants and forward
and that there is an appropriate audit trail available for review.

Conclusion
We continue to report that the use of the FIFO method (1) departed from Federal accounting
standards and (2) was noncompliant with budgetary internal control requirements and the overall
conceptual framework established by the Federal financial management laws and guidance
issued by the standard setters. Specifically, the use of FIFO by the information system, IDIS
Online, made it noncompliant with Federal financial management system requirements because
of inadequate budget controls and the misuse of USSGL attributes at the transaction level for
CPD’s formula grant disbursements. While steps were underway to remove the FIFO method,
these changes applied to fiscal year 2015 and future grants will not be applied retroactively.
Additional work is needed to match disbursements to commitments and to make IDIS Online
compliant with the USSGL and FFMIA. The effects of not removing the FIFO method


                                                 26
retroactively will continue to have implications for future years’ financial statement audit
opinions until the impact is assessed to be immaterial.

During fiscal year 2016, $2.7 billion in disbursements and $2.4 billion in obligations were
susceptible to this FIFO method, which is not in accordance with GAAP. Due to this material
amount, the combined statement of budgetary resources and the consolidated balance sheet were
not prevented from containing material misstatements.

Recommendations
Prior-year recommendations regarding this finding remained open and can be referred to in the
Followup on Prior Audits section of this report. We have no new recommendations in this
report.




                                                 27
Finding 5: HUD’s Financial Management System Weaknesses
Continued in 2016
HUD’s financial system weaknesses remained a material weakness in fiscal year 2016 due to the
combined impact of many deficiencies and limitations. While HUD took steps to modernize its
financial management system through the transition of key financial management functions to an
FSSP in 2016, it encountered significant challenges after implementation that had not been
resolved as of September 30, 2016. HUD’s inability to modernize its legacy financial systems
and the lack of an integrated financial management system resulted in a continued reliance on
different, legacy financial systems with various limitations. Program offices compensated for
system limitations by using less reliable manual processes to meet financial management needs.
These system issues and limitations inhibited HUD’s ability to produce reliable, useful, and
timely financial information.

HUD Encountered Significant Challenges With Its Transition to a Shared Service Provider
for Financial Management Services
HUD experienced significant data quality challenges following the transition of key financial
management functions to an FSSP with release 3 of the New Core Project on October 1, 2015. 40
Specifically, HUD had unresolved data conversion errors and inaccurate funds management
reports and lacked a fully functional data reconciliation process. In addition, HUD’s NCIS
performance was not adequately monitored, tracked, or measured, and controls over processing
errors within Oracle Federal Financials were routinely bypassed. Data conversion errors
complicated the analysis and monitoring of balances for funds control purposes and increased the
risk of invalid spending transactions and inaccurate financial reporting.

Additionally, the dilution and deferral of key requirements and system testing enabled significant
data quality issues to go unnoticed and unaddressed until after the implementation of New Core,
release 3. HUD officials did not adequately meet the significant business-user requirement that
system-generated listings of program obligations and expenditures be reconciled to trial balance-
general ledger data in a timely manner. As a result, key data extracts were provided in an
unusable manner, and key audit procedures were delayed while both HUD and OIG personnel
worked to resolve data quality issues.

Despite the presence of impactful issues, HUD did not resolve issues, improve data, or report
quality weaknesses before the go-live date and did not move the implementation date in response
to unresolved issues with a potentially adverse impact on the production environment. 41




40
   New Core was HUD’s financial system modernization program, initiated in 2013, that involved migrating
financial management capabilities to an FSSP, with expected benefits including reduced legacy system costs,
improved data, and remediated audit deficiencies.
41
   Audit Report 2016-DP-0004, HUD Rushed Implementation of Phase 1, Release 3, of the New Core Project,
issued September 20, 2016



                                                        28
HUD’s efforts to modernize its financial management systems continued to be hindered by
weaknesses in implementing key IT management practices. 42 On November 4, 2015, HUD’s
Deputy Secretary stated that HUD would not develop additional capabilities as part of the New
Core program. As a result, HUD will continue executing program transactions with expensive
and inefficient legacy financial systems that were to be replaced during the New Core Project.
Additionally, the FSSP increased the cost of HUD’s financial accounting process and operations.

HUD’s Financial Systems Lacked Key Functionality
Several of HUD’s financial systems used to support significant balances on the financial
statements lacked key functionality. This deficiency prevented HUD from relying on the data
output provided and reporting key financial statement balances in accordance with GAAP.

Ginnie Mae did not have systems in place to adequately record and account for the loan
accounting and processing of activity in its defaulted issuers’ portfolio. Ginnie Mae remained
unable to support key financial statement line items related to its nonpooled loans portfolio
acquired from defaulted issuers. Ginnie Mae’s challenges come from its lack of a financial
system (or systems) capable of recording loan-level transaction details in compliance with
GAAP accounting requirements. Material weaknesses related to Ginnie Mae’s nonpooled loans
portfolio, approximately $4.2 billion and $5.4 billion, as of September 30, 2016, and September 30,
2015, remained unresolved as of September 30, 2016.

Ginnie Mae did not have an accounting system to account for and track servicing costs at a loan
level. As a result, it was reliant on third-party master subservicer data, which we found
unreliable because of completeness and accuracy weaknesses. We concluded that Ginnie Mae
failed to adequately establish and maintain accounting systems to manage and control the loan
accounting and processing of the activities related to its defaulted issuers’ portfolios. Refer to
the relevant material weaknesses and associated recommendations for additional details.43

System configuration issues within the budgetary accounting module of the GFAS application
prevented Ginnie Mae from automating its contract obligation process. In fiscal year 2015, we
reported that system configuration and posting logic deficiencies in the GFAS budgetary module
resulted in inaccurate budgetary account balances. In fiscal year 2016, Ginnie Mae corrected a
number of these issues; however, the system still could not accurately account for contract
obligations. Consequently, Ginnie Mae manually calculated key USSGL account balances and
made adjustments to its third quarter statement of budgetary resources totaling $222 million. In
fiscal year 2015, this manual calculation and adjustment process resulted in a $46.2 million error.
This manual process was inefficient and noncompliant with FFMIA requirements related to the
application of the USSGL at the transaction level. Additionally, we noted issues regarding the
segregation of duties within GFAS. Specifically, accounting personnel had inappropriate access
to multiple roles that should be separated to maintain effective internal control.


42
   GAO, GAO-16-656, July 2016, Financial Management Systems: HUD Needs to Address Management and
Governance Issues That Jeopardize its Modernization Efforts; http://www.gao.gov/assets/680/678727.pdf
43
   Audit Report 2016-FO-0001, Audit of the Government National Mortgage Association’s Financial Statements for
Fiscal Years 2015 and 2014, issued November 13, 2015



                                                       29
Ginnie Mae’s budgetary accounting module was implemented with incomplete system
requirements and inadequate user acceptance testing. In addition, the completeness and accuracy
of data migration were insufficiently validated before deployment into the production
environment, and while Ginnie Mae and its contractors had worked to identify and resolve these
system issues, correcting the issues was time consuming and difficult. Despite spending a great
deal of resources, 2 years after implementation, these issues had not been resolved.

Updates to IDIS remained in process and continued to hinder CPD’s ability to properly account
for formula grant transactions in accordance with GAAP and comply with FFMIA. CPD uses
IDIS to manage its formula grant programs. While CPD had made progress in addressing the
noncompliant application of FIFO to grants initiated during 2015 and going forward, funding
constraints delayed further remediation and compliance with accounting standards and FFMIA.
See further discussion of this issue in the related material weakness.44

Emergency Homeowner’s Loan Program data in HUD’s Loan Accounting System were not
reliable. In prior years, 45 we reported that EHLP data in LAS was not reliable because of system
and process internal control weaknesses. Specifically, EHLP loan data initially entered into LAS
were inaccurate and incomplete, the data correction process was ineffective, and loan-level
transaction details in LAS were lost during a database rebuild effort. For fiscal year 2016, the
EHLP data in LAS remained unreliable and did not support the loans receivable balances in the
general ledger.

HUD did not have a working property inventory system in place. HUD did not have a property
management system in place to record transactional details during fiscal year 2016. HUD
decommissioned its legacy property management system in fiscal year 2016 after being unable to
remediate technical issues caused by a lapsed maintenance contract that had impeded system
functionality since 2012. The Office of Administration was working with OCIO to populate its
new automated property management application hosted by the Federal Aviation Administration.

Legacy procurement applications that did not comply with financial system requirements could
not be decommissioned due to longstanding data migration challenges. As of September 30, 2016,
HUD reported that three Office of the Chief Procurement Officer (OCPO) procurement systems, the HUD
Procurement System (HPS), Small Purchase System (SPS), and HUD Integrated Acquisition
Management System (HIAMS), were not substantially compliant with FFMIA. These systems have been
replaced, and OCPO needs to perform procurement closeout actions in HPS and HIAMS and validate
SPS data before decommissioning. HUD hoped to complete decommissioning for these three systems
during fiscal year 2017.




44
   Finding 4: CPD’s Formula Grant Accounting Did Not Comply With GAAP, Resulting in Misstatements on the
Financial Statements
45
   Audit Report 2015-DP-0004, Loan Accounting System, issued December 9, 2014



                                                     30
HUD Did Not Have Financial Systems in Place To Meet Financial Management Needs
In addition to weaknesses and limitations associated with HUD’s financial systems, HUD did not
have systems in place to meet other financial management needs.

HUD lacked an effective cost accounting system. In fiscal year 2006, GAO reported 46 that
HUD’s financial systems did not have the functionality to provide managerial cost accounting
across its programs and activities. HUD lacked an effective cost accounting system that was
capable of tracking and reporting the costs of its programs in a timely manner to assist in
managing its daily operations. This lack of functionality resulted in the lack of reliable and
comprehensive managerial cost information on HUD’s activities and outputs. This deficiency
made HUD unable to produce reliable, cost-based performance information. Despite being
within the scope of the New Core program, there were no plans to implement this core financial
system capability as of fiscal year 2016.

PIH’s manual cash management processes did not allow recognition of financial transactions or
timely adjustments to PHA disbursements. PIH’s cash management process was not automated.
Under the cash management process, PIH manually determines the amount PHAs are holding
(PIH prepayment on HUD’s balance sheet) and the amount that it should offset to follow cash
management requirements. This process is conducted through the use of complex, unprotected
Excel spreadsheets that include extracted data as of a point in time from multiple systems and
tracking logs for more than 2,200 PHAs. PIH lacked a system to track these amounts in real time
as the disbursements and expenses occurred, resulting in (1) increased risk of error, (2) untimely
recognition of accounting events in HUD’s general ledger and financial statements, 47 and (3)
delayed transition of excess funds from PHAs to HUD to comply with Treasury and OMB cash
management requirements.48

HUD’s lack of a system to account for the Section 108 and 184 loan guarantee programs
contributed to its inability to support related general ledger balances.
While HUD had moved certain recording of Section 108 and 184 loan guarantee programs into
Oracle, daily loan guarantee activity was still recorded through manual journal vouchers. A
historical lack of compliant loan guarantee systems over the years contributed to HUD’s inability
to support key general ledger balances with subledger data or supporting documentation.
Because of this deficiency, there were discrepancies in HUD’s accounts for loan guarantee
liabilities, foreclosed-on property, unpaid obligations, and the memorandum accounts used to
track the status of its loan guarantee authority. Without a financial system to record detailed
program transactions, HUD could not adequately monitor its loan guarantee programs.

Conclusion
Complete and reliable financial information is critical to HUD’s ability to accurately report on
the results of its operations to both internal and external stakeholders. During fiscal year 2016,


46
   GAO-06-1002R, Managerial Cost Accounting Practices, dated September 21, 2006
47
   Finding 2 - HUD’s Assets and Liabilities Were Misstated and Not Adequately Supported
48
   Finding 12 - HUD Did Not Comply With Treasury Financial Manual Rules on Cash Management or 2 CFR Part
    200



                                                    31
system limitations and weaknesses continued to contribute to the possibility that a material
misstatement of HUD’s financial statements would not be prevented or detected and corrected in
a timely manner.

Until these weaknesses are fully remedied, HUD’s ability to produce reliable, useful, and timely
financial information needed for accountability, performance reporting, and decision making will
remain a departmental material weakness. Therefore, we will continue to monitor HUD’s
progress in addressing our concerns in this area.

Recommendations
Prior-year recommendations regarding this finding remained open and can be referred to in the
Followup on Prior Audits section of this report. We have the following new recommendations.
We recommend that the Office of the Chief Financial Officer

   5A. Establish standard operating procedures to capture the process involved with the transfer
       of accounting data to Oracle from HUDCAPS through NCIS. Procedures should
       include measures to ensure that information is processed completely, accurately, and in a
       consistent and reperformable manner to allow for timely review.

   5B. Adequately document key internal control processes and control activities in place for
       the HUDCAPS, NCIS, and Oracle interface, including but not limited to Oracle posting
       models, and ensure that they are readily available for review.




                                               32
Significant Deficiencies

Finding 6: HUD’s Financial Management Governance Was
Ineffective
HUD’s financial management governance remained ineffective during 2016. HUD’s transition
to an FSSP for financial management services was punctuated by operational issues that were
exacerbated by a lack of mature financial management governance practices. Additionally, as
we have reported in prior-year audits, HUD did not have reliable financial information for
reporting and continued the use of its outdated legacy financial systems. Weaknesses in program
and component internal control that impacted financial reporting were able to develop in part due
to a lack of financial management governance processes. As a result, there were many
deficiencies in HUD’s internal controls over financial reporting, resulting in misstatements on
the financial statements and noncompliance with laws and regulations.

Recommendations From an Independent Organizational Assessment of HUD OCFO To
Improve HUD’s Financial Management Governance Remained Unimplemented
While we have been reporting on HUD’s financial management governance weaknesses since
fiscal year 2013, during fiscal year 2015, HUD took steps to address weaknesses in its financial
management governance by contracting with the National Academy of Public Administration
(NAPA) for an organizational assessment of financial management at HUD. The assessment
was designed to identify risks associated with the transition of its accounting functions to a
shared service provider and, in part, to address concerns previously identified by OIG. NAPA
made three high-level recommendations, concluding that HUD should

 1. Improve financial management oversight and governance,
 2. Address concerns associated with the transition to the FSSP, and
 3. Strengthen the finance workforce. 49

During the 2015 financial statement audit, OIG followed up with HUD management to
determine HUD’s progress in addressing the NAPA study recommendations and noted
weaknesses in HUD’s process for tracking recommendations from separate evaluations, such as
those performed by NAPA, and the associated management actions. HUD’s lack of evaluation
and corrective action plans in response to the NAPA recommendations contributed to this
weakness.50

The NAPA study also supported the longstanding OIG recommendation that HUD establish a
Chief Financial Officer (CFO) Council to enhance its financial governance structure. While
HUD had historically resisted recommendations to create a senior management council, updated


49
   Department of Housing and Urban Development, Office of Chief Financial Officer, Organizational Assessment,
March 19, 2015. http://napawash.org/images/reports/2015/HUD_OCFO_Study_Final_Report.pdf
50
   Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014
Consolidated Financial Statements Audit, November 23, 2016



                                                       33
OMB Circular No. A-123 recently changed the establishment of a senior management council
from a best practice to a requirement. While HUD stated that it was finalizing plans for an
entitywide oversight group, such a group was not in place during fiscal year 2016. However, this
is an important step toward addressing HUD’s significant financial management governance
weaknesses.

The Lack of a Policy and Procedure Framework Hindered HUD’s Transition to a Federal
Shared Services Provider for Financial Management Services
As noted above, the NAPA study team also recommended that HUD take action to address
concerns related to HUD’s impending transition to an FSSP for financial management services.
HUD’s transition to an FSSP was hindered by governance weaknesses, including outdated or
incomplete accounting, financial management, and internal control policies and procedures. We
noted a pervasive lack of governance documentation during this year’s audit that worsened
issues related to HUD’s transition to an FSSP.

GAO’s recent work also cited governance weaknesses in HUD’s financial management that we
have reported on for a number of years. 51 GAO identified a lack of documented policies to
ensure the quality and consistency of program evaluations, echoing OIG’s concerns regarding
the inconsistent performance and lack of or untimely completion of management reviews and
risk assessments, which remained unaddressed as discussed later in this finding. 52 Additionally,
GAO reported on HUD’s financial systems modernization efforts and concluded that HUD’s
management and governance weaknesses must be addressed to enable HUD to effectively
modernize its financial systems. 53

Information and Communication Were Inadequate
We have also attributed the cause of HUD significant deficiencies and material weaknesses to a
lack of adequate information and communication among key groups. Specifically, program
office accounting policies and procedures were, at times, developed without adequate OCFO
input due to broad delegations to program office personnel. HUD has delegated key financial
management functions, including the review and approval of vouchers, reviews of unliquidated
obligations, and various budgetary accounting functions. However, we have found that program
office decisions made without adequate subject-matter expert input can overlook key
considerations, including compliance with accounting regulations or best practices. We have
attributed the root cause of significant deficiencies and material weaknesses identified in our
audits to inadequate consideration of key accounting and financial rules and regulations. For
example, we have noted that weak collaboration between OCFO and HUD components and




51
   Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014
Consolidated Financial Statements Audit, November 23, 2016
52
   GAO-16-497, Actions Needed to Incorporate Key Practices into Management Functions and Program Oversight,
http://www.gao.gov/assets/680/678551.pdf
53
   GAO-16-656, HUD Needs to Address Management and Governance Weaknesses That Jeopardize Its
Modernization Efforts, http://www.gao.gov/assets/680/678727.pdf



                                                      34
program offices have contributed to material weaknesses and significant deficiencies cited in our
financial statement audit reports. 54

CPD’s budgetary accounting for grants. The material weakness associated with CPD’s
budgetary accounting for grants, 55 which contributed to our 2013 qualified opinion and our 2014
and 2015 disclaimer of opinion, occurred within the environment of substantial delegation and
deferral to program office priorities. This deficiency occurred because OCFO was not involved
in the development of the mixed financial system (IDIS Online) to ensure that it complied with
FFMIA and GAAP. This deficiency will exist for several years because the programing changes
made to IDIS Online will be on a prospective basis for fiscal years 2015 going forward and not
apply to prior-year grant funds. As of September 30, 2016 and 2015, approximately $2.4 billion
and $6.3 billion, respectively, in undisbursed obligations had been impacted.

PIH cash management. As we first reported during the 2013 financial statement audit, 56 OCFO
was not consulted when PIH implemented its cash management process in fiscal year
2012. Further, as PIH’s cash management process has evolved, HUD’s OCFO has not taken an
active role in accounting for it. Specifically, HUD’s OCFO did not review PIH’s estimation
process to value the MTW PHA portion of the PIH prepayment or record receivables determined
through the PIH cash management process. As a result, $201.2 million in receivables was not
recognized on the financial statements, $41 million in repayment agreements was not recorded
for most of the year, and the PIH prepayment was understated by $33.1 million. While an
automated system would assist both OCFO and PIH in properly monitoring and accounting for
this process, the manual process could be improved through stronger governance. We previously
recommended that PIH implement a system to automate the process. However, as of the date of
this report, HUD had not provided an adequate management decision on how it planned to
address this recommendation. This recommendation was referred to the Deputy Secretary for a
decision on March 31, 2015. As of fiscal yearend, the Deputy Secretary had not provided a
decision on the referral.
Indian Housing Block Grant Investments. HUD did not properly account for approximately
$260.1 million 57 in advanced payments to its IHBG grantees for investment because OCFO was
unaware that payments were being advanced to IHBG grantees. This condition occurred because
OCFO did not regularly communicate with program offices to identify and evaluate the impact
on financial reporting of program events through the use of a senior assessment council or
comparable team. After we identified this issue during the fiscal year 2015 financial statement
audit, OCFO disagreed but was unable to provide a justification based on generally accepted
accounting standards. In addition, program offices and OCFO reported that they did not have the
systems to capture the information needed for reliable financial reporting. Although not having


54
   Audit Report 2016-FO-0004, U.S. Department of Housing and Urban Development Fiscal Years 2015 and 2014
Consolidated Financial Statements Audit, November 23, 2016
55
   Refer to finding 4 for more detail.
56
   Audit Report 2014-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and
2012 (Restated) Financial Statements, issued December 16, 2013
57
   This estimate is based on our review of SF-425s as of December 31. 2015, and June 30, 2016. SF-425s for
September 30, 2016, were not available in time for this report.



                                                     35
adequate systems may hinder HUD’s ability to record these prepayments, it does not exempt
HUD from accurate financial reporting.

Ginnie Mae’s Financial Governance Weaknesses Continued
In fiscal year 2016, despite improvements, Ginnie Mae failed to maintain a governance
framework that allowed appropriate policies, people, systems, and controls to ensure the
reliability and integrity of Ginnie Mae’s financial and accounting information. This failure in
governance was the underlying cause of the problems cited in the Ginnie Mae financial statement
audit report. 58 Ginnie Mae failed to (1) adequately identify, analyze, and respond to changes in
the control environment and risk associated with the acquisition of a multi-billion-dollar
servicing portfolio; (2) adequately establish accounting policies, procedures, and accounting
systems to manage and control the loan accounting and processing of the activities related to its
defaulted issuers’ portfolio; and (3) adequately oversee the implementation of the budgetary
accounting module in its financial system to ensure accurate reporting of budgetary activity.
This condition occurred because of insufficient internal controls to manage the risks associated
with business decisions and changes in its business environment. As a result, serious financial
reporting deficiencies occurred at Ginnie Mae, which impacted HUD consolidated financial
reporting. These governance weaknesses contributed to Ginnie Mae’s inability to produce
auditable financial statements. To address these issues, oversight is needed from OCFO to
ensure that the policies and guidance it provides are properly implemented.

HUD Did Not Implement and Maintain Adequate Accounting and Financial Systems
The CFO Act states that the responsibilities of an agency chief financial officer include
developing and maintaining adequate accounting and financial systems and implementing
agency asset management systems, including systems for cash management, debt collection, and
property and inventory management and control. We continued to report a material weakness
related to HUD’s financial management system and noncompliance with FFMIA as discussed in
finding 5 and appendix C. To implement and maintain financial systems in accordance with
CFO Act requirements, OCFO and other departmental organizations will need to collaborate
effectively, address governance weaknesses, and remediate financial system issues.

Management Control Reviews Were Not Performed
During fiscal year 2016 HUD did not conduct any routine or timely management control reviews
(MCR)59 for its program areas as required by HUD Handbook 1840.1. We reported in the prior
fiscal year that although MCRs were conducted for two program areas, they were not performed
routinely across all program areas as required by HUD guidance.60 We recommended that HUD
revise its MCR policies and procedures to include clearer and more specific requirements,


58
   Audit Report 2016-FO-0001, Audit of the Government National Mortgage Association’s Financial Statements for
Fiscal Years 2015 and 2014, Restated, issued November 14, 2015
59
   An MCR is a detailed evaluation of the complete system of management controls in a functional area. Such a
review will produce extensive documentation of controls and will include the testing of most if not all controls.
60
   Audit Report Number 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014
(Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18,
2015, page 31



                                                        36
including accountability for nonperformance. 61 OCFO stated that this matter had been put on
hold due to additional review by new management within the OCFO.

Inconsistent performance of MCRs may prevent HUD from achieving its internal control
monitoring goal of detecting conditions that may adversely affect the achievement of program
objectives. This inconsistency decreased the potential for HUD to achieve the intended results of
its programs and administrative functions by minimizing risks of fraud, waste, abuse, and
mismanagement of funds. It also could decrease the reliability of HUD’s financial reporting and
its ability to comply with applicable laws and regulations. For example, MCRs provide a basis
for the HUD Secretary to report annually to the President and Congress, as required by the
Federal Managers’ Financial Ingrity Act (FMFIA), on the adequacy of management controls
within HUD. Insufficient performance and monitoring of this process for all of HUD’s program
offices could prevent the Secretary from having an adequate basis when reporting on FMFIA.

HUD Was Not Addressing Internal Control Deficiencies in a Timely Manner
HUD was not addressing internal control deficiencies in a timely manner in accordance with
internal control requirements and OMB Circular A-50, Audit Followup. The timely remediation
of identified control deficiencies is a key element of the monitoring component outlined in
GAO’s Green Book, Standards for Internal Control in the Federal Government. Specifically, we
noted that as of September 30, 2016, 56 of 93, or 60 percent, of OIG recommendations from
prior-year financial statement audit reports were past the agreed-upon dates for final action.
Additionally, we noted that as of September 30, 2016, management had not established action
plans for 17 additional recommendations, a significant increase from only two recommendations
without action plans as of September 30, 2015. Additionally, as of June 2016, 58 percent (63 of
108) of GAO recommendations made to HUD in fiscal years 2012 through 2015 had not been
fully implemented. To improve internal controls, HUD must address deficiencies in a timely
manner.

Financial Management Weaknesses Necessitated Frequent Restatements
HUD’s financial management governance weaknesses resulted in many financial statement
errors that required the frequent performance of restatements. For the third consecutive year,
HUD will need to restate financial statements to correct errors. Errors in financial statements can
result from mathematical mistakes, mistakes in the application of accounting principles, or
oversight or misuse of facts that existed at the time the financial statements were
prepared. Recent restatements included restatements of HUD’s 2014 financial statements to
correct errors related to Ginnie Mae accounting and the 2013 financial statements to correct
material misstatements related to accounting for PIH prepayments and CPD’s accrual of grantee
expense liabilities. In the current year, HUD is performing a restatement to correct errors related
to the improper closing of USSGL accounts that caused overstatements and understatements of

61
   Audit Report Number 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014
(Restated) U.S. Department of Housing and Urban Development Financial Statement Audit, issued November 18,
2015, recommendation 6J: Revise policies and procedures to ensure that MCRs are routinely monitored and
completed for all program areas and establish a timeframe for completion of the MCR reports. Further, HUD should
ensure that an escalation process is included to address untimely completion of the MCR process.




                                                       37
HUD’s apportioned and unapportioned balances. Frequent restatements to correct errors can
undermine public trust and confidence. Additionally, the late notification of the restatements, at
times, limited our ability to adequately review and validate the accuracy of accounting
adjustments.

Conclusion
Deficiencies in HUD’s financial management governance continued during 2016. The
challenges associated with the transition to ARC financial management services and Oracle
Federal Financials were made worse by unaddressed weaknesses in HUD’s governance.

Recommendations
Prior-year recommendations remained unimplemented and can be found in the Followup on
Prior Audits section of this report. We have the following new recommendation.

We recommend that the Deputy Chief Financial Officer

   6A.    Establish a framework for financial policy development and review of policy and
          procedures that defines roles and responsibilities and provides reasonable assurance
          regarding the effectiveness of related controls.




                                                 38
Finding 7: Weaknesses in HUD’s Administrative Control of Funds
System Continued
We have reported on HUD’s administrative control of funds in our audit reports and
management letters since fiscal year 2005. HUD continued to not have a fully implemented and
complete administrative control of funds system that provided oversight of both obligations and
disbursements. Our review noted instances in which (1) the Office of Multifamily Housing
Programs did not follow HUD’s administrative control of funds; (2) funds control plans were out
of date or did not reflect the controls and procedures in place with the transition to an FSSP; (3)
program codes were not included in funds control plans and funds control documentation; and
(4) OCFO staff processed accounting changes without proper review, approval, and sufficient
supporting documentation. These conditions existed because of (1) decisions made by HUD
OCFO, (2) failures by HUD’s allotment holders to update their funds control plans and notify
OCFO of changes in their obligation process before implementation, (3) a lack of compliance
reviews in the current year, and (4) a lack of policies and procedures requiring documentation of
system accounting changes. As a result, HUD could not ensure that its obligations and
disbursements were within authorized budget limits and complied with the Antideficiency Act
(ADA).

The Office of Multifamily Housing Programs Did Not Comply With the Administrative
Control of Funds Policies and Procedures
HUD’s Office of Multifamily Housing Programs did not ensure that it complied with OCFO’s
administrative control of funds policies and procedures 62 in administering its Section 8 project-
based rental assistance program. It (1) implemented substantial changes to the Section 8 project-
based program obligation process in fiscal year 2011 without OCFO’s approval 63 and (2) could
not provide the appropriate obligating documents as stated in its 2011 funds control plan to
support that obligations and disbursements complied with legal authorization and contract
requirements.64 This deficiency was reported in our prior-year audit report, 65 and the Office of
Multifamily Housing Programs agreed to implement changes.

During our fiscal year 2015 audit, the Office of Multifamily Housing Programs provided OCFO
a funds control plan for its review. However, as part of HUD’s fiscal year 2016 Process
Improvement for Funds Control Plans approach, OCFO was no longer reviewing changes to the


62 HUD’s policies require OCFO to review and approve funds control plans to ensure that internal controls for
processing obligations and disbursements comply with OMB Circular A-11, Budget Execution Manual,
requirements. Controls should provide evidence of government officials’ authorization for each transaction in which
program funds are used, preventing or minimizing ADA violations at all levels of the budget process.
63
   Under Section 902 of the CFO Act, the agency chief financial officer is charged with overseeing all financial
management activities relating to the programs and operations of the agency; developing and maintaining an
integrated agency accounting and financial management system, including financial reporting and internal controls;
and directing, managing, and providing policy guidance and oversight of agency financial management personnel,
activities, and operations.
64
   The housing assistance payments contract renewal, along with the notification of funding, is required for
authorizing the project’s continued participation and for authorizing the obligation of funds the first year.
65
   Audit Report 2015-FO-0002, Interim Report on HUD’s Internal Controls Over Financial Reporting, issued
December 8, 2014



                                                         39
preexisting funds control plans. Therefore, this weakness continued in fiscal year 2016 since
HUD was in a transitioning period to a new funds control structure and no updates were being
accepted by OCFO for existing funds control plans. Additionally, the interim funds control
documentation did not address Multifamily Housing Programs process changes.

In fiscal year 2016, we found that 60 obligations and 78 disbursements from samples of 93
obligations and 101 disbursements, or 71 percent of the total transactions tested, were not
supported with proper obligating documentation as prescribed in the latest approved housing
control of funds requirements. These obligation and disbursement transactions totaled $137.7
million and $21.9 million, respectively.

HUD’s Funds Control Documentation Did Not Properly Include Significant Business
Processes Completed by Its Federal Shared Service Provider
We previously reported that all of HUD’s funds control plans were not updated in a timely
manner. This condition continued in fiscal year 2016, as HUD was transitioning to a new funds
control structure. OCFO requires allotment holders to recertify annually that internal controls to
administer funds have not changed and submit updated plans before implementing changes.
However, we noted the following:

   •   HUD’s funds control policies were not revised for salary and expense transactions
       processed in ARC’s Oracle financial system. As a result, there were inconsistencies in
       the 33 salary and expense funds control plans in the ARC standard operating procedures.
       Salaries and expenses receive annual appropriations of $1.7 billion.

   •   There was no traceability from the standard operating procedures established in the HUD
       Guidance on Funds Control for Business Processes document to the appropriation funds
       used for obligation incurred and disbursement transactions. Specifically, there was no
       documentation of fund, program code, or program class to restrict funds accordingly.

   •   The funds control plan for the Office of the Chief Human Capital Officer had not been
       updated since its reorganization and renaming from the Office of Administration in 2009.
       As a result, the plan referenced divisions and offices that no longer existed.

   •   The funds control plans for the Section 184 Loan Guarantee program were inconsistent
       with the procedures in use. The Indian Housing Loan Guarantee, or the Section 184
       program, did not have documentation of internal controls over funds. The funds
       available can subsidize a total loan principal, up to $1.190 billion, until spent. The
       revision process of Section 184 funds control plans was not accepted by OCFO during
       the interim period; therefore, documentation of funds control did not exist for the current
       year. Revisions to these plans were in process during fiscal year 2016.

These conditions existed because in October 2015, HUD transitioned to ARC for financial
management services. This change resulted in the replacement of HUDCAPS with Oracle
Federal Financials as the official system of record for all general ledger accounts and budgetary
resources for HUD. As part of this transition, OCFO issued HUD’s fiscal year 2016 Process


                                                 40
Improvement for Funds Control Plans approach, and the Fiscal Year 2016 Funds Control Plans
and Handbook Project memorandum on October 9, 2016, to outline the funds control
requirements. According to the memorandum, OCFO did not require the revision of plans to
address Oracle financial reporting and the funds control business process for transactions
processed by ARC, HUD’s FSSP. Specifically, OCFO management did not require the budget
execution and funds control procedures of transactions processed directly to Oracle as a part of
the migration to be reflected in HUD’s funds control plans.

Instead, OCFO prepared HUD’s Guidance on Funds Control for Business Processes document,
which documents ARC’s funds control procedures, for the program offices’ use. This document
became a procedural guide for the business processes performed by ARC and served as a
standard operating procedure manual, outlining the transactions that occur in the Oracle financial
reporting system. It was not intended to supersede the existing funds control policies
implemented by HUD and was to be used in combination with existing funds control plans.
However, this document’s control structure conflicted with the existing funds control plans due
to key procedures, such as the allocation of funds to program offices, which did not reflect the
budget execution procedures adopted with ARC. Further, critical financial reporting elements of
program code and program class within the ARC Cam1 Code 66 were not transparent in the funds
control documentation to provide accountability to the financial system of record. Lastly, the
procedures identified in the document did not provide traceability to the applicable funds or
program office transactions and accountability to the responsible officials.

Further, HUD’s allotment holders did not update their funds control documentation or notify the
CFO in a timely manner after changes occurred. HUD Handbook 1820.2, REV-5, states that an
allotment holder must immediately advise the CFO of any changes to its funds control plan
during the fiscal year. Administrative changes to the funds control plans must be communicated
in writing, including the precise timing of any changes, to the persons or positions authorized to
initiate, approve, and process actions that commit, obligate, or spend funds. OCFO attested that
the Delegation of Authority document ensures accountability of responsible officials and
traceability to the corresponding funds during the transition. However, there was no inclusion of
responsible officials for salary and expense transactions, and the responsible officials identified
for budget execution were not designated authority at the fund level.

Another factor leading to the out-of-date funds control documentation was OCFO’s lack of
oversight and monitoring of the program offices’ compliance with their funds control plans in
prior years. The CFO Act states that the responsibilities of an agency chief financial officer
include directing, managing, and providing policy guidance and oversight of all agency financial
management personnel, activities, and operations. Due to the lack of oversight and monitoring,
OCFO was not aware that changes within the program offices were going unreported and,
therefore, could not correct the behavior.



66
  The Oracle financial system includes the account flex field for the line of accounting. In fiscal year 2016, key
changes to the accounting classification structure included that the program class and program code were combined
into one field, called “Cam 1” in Oracle.



                                                         41
During fiscal year 2013, OCFO’s Funds Control Assurance Division began performing reviews
of program office compliance with the funds control plans and completed its first year of a 5-
year cycle in fiscal year 2014. However, HUD’s transition to a new funds control business
structure in 2016 delayed the completion of compliance reviews throughout the year. Notably,
HUD was developing new policies and procedures for completing compliance reviews, which
were not completed until September 2016.

Not All HUD Programs Had Proper Funds Control Documentation
Our review of HUD’s funds control plans found 102 program codes that were not documented in
a funds control plan. HUD’s program codes are used to identify funds obligated and spent for
specific programs and activities in its financial systems. In our prior-year audit, we reported that
112 program codes were not included in funds control plans. We recommended that OCFO
ensure that the program codes are properly approved and included in a funds control plan. In
fiscal year 2016, we determined that 10 program codes were properly included in a funds control
plan; however, the recommendation was not fully addressed by OCFO because there were 102
program codes without a funds control plan.

HUD was not in compliance with OMB Circular A-11, section 150, Administrative Control of
Funds, which states that the purpose of an agency’s funds control system is to restrict both
obligations and expenditures from each appropriation of fund account to the lower of the amount
apportioned by OMB or the amount available for obligation or expenditure in the appropriation
or fund account.

Additionally, HUD Handbook 1830.2, REV-5, Administrative Control of Funds, states that
proper execution of a funds control plan should provide reasonable assurance that obligations
and expenditures will not exceed the authorized limits of the allotted funds. It also states that
funds control plans must contain detailed information for the program line item or other activity
included in the allotment, broken down to the lowest level of any corresponding assignment of
funds, and list the hierarchy of accounting codes associated with each funded activity covered in
the allotment to show how funded activities are controlled and rolled up to the allotment level as
a required element of a funds control plan.

HUD did not have documented internal controls over the obligation and disbursement of all of its
funds. As a result, the agency could not monitor the internal controls to ensure that they
functioned effectively. There was no traceability from the standard operating procedures
established in the HUD Guidance on Funds Control for Business Processes document to the
appropriation funds used for obligation incurred and disbursement transactions. The interim
documentation did not include fund, program code, or program class to restrict funds
accordingly. This condition caused HUD to lose traceability of transactions with the
corresponding authority and program law.

CFO Systems Division Did Not Document Changes to the Accounting Data
During our review in 2015, we found instances in which the OCFO Systems division made
changes to accounting data that resulted in unsupported general ledger transactions. In fiscal
year 2016, we found that this condition continued, and as a result, we could not validate these



                                                  42
transactions’ compliance with the program funds control process and consistency with Federal
accounting standards.
OCFO did not have policies and procedures in place requiring documentation, review, and
approval for changes to its financial data as required by Treasury guidance and internal control
standards. OCFO Systems reversed transactions from fund 86 16 0163 using table updates in
HUDCAPS to report them in fund 86 16-17 0163 after passage of the fiscal year 2016
appropriations bill; however, there was no evidence of supervisory review and approval of the
adjustments in accordance with Treasury Financial Manual, volume I, part 2, chapter 5100. 67
In a sample of disbursement and collection transactions, we identified five items for which HUD
had no journal vouchers, SF 1166 (Voucher and Schedule of Payments), or other supporting
documentation readily available. The five items sampled totaled $335 million in disbursements.
Additional analysis of the disbursements made from fund 86 16 0163 provided that 12,513
transactions of $692.5 million were reversed and moved to fund 86 16-17 0163. HUD’s
budgetary accounts showed that 70,384 transactions totaling $4.2 billion in accounts 4801, 4901,
and 4902 were reversed and moved to fund 86 16-17 0163 as well. The adjusting transactions
were made with no effective internal control over financial reporting and, therefore, increased
the risk of errors and unauthorized adjustments to HUD’s financial data.
Conclusion
HUD did not have a fully implemented and complete administrative control of funds system
during fiscal year 2016. The interim funds control approach established as a result of HUD’s
transition to ARC created an inconsistent internal control structure for restricting the obligation
and expenditure of funds. The inconsistencies among the multiple pieces of funds control
documentation did not ensure accountability or traceability to the policies and procedures
governing budget execution, obligation, and expenditure of funds. Additionally, limited funds
control of salary and expense transactions processed in ARC’s Oracle financial system created
an environment for unrestricted obligations and disbursement of funds. As a result, HUD did not
have adequate assurance that its obligations and disbursements complied with applicable laws,
limitations, and ADA requirements

In addition, processing disbursements before the documented point of legal obligation may lead
to ADA violations. Statistically projecting our results for the multifamily Section 8 rental
housing assistance disbursements in fiscal year 2016, we can be 95 percent confident that at least
$6.89 billion in obligations and $7.64 billion in disbursements were processed without properly
authorized supporting documentation. As a result, we were not able to validate multiple
obligation and disbursement samples to determine whether obligations incurred and
disbursements made were properly approved by the authorized official with the correct projects,
number of units, rent rates, and amount allocated.


67
   Treasury Financial Manual, volume I, part 2, chapter 5100, Supplement FBWT [Fund Balance With Treasury],
Reconciliation Procedures: IV Policy, Adjustments: An agency may not arbitrarily adjust its FBWT account. Only
after clearly establishing the causes of errors and properly documenting those errors should an agency adjust its
FBWT account balance. If an agency must make material adjustments, the agency must maintain supporting
documentation. This will allow correct interpretation of the error and its corresponding adjustment.



                                                        43
Lastly, effective internal control over accounting data changes remained weak. Therefore, there
was an increased risk of errors and unauthorized adjustments to HUD’s financial data. There
was no supporting documentation for the reversal of transactions, which consisted of an absolute
value of $1.385 billion in disbursements and $8.4 billion affecting multiple budgetary accounts. 68
OCFO did not have policies and procedures in place requiring documentation, review, and
approval for changes to its financial data as required by Treasury guidance and internal control
standards.

Recommendations
Prior-year recommendations regarding this finding remained open and can be referred to in the
Followup on Prior Audits section of this report. We have five new recommendations in this
report.

We recommend the Deputy Chief Financial Officer

        7A. Finalize and implement the funds control policies and procedures for the business
            processes completed by ARC, including salary and expense transactions, and ensure
            traceability to the program funds, adopting the policies for budget execution,
            obligation, and expenditure of funds.
        7B. Monitor each program office’s compliance with the established funds control
            policies by reviewing and approving funds control documentation revisions and
            annual certifications in a timely manner.
        7C. Ensure that each program office maintains current reporting elements in its funds
            control documentation, including the fund, program code, and program class, to
            provide traceability to the Oracle financial system and the transaction source.
        7D. Ensure that the roles and responsibilities are defined and documented by position for
            those individuals authorized in the funds control process.




68
  Absolute value of $692.5 million reversed out of 86 16 0163 + absolute value of $692.5 million entered into 86
16-17 0163 = $1.385 billion; absolute value of $4.2 billion reversed out of 86 16 0163 + absolute value of $4.2
billion entered into 86 16-17 0163 = $8.4 billion



                                                         44
Finding 8: HUD Continued To Report Significant Amounts of
Invalid Obligations
Deficiencies in HUD’s process for monitoring its unliquidated obligations and deobligating
balances tied to invalid obligations continued to exist. Specifically, some program offices did
not complete their obligation reviews in a timely manner, and we discovered $204.4 million 69 in
invalid obligations not previously identified by HUD. We discovered another $93.4 million 70 in
obligations that were inactive, 71 potentially indicating additional invalid obligations. We also
discovered $34.6 million in obligations that HUD determined needed to be closed out and
deobligated during the fiscal year that remained on the books as of September 30, 2016. We
attributed these deficiencies to ineffective monitoring efforts and the inability to promptly
process contract closeouts. Lastly, we noted that as of September 30, 2016, HUD had not
implemented prior-year recommendations to deobligate $100.5 million in funds. As a result,
HUD’s unpaid obligation balances on the statement of budgetary resources were potentially
overstated by $432.9 million.

CPD Obligations Were Inactive or Expired
As of September 30, 2016, we noted inactive or expired CPD obligations in the following
program areas: (1) Homeless Emergency and Rapid Transition to Housing – Continuum of Care
(Hearth CoC), (2) Emergency Solutions Grants (ESG), and (3) Neighborhood Stabilization
Program (NSP) grants. We attributed this condition primarily to the lack of an adequate closeout
policy, deadlines, and resources to perform closeout activities in a timely manner. As a result,
funds remained obligated for grants that no longer had a bonafide need, and HUD’s unliquidated
obligation balance was overstated on its consolidated statement of budgetary resources.

        Hearth CoC. Grants were not closed within the 90-day period after the expiration date
        required by the program’s funds control plans and the Code of Federal Regulations
        (CFR). The Office of Special Needs Assistance Programs (SNAPS) did not implement or
        enforce policies and procedures to ensure that expiring contracts were closed within the
        90-day period. We identified 3,121 contracts, which expired between July 1, 2015, and
        June 30, 2016, that were not closed within the 90-day period, and remaining undisbursed
        obligation balances of approximately $151.7 million had not been recaptured and
        reallocated to be used to further the purposes of the program or returned to Treasury.

        In fiscal year 2015, the Office of Policy Development and Coordination (OPDC) was
        created to focus on grant closeouts and audit responses for CPD programs, starting with
        homeless assistance grants. OPDC and SNAPS were piloting automated processes to
        improve the closeout of expired grants and the recapture of any remaining funds. HUD
        was also working to assign clear roles and responsibilities to OPDC and SNAPS and to
        train field office staff. HUD believes these tasks will enable SNAPS to more regularly


69
   $151.7 million in homeless assistance funds, $18 million in ESG funds, and $34.7 million in housing obligations
70
   $86.4 million in Ginnie Mae funds and $7 million in NSP funds
71
   We define an obligation as inactive if a disbursement has not been made within a reasonable amount of time. This
time varies based on program area and applicable criteria.



                                                         45
        track the financial status of its grants as well as the field offices’ efforts to comply with
        policies and procedures to recapture the unspent funds on expired contracts.
        While SNAPs worked diligently to close out and recapture remaining funds on expired
        grants identified in prior-year audit reports, the field offices continued to be overwhelmed
        with running multiple fiscal year funding competitions simultaneously.
        ESG. Grants were not closed within the 90-day period after the 24-month expenditure
        deadline as required by the CFR. We identified 1,365 contracts, which expired between
        June 2, 2012, and June 30, 2016, that were not closed within the required timeframe. In
        addition, the remaining undisbursed obligations of approximately $18.1 million had not
        been recaptured. Of this amount, only nine contracts, with a total of about $68,000 in
        undisbursed obligations, were marked for deobligation during HUD’s annual review of
        open obligations for fiscal year 2016, leaving 1,356 expired contracts totaling
        $17,986,109 remaining open that could potentially represent invalid obligations.
        SNAPS had not established procedures to specifically address the closeout and recapture
        of undisbursed obligations after the 24-month expenditure deadline for ESG contracts.
        Instead of recapturing funds on expired contracts, the office chose to implement other
        requirements or sanctions for grantees that had not complied with the 24-month
        expenditure deadline which is allowed per 24 CFR 576.501. SNAPS required that
        noncompliant grantees submit and comply with proposals that included planned actions
        and timelines to implement corrective actions.

        NSP 1 and 3. Grantees continued to spend grant funds from their line of credit despite
        the passing of expenditure deadlines in 2013 and 2014 established in the Federal
        Register. The expenditure deadlines were set based on the needs assessment for the
        program and to address what Congress described as emergency conditions. Despite the
        expenditure deadlines, HUD decided to allow grantees to continue to spend program
        funds beyond the expenditure deadline if they had spent an amount equal to at least 100
        percent of the their initial allocation of NSP funds by their expenditure deadline date.
        Those that did not meet this requirement were subject to other corrective actions but not
        necessarily the recapture of remaining funds, and they were allowed to continue to spend
        their program allocation. However, we found 16 open NSP grants with no disbursements
        from their grant balance or program income since 2014 with remaining grant balances
        totaling approximately $7 million.

        This condition occurred because (1) some grantees no longer had an adequate pool of
        NSP-eligible foreclosed-on or abandoned properties in their target areas, which decreased
        spending opportunities; (2) CPD had inadequate resources to oversee NSP, which
        impacted its ability to monitor obligations and expenditure deadlines, pursue closeout
        efforts, and enforce corrective actions; and (3) CPD lacked closeout deadlines. 72


72
 CPD considers a grantee ready for program closeout once all applicable administrative actions and all required
work of the Federal award have been completed by the non-Federal entity. CPD’s closeout guidance states that



                                                         46
Ginnie Mae’s Obligation Balance Contained Invalid Obligations
Based on our review of Ginnie Mae’s unpaid undelivered orders, 20 contracts totaling $72.8
million were inactive. 73 Three of these contracts totaling $64.6 million were for mortgage
servicers that no longer serviced Ginnie Mae loans,74 and the contracting officer confirmed that
they should be closed and deobligated. The other 17 small contracts with a remaining balance of
$8.2 million also appeared to have ended since there was no recent activity 75 on Ginnie Mae’s
contract activity report. In addition to these invalid obligations, Ginnie Mae did not record a
deobligation in its financial system for a contract that had been closed by OCPO in its
procurement system totaling $13.6 million.

This condition occurred because Ginnie Mae did not have a formal process in place to review its
contracts and inform HUD’s OCPO of contracts that need to be closed and deobligated. Once
the contracts were closed, HUD’s OCPO did not have a formal process to provide the
information to Ginnie Mae for financial recording. For example, Ginnie Mae could not
deobligate $13.6 million on a contract that HUD’s OCPO said it closed because OCPO could not
locate the signed contract and had not provided it to Ginnie Mae. These steps are necessary
because HUD’s procurement system and Ginnie Mae’s financial system do not interface with
one another.

When contracts and other agreements are completed or terminated, the remaining obligation
balances become invalid. Therefore, if these obligations are not deobligated, HUD’s obligation
balance on the statement of budgetary resources is overstated. These invalid obligations
overstated HUD’s unliquidated obligation balance by $86.4 million.

Housing Obligations Were Inactive or Expired
As of September 30, 2016, we noted $22,075,052 in Section 235-236 funds, $12,261,389 in
Section 202-811 funds, and $384,125 in project-based Section 8 funds that were identified to be
deobligated but were not. HUD did not adequately monitor and deobligate unliquidated balances
from these obligations, resulting in the unpaid obligation balance on HUD’s statement of
budgetary resources being potentially overstated by $34,720,566 million. See table 4.




grantees may continue to spend their remaining line of credit funds following expenditure deadlines with the
objective of satisfying the closeout criteria as quickly as possible.
73
   We consider an obligation inactive when there has been no activity in 1 year.
74
   The period of performance on these contracts ended December 15, 2011, September 3, 2014, and February 28,
2015.
75
   We considered activity after June 30, 2015 to be recent.



                                                       47
                                                  Table 4
                                        Invalid housing obligations
                                                                         $                  #
                   Section 235-236                                  $22,075,052           709
                   Section 202-811                                  12,261,389             53
                   Project-based Section 8                            384,125              23
                   Total                                            34,720,566            785

Program Offices Did Not Complete Their Deobligation Certifications in a Timely Manner
and Did Not Complete Deobligations Identified During the Departmental Review
The annual departmentwide obligation review and certification process is an essential part of
HUD’s internal controls over its funding and accurate financial reporting. This review gives
OCFO assurance that its fiscal yearend obligation balance is valid and accurately valued. To
ensure adequate time for the deobligation of any invalid obligations by the end of the fiscal year,
OCFO required program offices to review and certify their obligations by June 24, 2016. A
number of program offices completed their review and certified their obligations after the
deadline. As a result, offices may be unable to process deobligations before the end of the fiscal
year due to insufficient time.

In addition, several offices did not complete the deobligation of the invalid obligations they
identified. During the fiscal year 2016 review, offices marked 2,115 obligations with remaining
balances of $63.1 million for deobligation. Of these, 1,141 obligations with remaining balances
of $34.6 million were not closed out and deobligated by the end of the fiscal year. 76 We
attributed HUD’s inability to process all of the closeouts and deobligations by the end of the
fiscal year to delayed certifications and a lack of monitoring of obligations throughout the year.
Several HUD program offices relied on the annual OCFO-coordinated open obligations review
to assess all of their obligations and deobligate any invalid obligations. As we have reported in
prior years, while the OCFO-coordinated review is an important internal control, it was not
designed to be the sole control over open obligations because (1) the period for review and
deobligation is limited and (2) only obligations above the predetermined threshold 77 are required
to be reviewed.

As a result, HUD’s unpaid obligation balances on the statement of budgetary resources were
overstated by $34.6 million. HUD was working to close and deobligate these obligations, and
the associated funding should be recaptured during fiscal year 2017.

Prior-Year Recommendations Had Not Been Implemented
We noted that as of September 30, 2016, prior-year recommendations regarding deobligation
amounts of $100.5 million were outstanding. Therefore, HUD’s unpaid obligations on the

76
  Refer to Appendix B – Departmentwide Obligation Review – Schedule of Recommended Deobligations
77
  The threshold to be included in the open obligations review for administrative and program obligations is $23,000
and $243,000, respectively



                                                         48
statement of budgetary resources related to prior-year unimplemented recommendations were
overstated by $100.5 million. See table 5.

                                            Table 5
                    Office               Program                       $
                   Housing        Project-based Section 8       $52.5 million
                   Housing           Section 235-236             36.2 million
                   Housing           Section 202-811              1.3 million
                    CPD            Homeless assistance           10.5 million
                                   Total:                     100.5 million

Conclusion
HUD’s processes for (1) monitoring the validity and need for its unliquidated obligations and (2)
timely closeout of expired grants continued to not be fully effective during fiscal year 2016. We
identified $297.8 million tied to expired or inactive obligations or grants that had not completed
the closeout process. Additionally, HUD did not close out all of the obligations identified as
invalid by the end of the fiscal year. This condition resulted in $34.6 million in invalid
obligations remaining on HUD’s books at yearend. In total, HUD’s unliquidated obligation
balance on the statement of budgetary resources was potentially overstated by $332.4 million.
We also noted that as of September 30, 2016, HUD had not implemented prior-
yearrecommendations of $100.5 million, which also caused a potential overstatement on the
statement of budgetary resources.

Recommendations
We recommend that the Principal Deputy Assistant Secretary for Community Planning
Development

   8A. Close out and deobligate the remaining balances on 3,121 expired homeless assistance
       contracts of $151,719,152. Further, deobligate $10,996,784 in 234 program obligations
       marked for deobligation during the departmentwide open obligations review.

   8B. Review the status of the remaining balances on 1,356 expired ESG contracts totaling
       $17,986,109 and determine whether these balances should be recaptured.

   8C. Work with the Office of Policy Development and Coordination to issue and implement
       procedures to address undisbursed obligations on contracts after the 24-month
       expenditure period for the ESG program.
   8D. Prescribe a deadline date for closeout of NSP for rounds 1 and 3.
   8E. Research grants with no drawdown activity and if a bonafide need no longer exists, close
       out and deobligate remaining balances on the 16 grants with no drawdown activity
       totaling $6,966,585.




                                                 49
We recommend that the Principal Deputy Assistant Secretary for the Office of Housing-Federal
Housing Commissioner

   8F. Deobligate all obligations marked for deobligation during the departmentwide open
       obligations review, including as much as $18,290,686 in 307 administrative obligations
       and $3,420,032 in 202 program obligations marked for deobligation as of September 30,
       2016.

   8G. Review and if necessary deobligate the 785 expired or inactive Section 235-236, Section
       202-811, and Project Based Section 8 projects totaling $22,075,052, $12,261,389, and
       $384,125, respectively.

We recommend that the Chief Information Officer

   8H. Deobligate the $83,501 in 124 administrative obligations marked for deobligation
       during the departmentwide open obligations review.

We recommend the Chief Human Capital Officer

   8I. Deobligate the $360,907 in 125 administrative obligations marked for deobligation
       during the departmentwide open obligations review.

We recommend that the Chief Administrative Officer

   8J. Deobligate the $152,211 in 108 administrative obligations marked for deobligation during
       the departmentwide open obligations review.

We recommend that the Assistant Secretary for Fair Housing and Equal Opportunity

   8K. Deobligate all obligations marked for deobligation during the departmentwide open
       obligations review, including as much as $384,703 in 27 administrative obligations and
       $234,619 in 6 program obligations marked for deobligation as of September 30, 2016.

We recommend that the Assistant Secretary for Field Policy and Management

   8L. Deobligate the $85,782 in 5 administrative obligations marked for deobligation during
       the departmentwide open obligations review.

We recommend that HUD’s Chief Procurement Officer

   8M. Research the $13.6 million deobligation recorded in HIAMS for the Bank of New York
       Mellon and if it was executed, provide the signed contract to Ginnie Mae for recording
       in its general ledger.




                                              50
   8N. Implement a formal process to provide Ginnie Mae with all of the documentation it
       needs to record deobligations as soon as they are recorded in PRISMTM.

We recommend that Ginnie Mae’s Senior Vice President, Office of Management Operations,

   8O. Implement a formal process to periodically review obligations and when necessary,
       contact OCPO to execute deobligations.

   8P. Review the contracts totaling $72.8 million to determine validity and if no longer
       needed, forward to HUD’s procurement office for closure and deobligation.

We recommend that Ginnie Mae’s Chief Financial Officer

   8Q. Record the deobligations provided by OCPO totaling as much as $86.4 million for the
       contracts identified during our review. Additionally, Ginnie Mae should deobligate the
       $587,505 in three administrative obligations marked for deobligation during the
       departmentwide open obligations review.




                                               51
Finding 9: HUD’s Computing Environment Controls Had
Weaknesses
HUD’s computing environment, data centers, networks, and servers provide critical support to
all facets of its programs, mortgage insurance, financial management, and administrative
operations. In fiscal year 2016, we audited application controls over NCIS, which exchanges
data between the financial systems ARC Oracle Financials and HUD. We found that some
access controls within NCIS were not effective and some of the application security
documentation was inaccurate. These weaknesses occurred because of limited resources to
perform the required tasks. As a result, some contractors had inappropriate access to sensitive
budget and general ledger financial transactions. Further, inaccurate security documentation
could lead to inappropriate decisions. In addition, although HUD had taken action to address
information system control weaknesses reported in prior years, several of those weaknesses
remained. Without adequate general and application controls, there was no assurance that
financial management applications and the data within them were adequately protected.

Some Access Controls Within NCIS Were Not Effective
Some access controls within NCIS were not effective. Specifically, excessive privileges were
granted to two contractors in violation of the concept of least privilege. 78 These users were
granted the authority to access production data when their job functions did not require them to
have that level of access. They were also authorized to use the default admin user account within
Oracle for NCIS. The default admin user account was assigned to one user but was manually
transferred to another when the assigned user was unavailable. By default, this account had full
admin rights, which provided the contractor full control of the workspace.

NCIS audit logs for the end user and security administration functions provided information only
on user logins and whether they were successful or failed. There was no documentation on the
actions that the user took with these elevated privileges. Additionally, the Developer Activity by
User log, a log mentioned within the NCIS system security documentation, was not provided to
OCFO personnel that performed reviews of the audit logs and did not contain details regarding
the actions taken by the user. Also, NCIS audit logs for the database did not contain detailed
information on the actions the user took.

Due to limited resources within HUD, excessive privileges were granted to contractor personnel
that fully understood and could monitor the newly developed application. NCIS audit logs were
created for the initial functionality of the application. The number and significance of the
transactions processed through NCIS were increased with the implementation of release 3 of the
New Core Project, and the audit log functionality was not modified to address the additional
risks associated with a larger number of financially significant transactions resulting from these
changes.



78
  The principle of least privilege requires that users be granted the most restrictive set of privileges (or lowest
clearance) needed to perform authorized tasks (that is, users should be able to access only the system resources
needed to fulfill their job responsibilities).



                                                            52
The excessive access privileges granted to these contractors provided them inappropriate access
to sensitive budget and general ledger financial transactions and gave them the ability to access
the financial data, providing them with the ability to intentionally or accidentally delete or
modify the data. These users also had the ability to modify user accounts, which could lead to
the unauthorized granting of access to HUD users or contractor personnel. Allowing both
contractors to use the default admin user ID left HUD unable to definitively track actions to one
individual in accordance with policy.

Audit logs provide the ability to maintain a record of system, application, and user activity. In
conjunction with the appropriate tools and procedures, audit logs can assist in detecting security
violations, performance problems, and application flaws. Without appropriate audit logs, HUD
did not have a mechanism in place to track and associate user and system activity to events. Due
to inadequate logs over the security administration function, HUD was unable to determine when
or whether access modifications had been made or whether any actions taken were authorized.

Some of the New Core Interface Solutions’ Security Documentation Was Inaccurate
Some of the NCIS application security documentation was inaccurate. We identified the
following examples of instances in which system documentation was not updated to reflect the
current application.

   •   The NCIS system security plan (SSP) stated that NCIS’ Oracle database generates table-
       level audit logs, which automatically capture changes to table data, such as account
       creation, modification, disabling, and termination actions. The NCIS security testing and
       evaluation documentation, dated August 2015, stated that testing of the audit logs for the
       end user and security administrator contained information regarding who performed the
       action and when the action was completed. Our assessment of the end user and security
       administrator audit logs found that only user login information was maintained in the
       log.

   •   The NCIS SSP contained inaccurate information regarding the level of access provided to
       the security administration function. The SSP stated that the security administrator role
       was forced to use the workspace administrator access level to perform the security
       function level due to the design of the application and that this level of access gave the
       security administrator access to the development environment. This security weakness
       was reported as an issue with release 1 of NCIS. A plan to correct the item was created,
       and the issue was resolved in January 2015; however, the deficiency was reported in the
       current SSP.

   •   The NCIS SSP contained inaccurate information regarding the functionality of the
       application. The system description detailed the transfer of data between HUD and ARC;
       however, the description related to the processing that the system did for New Core,
       release 1, functionality and not release 3. The description detailed the transfer of travel
       transactions between the applications. These data are no longer transferred between the
       applications.




                                                 53
       •   The NCIS SSP identified five user roles for the application, while the NCIS Operations
           and Maintenance Manual identified eight user roles. The eight user roles identified in the
           NCIS Operations and Maintenance Manual, updated to reflect release 3.1 functionality,
           were consistent with the levels of access granted on the user access listing.

This condition occurred because OCFO did not enforce documentation requirements. OCFO has
continually made significant system modifications to the NCIS application since its
implementation in October 2014. The NCIS application was a significant part of the
implementation of a new core financial management system. Since the SSP established and
documented the security controls, it was supplemented by the assessment report, and the plan of
actions and milestones was the documentation that management reviewed. Inaccurate
information within this document could lead to inappropriate decisions.

Some Windows Servers 2008 User Accounts Were Not Adequately Managed
Some Windows Server 2008 user accounts were not adequately managed. We identified 31 user
accounts that did not require a password to sign on. The accounts were still active and had not
been disabled. According the OCIO, the accounts were inactive legacy accounts that existed on
the local servers, but no longer existed on the domain controller. The accounts were carried
forward during the upgrade from Windows 2003 to 2008. Inactive user accounts that remain
enabled can be an attractive target for attackers. This is because an inactive user account can be
leveraged to get access to resources without being noticed since it is a valid account that no
longer has an owner. Consequently, usage most likely would not be noted. When we brought
this issue to OCIO’s attention, steps were immediately taken to remove these accounts from the
local servers.

Information System Control Weaknesses Were Previously Identified in HUD’s Loan
Accounting System
LAS is based on a commercial-off-the-shelf product and was implemented in August 2006. LAS
is a mixed financial system that performs the direct loan-servicing activities required to support
HUD’s Section 202 Housing for the Elderly and Handicapped Loan Program, Section 201
Flexible Subsidy Program, Section 236 Excess Rental Income Program, Green Retrofit Program,
and EHLP. The system maintains the loan amortization schedules, generates the monthly
interest amounts due and principal amounts due, and applies collections to the interest and
principal amounts due, and all excess amounts are recorded in the project-loan suspense account.
In an audit conducted in fiscal year 2014, 79 we found that the EHLP data within LAS were
incomplete and inaccurate. Specifically, (1) the loan data in LAS were incomplete, (2) the loan
data initially entered into LAS were inaccurate, and (3) the process used by HUD to correct the
data for the HUD direct loan portion of the program may not result in accurate data. We found
that controls over the data transfer process for EHLP loan data were not secure. While a secure
Web site was established for the fiscal agents and States to send EHLP loan information to the
Office of Housing and OCFO, the fiscal agent and State grantees, which administered the



79
     2015-DP-0004, Review of the Loan Accounting System, issued December 9, 2014



                                                       54
program, were not required to transmit data via the secure Web site. In addition, controls to lock
out a user after three failed login attempts were not implemented.
We found that data changes were not adequately controlled in LAS and determined that some
access controls within LAS were not effective. Specifically, (1) the user recertification process
did not ensure that all users were included, (2) formal procedures for granting and removing user
access were not always followed, (3) excess privileges were granted to two users, and (4) audit
logs were not reviewed. Our audit revealed that the LAS configuration management plan was
outdated and that documentation for application interfaces with LAS was not consistent and
technical details required to operate the interfaces was not included in the documentation.

We followed up on the status of these weaknesses during fiscal year 2016. HUD took actions to
address the weaknesses identified with the process to make data changes, the configuration
management plan, access controls, the data transfer process, the review of audit logs, and the
revision of the user interface documentation. HUD continued to address the weaknesses
identified related to the EHLP data. These actions were scheduled to be completed during fiscal
year 2016 but are still in process. HUD expected to complete the corrective actions during fiscal
year 2017.

Information System Control Weaknesses Were Previously Identified in the IBM
Mainframe
The IBM mainframe houses many of HUD’s applications used to facilitate day-to-day
operations. The mainframe includes communication functionalities on multiple platforms that
provide information exchange services between users and applications. It permits authorized
HUD users to access data maintained on multiple applications and integrate the data into other
applications or process the information in its current form. In addition, the mainframe acts as a
gateway for authorized external organizations and agencies to access HUD-maintained data.
Major financial applications that operate on the IBM platform include (1) HUDCAPS, (2) the
Single Family Insurance Claims Subsystem, and (3) the Tenant Rental Assistance Certification
System.

Our review in fiscal year 2015 found 80 that HUD did not ensure that information system controls
over the IBM mainframe fully complied with Federal requirements and its own security policies.
Specifically,
     1. User accounts on the IBM mainframe were not properly managed. Members of the Help
        Desk had access to a powerful system utility when they had no business need for it.
        Additionally, two users had update privileges to datasets that were part of the IBM
        mainframe’s security application. These users had no business purpose for modifying
        these datasets. Users had these unnecessary privileges in their profiles because reviews
        of user access to the IBM mainframe did not include reviewing the user accounts to
        determine whether they followed the policy of least privilege. This failure to follow

80
  2016-DP-0001, Fiscal Year 2015 Review of Information System Controls in Support of the Financial Statements
Audit, issued November 13, 2015. This was a limited distribution report due to the sensitive nature of the
information reported, and was, therefore, not made available to the public.



                                                       55
        HUD’s IT security policy increased the risk that sensitive information could be exploited
        by malicious individuals, system integrity could be compromised, and data could be
        corrupted or disclosed.

     2. Existing vulnerabilities were not reported in system security documentation. This
        condition occurred because of an oversight by HUD’s IT support contractor. Failure to
        properly document open findings in risk assessments and security authorization
        documentation presents an inaccurate risk profile for the information system.

We followed up on the status of these weaknesses during fiscal year 2016. Eleven of the twelve
recommendations were addressed during the fiscal year. HUD planned to resolve the remaining
recommendation during the second quarter of fiscal year 2017.

Information System Control Weaknesses Were Previously Identified in HUD’s Intranet
General Support System
In an audit conducted in fiscal year 2014, 81 we reviewed controls over HUD’s Intranet general
support system. We found that OCIO did not have documentation that sufficiently defined the
segregation of duties or procedures for evaluating compliance with the segregation of duties for
users with above-read access to the Intranet general support and its interconnected systems. We
also found that security management documentation was not always complete, accurate, or
current. Not all security management program documents were updated to reflect current
conditions; some information on HUD’s IT security Web site was outdated, inaccurate, or
unavailable; and minor applications did not have valid authorizations to operate.

We followed up on the status of these weaknesses during fiscal year 2016. HUD had taken
action to correct segregation of duties and security management weaknesses and planned to
address the one open recommendation during the second quarter of fiscal year 2017.

Conclusion
HUD’s computing environment provides critical support to all facets of its program, mortgage
insurance, financial management, and administrative operations. During fiscal year 2016, as in
prior years, we continued to identify information systems control weaknesses that could
negatively affect HUD’s ability to accomplish its assigned mission, protect its data and IT assets,
fulfill its legal responsibilities, and maintain its day-to-day functions. As a result, we continue to
report a significant deficiency for HUD’s computing environment.




81
 2015-DP-0005, Fiscal Year 2014 Review of Information Systems Controls in Support of the Financial Statements
Audit, issued February 24, 2015



                                                      56
Recommendations

We recommend that the Office of the Chief Financial Officer
   9A. Remove access granted to developer contractor personnel to the production database.

   9B. Prohibit developer user ID sharing and create an additional user ID for system
       administration within the developer environment.

   9C. Establish audit logs that track user activity for the security administration functions and
       once established, ensure that they are monitored in accordance with policy.

   9D. Establish audit logs that track user activity for privileged users within the production
       environment and once these logs are established, ensure that they are monitored in
       accordance with policy.

   9E. Review and update the NCIS documentation to reflect the current state of the system and
       ensure that the most recent documents are made available to the users.

   9F. Establish and implement procedures to ensure that the updated documentation remains
       current.




                                                 57
Compliance With Laws and Regulations
In fiscal year 2016, we found instances in which HUD did not ensure that transactions were
executed in accordance with laws governing the use of budget authority and with other laws and
regulations that could have a direct and material effect on the financial statements and any other
laws, regulations, and governmentwide policies identified in OMB audit guidance.




                                                 58
Finding 10: HUD’s Financial Management System Did Not Comply
With the Federal Financial Management Improvement Act
In fiscal year 2016, we noted a number of instances of FFMIA noncompliance within HUD’s
financial management system. HUD’s continued noncompliance was due to New Core Project
implementation challenges and a reliance on a number of legacy financial systems.

HUD Did Not Always Comply With FFMIA
FFMIA, section 803(a), requires chief financial officer agencies to establish and maintain
financial management systems that comply substantially with (1) Federal financial management
systems requirements, (2) applicable Federal accounting standards, and (3) the USSGL at the
transaction level. FFMIA also requires agencies and their auditors to determine annually
whether an agency’s financial management system (including primary or general ledger
accounting systems and subsidiary or “mixed” systems) complies with those requirements.

As of September 30, 2016, we noted instances in which HUD did not comply with the three
section 803(a) elements of FFMIA. We tested compliance with FFMIA in accordance with
OMB Circular No. A-123, Appendix D, Compliance with the Federal Financial Management
Improvement Act of 1996. 82

HUD also concluded that the agency and its financial management system did not comply with
each element of FFMIA. Refer to table 6 for details.

                                          Table 6
                     Compliance with Section 803(a) elements of FFMIA
                                           Agency                 Auditor
                                     Lack of compliance     Lack of compliance
            1. System requirements
                                            noted                  noted
                                     Lack of compliance     Lack of compliance
            2. Accounting standards
                                            noted                  noted
            3. USSGL at transaction  Lack of compliance     Lack of compliance
            level                           noted                  noted


As of Septemer 30, 2016, HUD reported noncompliance with the requirements of FFMIA. For
areas of FFMIA noncompliance, each agency must identify remediation activities that are
planned and underway, describing target dates and offices responsible for bringing systems into
compliance with FFMIA.83 Refer to HUD’s 2016 agency financial report for additional details.



82
   OMB Memorandum M-13-23 (OMB Circular A-123, appendix D) (September 20, 2013, accessed October 22,
2016); http://www.whitehouse.gov/sites/default/files/omb/memoranda/2013/m-13-23.pdf
83
   OMB Circular A-136, Revised (October 7, 2016, accessed October 22, 2016);
https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a136/a136_revised_2016.pdf



                                                   59
In addition, when auditors disclose a lack of compliance with one or more of the section 803(a)
requirements, FFMIA requires that auditors provide additional details regarding the
noncompliance. 84 Refer to appendix C for additional details.

As the combined impact of HUD’s system limitations expands beyond the scope of the updated
FFMIA framework, the system flaws identified as instances of FFMIA noncompliance are
further described in the Internal Control section of this report as deficiencies contributing to a
related material weakness. (See Finding 5 – Financial Management System Weaknesses.)

Conclusion
HUD’s financial management system did not comply with FFMIA as of September 30, 2016.
Specifically, we noted instances in which HUD did not comply with the three section 803(a)
elements of FFMIA.

Recommendations
There are no new recommendations in this area.




84
  OMB Bulletin 15-02, Audit Requirements for Federal Financial Statements (August 4, 2015, accessed October 22,
2016); https://www.whitehouse.gov/sites/default/files/omb/bulletins/2015/15-02.pdf




                                                       60
Finding 11: HUD Continued To Not Comply With the HOME
Investment Partnership Act
HUD continued to not comply with section 218(g) of the HOME Investment Partnership Act
(also known as the HOME Statute) regarding grant commitment requirements. HUD’s
misinterpretation of the plain language in the Act, the implementation of the cumulative method
and the FIFO technique, and the current recapture policies continued to result in HUD’s
noncompliance with HOME Statute requirements. As a result, HUD continued to incorrectly
permit some jurisdictions to retain, commit, and disburse HOME Investment Partnerships
Program grant funds beyond the statutory deadline. HUD will continue to be noncompliant with
related laws and regulations until the cumulative method is no longer used to determine whether
grantees meet commitment deadlines required by the HOME Statute. Allowing grantees to
disburse funds from commitments made outside the 24-month statutory period may have caused
HUD to incur improper payments.

HUD Policies Did Not Comply With the HOME Statute
The HOME Statute required HUD to establish a HOME Investment Trust Fund for each
participating jurisdiction (grantee), with a line of credit that included the grantee’s annual
allocation. The Statute also required each grantee to place all of its annual allocation’s funds
under a binding commitment within 24 months after it received its line of credit. Failure to do
so would result in the grantee’s losing its right to draw any funds that were not placed under
binding commitment within the 24 months and required HUD to make such reductions and
reallocate the funds as soon as possible.

HUD implemented a flawed process, called the cumulative method, to determine a grantee’s
compliance with the requirements of section 218(g) of the Statute and determine the amount to
be recaptured and reallocated with section 217(d). HUD measured compliance with the
commitment requirement cumulatively, disregarding the allocation year used to make the
commitments.

Further, as discussed in finding 4 of this report, HUD also implemented the FIFO method to
commit HOME program funds, which made it difficult to determine which commitments were
made during the 24-month period. We continued to find this FIFO method to be a departure
from Federal GAAP.

Our audit results indicated that the use of a noncumulative method would result in a number of
grantees that would not meet the 24-month commitment deadline, resulting in grant funds that
could possibly have been recaptured and reallocated. We determined the commitment status,
based on a noncumulative approach, for 460 grantees for the 2014 annual allocation commitment
requirement and noted that 301 grantees had met the commitment requirement based on HUD’s
cumulative method but did not meet the requirement based on OIG’s noncumulative
method. We also noted that 46 grantees did not meet the requirement based on either
method. This discrepancy resulted in a total net difference of $97 million, which should have
been recaptured and reallocated if HUD had used the noncumulative calculation and grantees did
not provide evidence to support commitments that were not entered into IDIS Online.



                                                 61
Use of the Cumulative Method May Have Caused Improper Payments
During the fiscal year 2015 audit, 85 we determined that grantees that should have been
considered noncompliant with the HOME Statute under the noncumulative method had
disbursed approximately $950,000 from the commitments they made after their 24-month
commitment deadline expired. We believe that the $950,000 disbursed from commitments
outside the 24-month statutory period meets the criteria of an improper payment. According to
OMB Circular A-123, appendix C, an improper payment is any payment that should not have
been made or that was made in an incorrect amount under statutory, contractual, administrative,
or other legally applicable requirements.

We made recommendations during the fiscal year 2015 financial statement audit to (1)
implement a payment recapture audit for the HOME program, specifically, to identify and
recapture improper payments made as a result of the continued use of the cumulative method and
include the HOME program in the next annual improper payment risk assessment, and (2) ensure
that the impact of the cumulative method to meet commitment deadlines is included in the risk
assessment process to evaluate the susceptibility to significant improper payments. However, as
of September 30, 2016, we had not reached an agreement with OCFO on these
recommendations. As a result, they were referred to the Deputy Secretary for a decision on
September 20, 2016.

Changes To Eliminate the Cumulative Method Were Underway
In fiscal year 2013, CPD agreed to implement changes to IDIS Online to eliminate the FIFO
method for fiscal year 2015 CPD formula grants (including the HOME program) beginning
September 30, 2014. CPD stated that once the applicable changes were made to the HOME
regulations and IDIS Online, HUD would stop using the cumulative method for determining
compliance with the HOME 24-month commitment requirement for fiscal year 2015 grants and
forward. In doing so, CPD would comply with section 218(g) of the HOME Statute for grants
obligated after the system changes are implemented. Despite our position to have changes
applied prospectively as well as retroactively, CPD decided that compliance with the 24-month
statutory commitment requirement for funds obligated before the system and regulatory changes
would still be determined on a cumulative basis. For funds obligated after the system and
regulatory changes, compliance would be determined on a grant-specific basis.

In fiscal year 2015, steps to eliminate the FIFO logic and cumulative method from IDIS Online
were stopped due to budget shortfalls. By late fiscal year 2015, HUD was able to authorize the
additional funds to restart the project and as of September 30, 2016, planned to complete all
deliverables by May 2017. Among the remaining work, modifications to IDIS are still necessary
for the system to comply with FFMIA and the USSGL at the transaction level, which includes
ensuring that IDIS Online ties disbursements to specific commitments for the HOME program.




85
 Audit Report 2016-FO-0003, Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
Department of Housing and Urban Development Financial Statement Audit, issued November 18, 2015



                                                     62
Conclusion
Among the remaining work left to complete in the FIFO elimination plan, CPD must ensure that
IDIS ties disbursements to specific commitments for the HOME program so that compliance
with the HOME Statute can be made on a grant-by-grant basis. However, because the changes
will be implemented only for fiscal year 2015 grants and forward, HUD will continue to be
noncompliant with the HOME Statute until the cumulative method is no longer used to
determine whether commitment deadlines required by the Statute are met by the grantees. As a
result, we will continue to report that HUD is noncompliant with related laws and regulations
until the cumulative method is no longer used.

Recommendations
Prior-year recommendations regarding this finding remained open and can be referred to in the
Followup on Prior Audits section of this report. We have no new recommendations in this
report.




                                               63
Finding 12: HUD Did Not Comply With Treasury Financial
Manual Rules on Cash Management or 2 CFR Part 200
Since the implementation of its cash management policies in fiscal year 2013, PIH has made
significant progress toward compliance with Treasury Financial Manual rules on cash
management. 86 However, despite considerable efforts by HUD’s Office of Housing Voucher
Programs, PHAs continued to maintain Federal cash in excess of their immediate disbursement
need for extended periods. Specifically, MTW PHAs held between $432.4 million and $466.5
million for most of the fiscal year and even after offsets performed in August and September
2016, held $212 million in excess of their immediate disbursement needs. Further, PHAs
accumulated $168.3 million from January to June 2016 and most likely accumulated additional
excess funds from July through September, 87 all of which had not been offset as of September
30, 2016. These conditions occurred because HUD lacked an automated system and real-time
expense data needed to fully implement its cash management policies. Since PHAs maintained
these funds in excess of immediate disbursement need for extended periods and were unable to
quickly offset the funds against future disbursements, HUD did not comply with Treasury’s cash
management regulations 88 or 2 CFR Part 200, 89 increasing the risk of funds being susceptible to
fraud, waste, and abuse.

PIH’s Cash Management Process Did Not Offset Excess Accumulations in a Timely
Manner
PIH’s cash management process continued to be primarily manual, which did not allow for
offsets of excess accumulations in a timely manner. 90 For example, HUD provided non-MTW
PHAs $159.8 million in excess funding from October to December 2015 but did not offset it
until 5 to 7 months later (May, June, and July 2016). HUD also identified $168.3 million 91 in


86
   Before fiscal year 2013, HUD provided housing assistance payments to its PHAs that far exceeded PHAs’ need
and did not have a process in place to offset excess funding. To address this problem, PIH implemented the
following cash management polices: (1) determine future disbursement based on previous need, (2) perform
quarterly cash reconciliations and offset excess funding as it is identified, and (3) offset amounts that accumulated
before the implementation of these new processes.
87
   PIH had not completed a reconciliation to determine the accumulations from July through September; however,
historically, the reconciliations have identified overpayments; therefore, it is likely that additional amounts
accumulated during this period.
88
   Treasury Financial Manual, Vol. 1, Part 4A, Section 2045.10, Cash Advances Establishing Procedure for Cash
Advances, section 3, states, “It is the responsibility of grantor agencies to monitor the cash management practices of
their recipient organizations to ensure that Federal cash is not maintained by them in excess of immediate disbursing
needs. Agencies must establish systems and procedures to assure that balances are maintained commensurate with
immediate disbursing needs, excess balances are promptly returned to the Treasury; and advance funding
arrangements with recipient organizations unwilling or unable to comply are terminated.”
89
   Regulations at 2 CFR 200.305 state, “For non-Federal entities other than States, payments methods must minimize
the time elapsing between the transfer of funds from the United States Treasury or the pass-through entity and the
disbursement by the non-Federal entity.” The regulations further state, “Advance payments to a non-Federal entity
must be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash
requirements of the non-Federal entity in carrying out the purpose of the approved program or project.”
90
   See finding 5 for more information on the manual process and system limitations.
91
   $141.4 in excess funding for non-MTW provided from January to June and $26.924 million in excess funding
provided to MTW PHAs from April to June



                                                          64
excess funding for non-MTW and MTW PHAs provided between January and June 2016 but had
not offset it against future disbursements as of September 30, 2016. Completion of cash
reconciliations to identify excess accumulations and the performance of offsets against future
disbursements were delayed because it took a significant amount of time for PIH to determine
how much PHAs spent and how much should be offset due to the manual nature of the process.
Without an automated system that provides real-time expense information and automatically
calculates offsets, the cash reconciliation process will continue to delay the completion of excess
accumulation offsets. As discussed in finding 5, we previously recommended that PIH
implement a system to automate the process. However, as of the date of this report, HUD had
not provided an adequate management decision on how it planned to address this
recommendation. This recommendation was referred to the Deputy Secretary for a decision on
March 31, 2015. As of the end of fiscal year 2016, a decision had not been provided.

MTW PHAs Held Excess Funds for Most of the Fiscal Year, and the Transition to HUD
Reserves Was Not Complete
Before fiscal year 2016, PIH transitioned precash management 92 accumulation from non-MTW
PHAs; however, it had not transitioned any precash management accumulations from MTW
PHAs. At the end of fiscal year 2015, PHAs reported that they were holding $466.5 million in
Housing Choice Voucher program funds under the MTW program and $432.4 million as of
March 31, 2016. PIH reviewed these balances to verify that PHAs reported correctly and
planned to offset $251 million of the $432.4 million validated as excess funding. However, PIH
could not offset the full amount in fiscal year 2016 and offset $218.2 million in August and
September 2016. PHAs spent another $2.2 million, leaving $212 million in excess funds being
held at the PHAs as of September 30, 2016. PIH also planned to offset $32.9 million in October,
November, and December 2016, leaving a remaining balance of $179.2 million held at PHAs. 93
While this is an important step toward achieving compliance with Treasury’s cash management
rules, HUD remained noncompliant because (1) the offsets could not be performed until August
and September 2016, resulting in MTW PHAs holding excessive funding for most of the fiscal
year, and (2) PIH did not transition the full amount it had identified as excess. Offsets totaling
$218.1 million could not be performed until August and September 2016 because it took
considerable time and effort to validate MTW PHA balances, which were self-reported because
(1) HUD had not previously tracked these amounts and (2) MTW PHAs are allowed to comingle
housing assistance payment funding with other MTW funds, making it difficult to determine
excess Housing Choice Voucher program funding. PIH could not offset the full amount because
(1) the original planned disbursements were not large enough to cover the full amount and (2)
PHAs disputed that the remaining balance of $179.2 million could be offset.

PHAs disputed $179.2 million of the balance they initially reported as of March 31, 2016,
because they stated that they had upcoming expenses, owed money to other programs, or needed



92
   PIH implemented cash management in 2013 using the policies noted in footnote 1. For MTW PHAs, PIH
implemented the first step but had not offset excess funding that accumulated before the change in its disbursement
policies.
93
   At the time of this report, we could not confirm whether the offsets had been performed.



                                                          65
to keep a portion of the reserve based on the appropriation language. 94 While PIH stated that it
did not agree that the appropriations language allowed PHAs to keep a portion of the reserve, it
did not transition the full amount for PHAs that used this reasoning to contest the planned offset.
Without a system to track expense information in real time, it is difficult for HUD to validate
MTW excess funds and contested balances.

Conclusion
PIH’s Office of Housing Voucher programs had made significant progress in coming into
compliance with Treasury’s cash management rules. However, since the cash management
process is still primarily manual, PHAs maintained Federal cash in excess of their immediate
disbursement need for extended periods. Specifically, MTW PHAs held between $432.4 million
and $466.5 million in funds in excess of their immediate disbursement needs for most of the
fiscal year and still held $212 million as of September 30, 2016. Further, PHAs accumulated
$168.3 million from January to June 2016 and most likely accumulated additional funding from
July through September, 95 none of which had been offset as of September 30, 2016. Since PHAs
maintained these funds in excess of immediate disbursement need for extended periods, HUD
did not comply with Treasury’s cash management regulations 96 or 2 CFR Part 200, 97 and funds
remained at risk of fraud, waste, and abuse. Without an adequate system to perform the cash
management process, HUD’s ability to identify and offset excess accumulations will continue to
be delayed and be at risk for noncompliance with Treasury’s cash management rules.


Recommendations
Several prior-year recommendations regarding this finding for the Housing Choice Voucher
program remained open and can be referred to in the Followup on Prior Audits section of this
report. In addition to the prior-year findings, we have the following new recommendation.



94
   In reference to the MTW agreements, the Consolidated Appropriations Act, 2016 (Public Law 11-113) stated,
“…agreements shall prohibit any statutory offset of any reserve balances equal to 4 months of operating expenses.
Any such reserve balances that exceed such amount shall remain available to any such agency for all permissible
purposes under such agreement unless subject to statutory offset.” While PIH is “offsetting reserves,” these are not
real offsets because the money is still available to the PHA; it is just maintained at HUD. The offsets in the
appropriation language regard offsets in which the money is sent back to the Treasury. PIH agreed with this
interpretation.
95
   PIH had not completed a reconciliation to determine the accumulations from July through September; however,
since the reconciliations reveal overpayments, it is likely that additional amounts accumulated during this period.
96
   Treasury Financial Manual, Vol. 1, Part 4A, Section 2045.10, Cash Advances Establishing Procedure for Cash
Advances, section 3, states, “It is the responsibility of grantor agencies to monitor the cash management practices of
their recipient organizations to ensure that Federal cash is not maintained by them in excess of immediate disbursing
needs. Agencies must establish systems and procedures to assure that balances are maintained commensurate with
immediate disbursing needs, excess balances are promptly returned to the Treasury; and advance funding
arrangements with recipient organizations unwilling or unable to comply are terminated.”
97
   Regulations at 2 CFR 200.305 state, “For non-Federal entities other than States, payments methods must minimize
the time elapsing between the transfer of funds from the United States Treasury or the pass-through entity and the
disbursement by the non-Federal entity.” The regulations further state, “Advance payments to a non-Federal entity
must be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash
requirements of the non-Federal entity in carrying out the purpose of the approved program or project.”



                                                          66
We recommend that the Assistant Secretary for Public and Indian Housing
       12A.   Complete any outstanding validation reviews and transition back as much as
              $168.3 million in Housing Choice Voucher program funding from PHAs.




                                              67
Finding 13: HUD Did Not Comply With the Improper Payments
Elimination and Recovery Act of 2010
HUD OIG’s Improper Payments Elimination and Recovery Act (IPERA) audit 98 found that HUD
did not comply with IPERA in fiscal year 2015 because it did not conduct its annual risk
assessment in accordance with OMB guidance or meet its annual improper payment reduction
target. Specifically, HUD did not assess all low-risk programs on a 3-year cycle or consider all
nine required risk factors, making the review incomplete and noncompliant with section
3(a)(3)(B) of IPERA. HUD also failed to meet or exceed the annual improper payment reduction
targets for its high-priority program, Rental Housing Assistance Programs (RHAP), causing
noncompliance with section 3(a)(3)(E) of IPERA. This is the third year in a row that HUD did
not comply with IPERA. Additionally, we found that information published in the agency
financial report (AFR) did not meet the reporting requirements of OMB Circular A-136,
significant improper payments in HUD’s RHAP continued, and HUD’s improper payment
estimate and methodology for RHAP continued to have deficiencies during fiscal year 2015.

HUD Did Not Perform Risk Assessments in Accordance With OMB Guidance
HUD did not (1) assess all low-risk programs on a 3-year cycle and (2) consider all nine required
risk factors. Beginning in 2006, OCFO determined that programs with expenditures of $40
million or less would be removed from the scope of the risk assessment because it did not
believe any of HUD’s programs were susceptible to having an error rate in excess of 25
percent. 99 We identified two programs that had not had a risk assessment performed because
their expenditures did not reach $40 million in a given year. We also identified one Ginnie Mae
program that had never been assessed.

Additionally, OCFO could not provide evidence that its risk assessment considered all of the
required risk factors, and the risk assessment report was incomplete in documenting its
consideration of five of the nine required risk factors.

HUD Did Not Meet Its Fiscal Year 2015 Improper Payment Reduction Target on Its Rental
Housing Assistance Programs
For fiscal year 2015, HUD’s improper payment target rate for RHAP was 3.1 percent, but the
improper payment rate realized was 4.01 percent. HUD’s continued inability to address the root
causes of its RHAP improper payments and implementation of OIG’s previous audit
recommendations remain the fundamental reason why it did not meet its fiscal year 2015
reduction targets.

HUD’s Scope and Disclosure for Payment Recapture Audits Were Incomplete
The scope and disclosure of HUD’s agencywide payment recapture audit plan were incomplete.
Specifically, HUD lacked support to show that all of its programs and activities that spent $1
million or more during the fiscal year were either considered for payment recapture audits or


98
   Audit Report 2016-FO-0005, Compliance With the Improper Payments Elimination and Recovery Act, issued
May 13, 2016
99
   25 percent of $40 million = $10 million



                                                     68
excluded based on cost-benefit considerations. In fiscal year 2015, HUD submitted its
justification and cost-benefit analysis for the programs for which it determined a payment
recapture audit would not be cost effective to OMB. The justification and cost-benefit analysis
were incomplete because they were done on a program office level and not on an individual
program and activity level as required. Additionally, HUD failed to disclose a complete list of
the programs excluded from its payment recapture audit plan, along with its justification and
analysis for excluding them, in its fiscal year 2015 AFR. This disclosure was required under
OMB Circular A-123, appendix C, part I, section (D)(6).

HUD’s Improper Payment Estimate and Reporting for Its High-Priority Program
Remained a Concern
HUD’s RHAP improper payment estimate reported in the fiscal year 2015 AFR may not be
accurate. Specifically, our concerns were based on HUD’s incorrect billing error adjustment
made in fiscal year 2015 and HUD’s continued reporting of a combined RHAP improper
payment rate instead of separate improper payment rates for each of the three RHAP
components. Both issues were repeat findings from previous audits. In response to one of our
prior-year audit recommendations, HUD attempted in fiscal year 2015 to adjust the billing error
for inflation, but HUD staff incorrectly adjusted it by only 1 year and used the incorrect
percentage to make the adjustment. HUD continued to report a combined improper payment rate
for the three components of RHAP in the AFR, which may have masked increases in the
improper payment rate for one or more of the components. OMB Circular A-123, appendix C,
prohibits agencies from grouping programs or activities in a way that masks significant improper
payment rates. We have reported on this issue in prior audit reports. Recommendations to
separate the rates by program remained unimplemented.

HUD Did Not Fully Comply With Reporting Requirements
HUD’s reporting for supplemental measures, corrective actions, accountability, and the root
cause category matrix in its fiscal year 2015 AFR did not fully comply with the reporting
requirements of OMB Circular A-136. Additionally, HUD did not identify or report high-dollar
overpayments for RHAP in compliance with Executive Order 13520. This noncompliance
occurred because HUD was in the process of addressing our prior-year audit recommendations
regarding the reporting of improper payments for deceased tenants, accountability, supplemental
measures, and corrective actions. Additionally, HUD did not keep up with changes in OMB
guidance regarding the reporting of high-dollar overpayments.

These conditions occurred because although OCFO developed and implemented the “IPERIA
AFR Requirements Checklist” to help ensure that improper payment reporting in the fiscal year
2015 AFR was complete and complied with OMB Circular A-136 requirements, there were
issues with the implementation of the checklist. Additionally, HUD was in the process of
determining how it would obtain the information necessary to report on high-dollar
overpayments for RHAP.

Significant Improper Payments in Rental Housing Assistance Programs Continued
An improper payment is any payment that should not have been made or that was made in an
incorrect amount under statutory, contractual, administrative, or other legally applicable



                                                69
requirements. HUD’s RHAP, consisting of (1) Public Housing Operating Subsidy, (2) Section 8
Housing Choice Voucher and Modern Rehabilitation, and (3) multifamily owner-administered
project-based programs, continued to report significant amounts of improper payments. OMB
Circular A-123, appendix C, 100 defines significant improper payments as gross annual improper
payments in the program exceeding (1) both 1.5 percent of program outlays and $10 million of
all program or activity payments made during the fiscal year reported or (2) $100 million
(regardless of the improper payment percentage of total program outlays).

HUD’s most recent contracted quality control study 101 for fiscal year 2015 estimated that
program administrator error contributed to gross improper payments of $183.3 million in public
housing, $400.8 million in Section 8 Housing Choice Voucher and Modern Rehabilitation, and
$163.8 million in multifamily owner-administered project-based programs. Improper payments
due to tenants’ intentionally not reporting income amounted to $155.8 million in Public Housing
Operating Subsidy, $243.2 million in Section 8 Housing Choice Voucher and Modern
Rehabilitation, and $145.4 million in multifamily owner-administered project-based programs.
HUD also performed billing studies in fiscal year 2016 and estimated that improper payments
due to billing errors were $270.7 million for its multifamily owner-administered project-based
programs and $138.9 million in its PHA-administered programs, including public housing and
Section 8 Housing Choice Voucher and Modern Rehabilitation. In total, HUD made an
estimated $1.7 billion in improper payments during fiscal year 2015.

Conclusion
HUD did not comply with IPERA for fiscal year 2015 because it did not (1) conduct its annual
risk assessment in accordance with OMB guidance and (2) meet its annual improper payment
reduction target. Additionally, HUD’s reporting on improper payments did not comply with
reporting requirements. As a result, HUD officials and other users of the AFR, including
Congress and OMB, did not have a complete and accurate picture of HUD’s improper payments
and recovery efforts for use in policy-making decisions. If HUD does not address its
noncompliance with IPERA, it will continue to miss opportunities to prevent, identify, and
recover improper payments.

Recommendations
Recommendations were included in a separate OIG audit report. Therefore, no
recommendations are reported here.




100
   Requirements for Effective Estimation and Remediation of Improper Payments
101
   FY [fiscal year] 2015 Quality Control for Rental Assistance Subsidy Determinations, issued August 31, 2016.
This report was produced for HUD by ICF International. The study was based on analyses of a statistical sample of
tenant files, tenant interviews, and third-party documents verifying income.



                                                        70
Scope and Methodology
We are required by the Chief Financial Officers Act of 1990, as amended by the Government
Management Reform Act of 1994 and implemented by OMB Bulletin 15-02, Audit
Requirements for Federal Financial Statements, to audit HUD’s principal financial statements,
which consist of the consolidated balance sheets as of September 30, 2016 and 2015 (restated);
the related consolidated statements of net cost, changes in net position, and combined statement
of budgetary resources for the fiscal years then ended; and the related notes to the financial
statements.
We considered internal controls over financial reporting by obtaining an understanding of the
design of HUD’s internal controls, determined whether these internal controls had been placed
into operation, assessed control risk, and performed tests of controls to determine our auditing
procedures for the purpose of expressing an opinion on the principal financial statements. We
also evaluated the internal controls in place at HUD’s FSSP, ARC, to determine whether the
FSSP’s internal controls could be relied upon. We tested compliance with selected provisions of
applicable laws, regulations, and government policies that may materially affect the consolidated
principal financial statements. The tests performed were not to provide assurance on these
internal controls, and, accordingly, we do not provide assurance or an opinion on such controls.
We did not evaluate the internal controls relevant to operating objectives as broadly defined by
FMFIA. We limited our internal controls testing to those controls that are material in relation to
HUD’s financial statements. Because of limitations inherent in any internal control structure,
misstatements may occur and not be detected. We also caution that projection of any evaluation
of the structure to future periods is subject to the risk that controls may become inadequate
because of changes in conditions or that the effectiveness of the design and operation of policies
and procedures may deteriorate.
Our consideration of the internal controls over financial reporting would not necessarily disclose
all matters in the internal controls over financial reporting that might be significant deficiencies.
We noted certain matters in the internal control structure and its operation that we considered to
be significant deficiencies under OMB Bulletin 15-02.
We considered HUD’s internal controls over required supplementary stewardship information
reported in HUD’s fiscal year 2016 AFR by obtaining an understanding of the design of HUD’s
internal controls, determined whether these internal controls had been placed into operation,
assessed control risk, and performed limited testing procedures as required by the American
Institute of Certified Public Accountants and U.S. Auditing Standards, AU-C, Section 730,
Required Supplementary Information. The tests performed were not to provide assurance on
these internal controls, and, accordingly, we do not provide assurance or an opinion on such
controls.
With respect to internal controls related to performance measures to be reported in
management’s discussion and analysis and HUD’s fiscal year 2016 AFR, we obtained an



                                                  71
understanding of the design of significant internal controls relating to the existence and
completeness assertions. We performed limited testing procedures as required by AU-C, Section
730, Required Supplementary Information, and OMB Bulletin 15-02, Audit Requirements for
Federal Financial Statements. Our procedures were not designed to provide assurance on
internal controls over reported performance measures, and, accordingly, we do not provide an
opinion on such controls.
To fulfill these responsibilities, we

•   Examined, on a test basis, evidence supporting the amounts and disclosures in the
    consolidated principal financial statements;
•   Assessed the accounting principles used and the significant estimates made by management;
•   Evaluated the overall presentation of the consolidated principal financial statements;
•   Obtained an understanding of internal controls over financial reporting (including
    safeguarding assets) and compliance with laws and regulations (including the execution of
    transactions in accordance with budget authority);
•   Tested and evaluated the design and operating effectiveness of relevant internal controls over
    significant cycles, classes of transactions, and account balances;
•   Tested HUD’s compliance with certain provisions of laws and regulations; governmentwide
    policies, noncompliance with which could have a direct and material effect on the
    determination of financial statement amounts; and certain other laws and regulations
    specified in OMB Bulletin 15-02, including the requirements referred to in FMFIA;
•   Considered compliance with the process required by FMFIA for evaluating and reporting on
    internal controls and accounting systems; and
•   Performed other procedures we considered necessary in the circumstances.

Under standards issued by the American Institute of Certified Public Accountants, a deficiency
in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent or detect and
correct misstatements on a timely basis. A significant deficiency is a deficiency or a
combination of deficiencies in internal control that is less severe than a material weakness yet
important enough to merit attention by those charged with governance.
A material weakness is a deficiency or combination of deficiencies in internal controls, such that
there is a reasonable possibility that a material misstatement of the financial statements will not
be prevented or detected and corrected on a timely basis.
Our work was performed in accordance with generally accepted government auditing standards
and OMB Bulletin 15-02. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objective(s). We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objective.




                                                 72
Followup on Prior Audits
Not included in the recommendations listed after each finding are recommendations from prior-
year reports on HUD’s financial statements that have not been fully implemented based on the
status reported in the Audit Resolution and Corrective Action Tracking System. Specifically, we
identified 93 unimplemented recommendations from prior-year reports, dating back to the audit
of the fiscal years 2010 and 2009 financial statements. Fifty-six of the unimplemented
recommendations were overdue for final action as of the date of this report (17 recommendations
did not have final action target dates because an agreed-upon action plan had not been
determined at the time of this report). Each of these open recommendations and its status is
shown below.



 Followup on prior audits
  Audit
         Program                                                         Final action target
 report-             Open recommendations
            office                                                              date
  rec #
 Additional Details To Supplement Our Fiscal Years 2015 and 2014 (Restated) U.S.
 Department of Housing and Urban Development Financial Statement Audit, 2016-FO-
 0003
  2016-
                     Evaluate the IHBG investment process and
   FO-
           OCFO implement a proper accounting treatment in                      N/A
  0003-
                     accordance with Federal GAAP.
  002-A
                     Work with the Office of Native American
  2016-
                     Programs to calculate the amounts advanced to
   FO-
           OCFO grantees and restate HUD’s financial statements to              N/A
  0003-
                     recognize the prepayments on the financial
  002-B
                     statements.
                     Develop standard operating procedures for
  2016-
                     routinely obtaining information on grantee
   FO-
           OCFO investment activity and accurately reporting                    N/A
  0003-
                     amounts in HUD’s general ledger and financial
  002-C
                     statements.
  2016-              Establish a process to track the amount HUD owes
   FO-               to PHAs to cover prepayment shortages and
             PIH                                                                N/A
  0003-              provide the information to OCFO so that it can be
  002-D              properly recognized as accounts payable.
  2016-              Develop a tracking function for the payments
   FO-               advanced to IHBG recipients to facilitate financial
             PIH                                                                N/A
  0003-              reporting and monitoring compliance with grant
  002-E              time restrictions.


                                               73
2016-            Assign adequate resources to identify and resolve
 FO-    Ginnie   incorrect transactions in GFAS so that the system
                                                                        3/21/2-17
0003-    Mae     can be used for reliable financial reporting of
004-A            Ginnie Mae’s budgetary resources.
2016-
 FO-    Ginnie   Promptly complete all reconciliation processes to
                                                                        3/21/2-17
0003-    Mae     determine the root causes of incorrect balances.
004-B
                 Based on root causes identified, make necessary
2016-
                 adjustments to the system configurations in GFAS
 FO-    Ginnie
                 to ensure proper and accurate budgetary resource       3/21/2-17
0003-    Mae
                 reporting that complies with FFMIA and OMB A-
004-C
                 11.
2016-
                 Review user roles in GFAS and assign additional
 FO-    Ginnie
                 staff to ensure that proper segregation of duties is   3/21/2-17
0003-    Mae
                 maintained.
004-D
                 Evaluate the weaknesses identified by NAPA, as
2016-
                 well as OCFO’s disagreement with those
 FO-
        OCFO     weaknesses and recommendations, and identify           7/31/2018
0003-
                 what corrective actions will be taken and when
006-A
                 those actions will be taken.
                 Develop a process to ensure that issues and
                 recommendations from all evaluations and audits,
                 including those performed by third parties like
2016-            NAPA, are adequately documented and tracked
 FO-             and properly evaluated by senior management to
        OCFO                                                              N/A
0003-            ensure that HUD’s FMFIA structure remains
006-B            compliant. HUD should also ensure that
                 corrective actions are agreed upon and
                 responsibility for implementing corrective actions
                 is appropriately delegated.
                 Develop procedures to provide oversight of OCPO
2016-
                 procurement activities to ensure that those with
 FO-
        OCFO     financial accounting and reporting impact are            N/A
0003-
                 properly captured and reflected in HUD’s
006-C
                 financial statements.
2016-            Review projects and acquisitions to determine
 FO-             whether the proper accounting treatment was
        OCFO                                                              N/A
0003-            applied and determine whether corrections to
006-D            HUD’s financial statements are needed.




                                           74
               Contact all other HUD program offices to
               determine whether any other programs authorize
2016-
               or are aware of grantees holding funds in advance
 FO-
        OCFO   of their immediate disbursement needs and                N/A
0003-
               determine financial statement impact on and
006-E
               compliance with Treasury cash management
               requirements of any found.
2016-          Distribute the workload among available
 FO-           accountants when staff is unavailable to ensure
        OCFO                                                          8/31/2016
0003-          that all cash reconciliations are performed in a
006-F          timely manner.
               Ensure that standard operating procedures for IGT
               activity are updated, to include reconciling IGT
               balances for all transactions required by the
2016-
               Federal Intragovernmental Transactions
 FO-
        OCFO   Accounting Policies Guide included in the              8/31/2016
0003-
               Treasury Financial Manual 2-4700. HUD should
006-G
               also include procedures to promptly reconcile,
               research, and resolve differences identified in the
               Treasury quarterly scorecard.
               Provide training on IGT reporting to ensure that
2016-
               responsible staff is sufficiently trained to allow
 FO-
        OCFO   reconciliations to be promptly performed and             N/A
0003-
               differences identified to be identified, researched,
006-H
               and resolved in a timely manner.
               Ensure that the agency’s key IGT point of contact
2016-
               is responsible for overseeing and coordinating
 FO-
        OCFO   efforts with component entities to ensure that           N/A
0003-
               Treasury quarterly scorecard differences are
006-I
               promptly researched and resolved.
               Revise policies and procedures to ensure that
               MCRs are routinely monitored and completed for
2016-
               all program areas and establish a timeframe for
 FO-
        OCFO   completion of the MCR reports. Further, HUD            3/17/2017
0003-
               should ensure that an escalation process is
006-J
               included to address untimely completion of the
               MCR process.
               Develop policies and procedures to ensure that
               any data changes and accounting adjustments
2016-          processed by OCFO Systems staff that impact the
 FO-           general ledger are sufficiently documented,
        OCFO                                                            N/A
0003-          identifying a description of the event, the
007-A          preparers of the adjustment, the approving
               officials of the adjustment, and dates when
               adjustments occurred.


                                         75
                  Close out and deobligate the remaining balances
                  on 2,308 expired homeless assistance contracts of
                  $104,347,996. HUD should also deobligate
2016-             $3,602,342 in 102 program obligations marked for
 FO-              deobligation during the departmentwide open
         CPD                                                             3/16/2017
0003-             obligations review. Lastly, HUD should review
008-A             the 57 obligations with remaining balances of
                  $188,176 and close out and deobligate amounts
                  tied to obligations that are no longer valid or
                  needed.
                  Develop and implement a monitoring plan to
                  review outstanding disaster grant activity to
                  ensure that the expenditure rates are consistently
2016-
                  tracked and evaluated and that there are specific
 FO-
         CPD      criteria to identify slow-moving projects. The           N/A
0003-
                  procedures should include a process to follow up
008-C
                  and recommend corrective actions for the slow-
                  moving projects identified, to include recapturing
                  funds if necessary.
                  Design and implement a policy to ensure that
                  reconciliations of expenditure activity between
                  HUD’s financial management systems and DRGR
2016-
                  [Disaster Recovery Grant Reporting system] are
 FO-
         CPD      periodically performed for all active disaster grant     N/A
0003-
                  balances to ensure that expenditure activity is
008-D
                  accurate in DRGR. The policy should also
                  include procedures for followup and resolution of
                  identified differences.
                  Deobligate all obligations marked for deobligation
                  during the departmentwide open obligations
                  review, including as much as $19,634,263 in 209
2016-             administrative obligations and $2,224,807 in 24
 FO-              program obligations marked for deobligation as of
        Housing                                                          3/9/2017
0003-             September 30, 2015. Additionally, HUD should
008-E             review the 225 obligations with remaining
                  balances of $285,024 and close out and deobligate
                  amounts tied to obligations that are no longer
                  valid or needed.
                  Review and if necessary deobligate the 228, 477,
2016-
                  and 29 expired or inactive project-based Section 8,
 FO-
        Housing   Section 235-236, and Section 202-811 projects          2/3/2017
0003-
                  totaling $52.5 million, $36.2 million, and $1.3
008-F
                  million, respectively.




                                            76
                 Deobligate all obligations marked for deobligation
                 during the departmentwide open obligations
                 review, including as much as $430,942 in 44
2016-            administrative obligations and $135,957 in 2
 FO-             program obligations marked for deobligation as of
        OCIO                                                          12/31/2016
0003-            September 30, 2015. Additionally, HUD should
008-H            review the 17 obligations with remaining balances
                 of $1,486,191 and close out and deobligate
                 amounts tied to obligations that are no longer
                 valid or needed.
2016-            Review the 216 obligations with remaining
 FO-             balances totaling $1,506,233 and close out and
        CAO                                                           5/21/2017
0003-            deobligate amounts tied to obligations that are no
008-J            longer valid or needed.
2016-            Deobligate $140,165 in 41 administrative and
 FO-             $125,166 in 3 program obligations marked for
        FHEO                                                          12/8/2016
0003-            deobligation during the departmentwide open
008-K            obligations review.
2016-            Review the 20 obligations with remaining
 FO-             balances of $77,807 and close out and deobligate
        EEO                                                           3/22/2017
0003-            amounts tied to obligations that are no longer
008-L            valid or needed.
2016-            Review the seven administration obligations with
 FO-             remaining balances of $115,035 and close out and
        OCFO                                                          3/18/2017
0003-            deobligate amounts tied to obligations that are no
008-N            longer valid or needed.
2016-
                 Deobligate the $587,198 in eight administrative
 FO-    Ginnie
                 obligations marked for deobligation during the       3/21/2017
0003-    Mae
                 departmentwide open obligations review.
008-O
2016-            Implement a payment recapture audit for the
 FO-             HOME program, specifically to identify and
        OCFO                                                             N/A
0003-            recapture improper payments made as a result of
012-A            the continued use of the cumulative method.
                 Include the HOME program in the next annual
2016-            improper payment risk assessment and ensure that
 FO-             the impact of the cumulative method to meet
        OCFO                                                             N/A
0003-            commitment deadlines is included in the risk
012-B            assessment process to evaluate the susceptibility
                 to significant improper payments
2016-
                 Complete any outstanding validation reviews and
 FO-
         PIH     transition back as much as $466.5 million in         9/30/2021
0003-
                 Housing Choice Voucher program funding from
013-A



                                          77
                   MTW PHAs and $41 million from non-MTW
                   PHAs.
Interim Report on HUD’s Internal Controls Over Financial Reporting, 2015-FO-0002
                   Continue to work with CPD’s information
 2015-             technology services contractor and OCFO to
  FO-              ensure that all three phases of the plan to bring
          CPD                                                            1/31/2017
 0002-             IDIS into compliance with GAAP and applicable
 001-A             Federal system requirements are completed as
                   scheduled.
 2015-             Reinstate cash reconciliations as soon as possible
  FO-              and transition as much as $423 million that
           PIH                                                          12/31/2038
 0002-             accumulated in PHA NRAs during fiscal year
 002-B             2014.
 2015-             Reclassify prepayments to accounts receivable
  FO-              once PIH determines the amount of the
          OCFO                                                            8/1/2016
 0002-             prepayment that PIH cannot offset because PHAs
 002-H             have insufficient funds.
 2015-
                   Validate grants payable estimates and any
  FO-
          CPD      assumptions used to produce the estimates against     9/30/2017
 0002-
                   subsequent grantee reporting.
 003-F
                   Incorporate into their grants payable accrual
 2015-
                   estimation methodologies steps to appropriately
  FO-
          CPD      validate grant accrual estimates and assumptions      10/2/2015
 0002-
                   used to produce the estimates against subsequent
 003-G
                   grantee reporting.
                   Work with the Office of Multifamily Housing
 2015-
                   Programs to evaluate its obligation process for the
  FO-
          OCFO Section 8 project-based program to ensure that it         8/31/2016
 0002-
                   complies with HUD, OMB, and GAO legal
 005-C
                   requirements to have a legal point of obligation.
                   Work with OCFO to revise the funds control plans
 2015-
                   for the Section 8 project-based programs to ensure
  FO-
         Housing that the obligation process in place is sufficient to    5/6/2016
 0002-
                   support a legally binding point of obligation and is
 005-E
                   reviewed and authorized by designated officials.
 2015-             Review the status of the 2,743 expired contracts,
  FO-              which make up the $119.9 million in Homeless
          CPD                                                            3/16/2016
 0002-             Assistance funds; close out the contracts; and
 006-A             recapture the excess funds.




                                          78
                  Deobligate $174,168 in 5 administrative
                  obligations and $9,920,926 in 308 program
2015-             obligations marked for deobligation during the
 FO-              departmentwide open obligations review.
         CPD                                                            10/1/2015
0002-             Additionally, review the 72 obligations with
006-B             remaining balances totaling $313,419 and close
                  out and deobligate amounts tied to obligations that
                  are no longer valid or needed.
                  Deobligate all obligations marked for deobligation
                  during the departmentwide open obligations
                  review, including as much as $4,988,326 in 613
2015-             administrative obligations and $6,395,922 in 79
 FO-              program obligations marked for deobligation as of
        Housing                                                         3/23/2016
0002-             September 29, 2014. Additionally, review the 269
006-E             obligations with remaining balances totaling
                  $19,624,446 and close out and deobligate amounts
                  tied to obligations that are no longer valid or
                  needed.
2015-
                  Deobligate the 76 expired or inactive Sections 202
 FO-
        Housing   and 811 and project-based Section 8 projects          3/4/2016
0002-
                  totaling $3,458,166.
006-F
                  Deobligate all obligations marked for deobligation
                  during the departmentwide open obligations
                  review, including as much as $3,561,042 in 64
2015-
                  administrative obligations marked for deobligation
 FO-
        OCIO      as of September 29, 2014. Additionally, review        3/6/2016
0002-
                  the 171 obligations with remaining balances
006-J
                  totaling $19,730,791 and close out and deobligate
                  amounts tied to obligations that are no longer
                  valid or needed.
                  Deobligate $89,237 in 46 administrative
                  obligations marked for deobligation during the
2015-
                  departmentwide open obligations review.
 FO-
         CAO      Additionally, review the 199 obligations with         7/17/2016
0002-
                  remaining balances totaling $4,146,234 and close
006-O
                  out and deobligate amounts tied to obligations that
                  are no longer valid or needed.
                  Deobligate $785 in one administrative obligation
                  marked for deobligation during the
2015-
                  departmentwide open obligations review.
 FO-
        OCFO      Additionally, review the six obligations with         4/29/2016
0002-
                  remaining balances totaling $332,888 and close
006-S
                  out and deobligate amounts tied to obligations that
                  are no longer valid or needed.


                                           79
                  Deobligate $5,210 in two administrative
                  obligations and $109,500 in one program
2015-             obligation marked for deobligation during the
 FO-              departmentwide open obligations review.
         FHEO                                                           12/16/2015
0002-             Additionally, review the 17 obligations with
006-U             remaining balances totaling $26,711 and close out
                  and deobligate amounts tied to obligations that are
                  no longer valid or needed.
2015-
                  Periodically reconcile balances with OCIO
 FO-
         OCFO     subsidiary records and research and resolve any       3/31/2016
0002-
                  identified differences.
007-D
                  Increase efforts to quickly complete outstanding
2015-
                  front-end risk assessments and coordinate with
 FO-
          CPD     OCFO to finalize the review and approval process       4/8/2016
0002-
                  even in the absence of policies and procedures
007-F
                  with specific deadlines in this area.
 2015-            Develop a subsidiary system to accumulate the
  FO-             capitalized cost and related depreciation expense
            CIO                                                       3/31/2016
 0002-            for each software project under development or
 007-I            placed into production.
 2015-
                    Enhance communication to appropriately identify
  FO-     Ginnie
                    mixed systems and include them in the inventory    3/6/2016
 0002-      Mae
                    of financial systems.
 009-A
 2015-              Add the Integrated Pool Management System,
  FO-     Ginnie Unclaimed Funds System, and Reporting and
                                                                       3/6/2016
 0002-      Mae     Feedback System to the inventory of FFMIA
 009-B              financial and mixed systems.
 2015-
  FO-               Implement a periodic review process to
           OCFO                                                        4/8/2016
 0002-              independently evaluate system classifications.
 009-C
Additional Details To Supplement Our Report On HUD’s Fiscal Years 2013 and 2012
(Restated) Financial Statements, 2014-FO-0003
                    Develop and implement a detailed remediation
                    action plan to ensure that grant management
                    systems eliminate the FIFO methodology in its
 2014-
                    entirety. The plan should (1) explain how the
  FO-
           CPD      budget fiscal year-TAFS for each accounting       9/30/2014
 0003-
                    transaction (project and activity setup,
 001-A
                    commitment, disbursement, etc.) will be recorded,
                    remain constant, and be maintained, (2) reference
                    Federal system requirements and criteria, and (3)



                                           80
               include resources, specific remedies, and
               intermediate target dates necessary to bring the
               financial management system into substantial
               compliance.




2014-
               Establish controls within the system, which
 FO-
        CPD    provide an audit trail of the use of the funds by the   9/30/2014
0003-
               budget fiscal year-TAFS.
001-B
               Provide oversight of CPD’s system
               implementation or modification to ensure that
               Federal financial management accounting
               standards are embedded into the system so that the
2014-
               information transferred from grant management
 FO-
        OCFO   systems to HUD’s core financial systems comply          10/30/2015
0003-
               with these standards, are recorded in HUD’s
001-C
               consolidated financial statements in accordance
               with Federal GAAP, and ensure that compliant
               administrative control of funds for its formula
               grant programs is established.
2014-          Transition the PHA NRA excess funds, which are
 FO-           as much as $643.6 million as of June 30, 2013, to
        PIH                                                            12/31/2038
0003-          HUD’s control as soon as possible to safeguard
002-A          the program resources.
2014-          Implement a cost-effective method for automating
 FO-           the cash management process to include an
        PIH                                                               N/A
0003-          electronic interface of transactions to the standard
002-C          general ledger.
               Review the cash management process to identify
2014-
               all financial events to be recognized in accordance
 FO-
        OCFO   with GAAP. Establish procedures to account for           4/8/2015
0003-
               the cash management activity in a timely manner
002-E
               in compliance with GAAP.
2014-
               Ensure that PIH’s automation of its cash
 FO-
        OCFO   management process complies with Federal                12/31/2015
0003-
               financial management requirements.
002-G




                                         81
               Design and Implement a loan guarantee system
               that complies with the Guaranteed Loan System
2014-
               Requirements. Ensure that the implemented loan
 FO-
        OCFO   guarantee system should be integrated with             12/31/2015
0003-
               HUD’s financial management systems and be
003-A
               included in its financial management system
               plans.
               Establish an appropriate accounting and financial
2014-          reporting governance structure within OCFO with
 FO-           the appropriate level of accounting, experience,
        OCFO                                                          3/11/2015
0003-          and training to support the size and complexity of
004-G          HUD’s and its component entities’ financial
               reporting requirements.
2014-
               Enforce already existing internal control
 FO-
        OCFO   procedures to ensure proper supervision over           10/1/2014
0003-
               accounting for Section 8 FAF receivables.
006-C
               Perform a thorough analysis of outstanding FAF
2014-          receivables and fiscal year 2013 collections to
 FO-           ensure that the receivables accurately represent the
        OCFO                                                           3/4/2015
0003-          amounts owed to HUD, including but not limited
006-D          to positive confirmations of outstanding
               receivable balances with the trustees.
2014-
               Review the status of these 1,855 expired contracts,
 FO-
        CPD    which make up $50.9 million; close out the             9/30/2016
0003-
               contracts; and recapture the excess funds.
008-A
2014-
               Complete the closeout of any remaining CDBG-R
 FO-
        CPD    and HPRP grants and forward all grant closeout         9/30/2014
0003-
               agreement certifications to OCFO for recapture.
008-B
               Deobligate $14,425,629 tied to 238 program
               obligations marked for deobligation during the
2014-
               departmentwide unliquidated obligations review.
 FO-
        CPD    Additionally, OCFO should review the 93                 4/3/2015
0003-
               obligations with remaining balances totaling
008-C
               $316,935 and close out and deobligate amounts
               tied to obligations that are no longer valid.




                                         82
                  Deobligate $12,755,325 tied to 165 administrative
                  obligations and $2,734,967 tied to 25 program
                  obligations marked for deobligation during the
2014-
                  departmentwide unliquidated obligations review.
 FO-
        Housing   Additionally, the Office of Housing should review      4/2/2015
0003-
                  the 429 obligations with remaining balances
008-D
                  totaling $5,764,905 and close out and deobligate
                  amounts tied to obligations that are no longer
                  valid.
2014-
                  Research and deobligate at least $9.3 million tied
 FO-
        Housing   to the 115 inactive and/or expired Section 202/811     4/2/2015
0003-
                  funding lines.
008-E
2014-
 FO-              Review and deobligate at least $26 million tied to
        Housing                                                          4/2/2015
0003-             215 inactive and/or expired Section 8 obligations.
008-F
                  Deobligate the $1,419 tied to three administrative
                  obligations marked for deobligation during the
2014-
                  departmentwide unliquidated obligations review.
 FO-
        OCFO      Additionally, OCFO should review the 42               12/31/2014
0003-
                  obligations with remaining balances totaling
008-K
                  $3,115,954 and close out and deobligate amounts
                  tied to obligations that are no longer valid.
                  Design and implement a policy to ensure that
                  reconciliations between the subsidiary ledgers
                  (supporting records) and the obligation balances in
2014-
                  the general ledger (controlling accounts) are
 FO-
        OCFO      periodically performed for all HUD                     4/1/2015
0003-
                  appropriations. The policy should also address the
008-M
                  follow-up and clearance of identified differences
                  and the responsibilities for the preparers and
                  reviewers.
                  Work with the program offices to determine the
                  ARRA funds that were not spent by September
2014-             30, 2013; implement the manual process
 FO-              identified; and recapture, to the extent permitted
        OCFO                                                            10/17/2014
0003-             by law, the unspent ARRA funds and return them
008-N             to Treasury, including at least $4.7 million and
                  $2.6 million in unspent grant funds for the CDBG-
                  R and HPRP programs, respectively.
2014-
                  Deobligate $7,263,662 tied to 178 administrative
 FO-
        OCIO      obligations marked for deobligation during the        2/13/2015
0003-
                  departmentwide unliquidated obligations review.
008-O


                                           83
                   Develop and implement procedures to routinely
2014-              evaluate the assistance and administrative
 FO-               obligation balances for the HUD-administered and
          PD&R                                                               4/6/2015
0003-              SSS subcategories of EHLP to determine whether
011-E              a valid need still exists and if not, deobligate those
                   balances.
                   Make changes to IDIS Online, which will require
                   grantees to specifically identify the grant
2014-              allocation year to which the commitment should
 FO-               be assigned and include the commitment dates.
           CPD                                                              10/30/2015
0003-              The system should also allow HUD to ensure that
015-A              commitments made during overlapping allocations
                   and periods are counted toward only 1 year’s
                   compliance requirements.
                   Stop using the cumulative method and the
2014-              deadline compliance report for determining
 FO-               compliance with the 24-month commitment
           CPD                                                              10/30/2015
0003-              requirement in the HOME Investment Partnership
015-B              Act and use only the commitment made within the
                   24-month period to determine compliance.
                   In accordance, with the GAO legal decision and
2014-
                   opinion, take steps to identify and recapture funds
 FO-
           CPD     that remain uncommitted after the statutory              10/30/2015
0003-
                   commitment deadline and reallocate such funds in
015-C
                   accordance with the Act.
2014-              Recapture funds from allocations during the 24-
 FO-               month overlapping period only for grantees that
           CPD                                                              10/30/2015
0003-              do not comply with the 24-month commitment
015-D              requirement.
Additional Details To Supplement Our Report on HUD’s Fiscal Years 2012 and 2011
Financial Statements, 2013-FO-0003
                    Develop and implement formal financial
 2013-              management policies and procedures to require an
  FO-               annual evaluation by OCFO and applicable
           OCFO                                                         11/29/2013
 0003-              program offices of all allowance for loss rates and
003-C               other significant estimates currently in use to
                    ensure appropriateness.
                    Develop internal controls to review field office
                    compliance more frequent than every 4 years,
 2013-
                    especially when findings have been identified in
  FO-
           CPD      the past, and to ensure that action plans operate    3/31/2016
 0003-
                    effectively and have addressed the deficiencies
004-B
                    noted so that noncompliance is not repeated
                    during the next quality management review.



                                              84
 2013-               Review the status of these expired contracts,
  FO-                which make up the $50.6 million, and recapture
           CPD                                                            10/18/2013
 0003-               excess funds for the contracts that have not been
006-A                granted extensions.
 2013-               Review the 270 obligations with remaining
  FO-                balances totaling $432,147 and close out and
           CPD                                                             9/30/2014
 0003-               deobligate amounts tied to obligations that are no
006-B                longer valid or needed.
Additional Details To Supplement Our Report on HUD’s Fiscal Years 2011 and 2010
Financial Statements, 2012-FO-0003
                     Review the status of each of its homeless
 2012-
                     assistance contracts that make up the $32 million
  FO-
           CPD       OIG identified as excess funding and recapture         2/6/2013
 0003-
                     excess funds for expired contracts, which have not
002-B
                     been granted extension.
                     The Office of Housing report on income
                     discrepancies at the 100 percent threshold level as
                     a supplemental measure; assign staff to review the
                     deceased single-member household and income
 2012-               discrepancy reports at least quarterly and follow
  FO-                up with owners and management agents (O-A)
          Housing                                                          4/30/2016
 0003-               listed on these reports; and include in the contract
005-B                between HUD and O-As a provision for improper
                     payments that requires O-and resolve in a timely
                     manner income discrepancies, failed identity
                     verifications, and cases of deceased single-
                     member households.
Additional Details to Supplement Our Report on HUD’s Fiscal Years 2010 and 2009
Financial Statements, 2011-FO-0003
 2011-               Cease the changes being made to IDIS for the
  FO-                HOME program related to the FIFO rules until the
           CPD                                                             6/15/2015
 0003-               cumulative effect of using FIFO can be quantified
001-A                on the financial statements.
 2011-
                     Change IDIS so that the budget fiscal year source
  FO-
           CPD       is identified and attached to each activity from the  6/15/2015
 0003-
                     point of obligation to disbursement.
001-B
                     Cease the use of FIFO to allocate funds (fund
 2011-               activities) within IDIS and disburse grant
  FO-                payments. Match outlays for activity
           CPD                                                             6/15/2015
 0003-               disbursements to the obligation and budget fiscal
001-C                source year in which the obligation was incurred,
                     and in addition, match the allocation of funds




                                           85
               (activity funding) to the budget fiscal year source
               of the obligation.



               Include as part of the annual CAPER
               [consolidated annual performance and evaluation
2011-
               report], a reconciliation of HUD's grant
 FO-
        CPD    management system, IDIS, to grantee financial         6/15/2015
0003-
               accounting records on an individual annual grant
001-D
               basis, not cumulatively, for each annual grant
               awarded to the grantee.
               Review the 510 obligations which were not
2011-          distributed to the program offices during the open
 FO-           obligations review and deobligate amounts tied to
        OCFO                                                         10/31/2011
0003-          closed or inactive projects, including the $27.5
002-C          million we identified during our review as expired
               or inactive.
               Review the status of each of its Homeless
2011-
               Assistance contracts that makes up the $97.8
 FO-
        CPD    million OIG identified as excess funding and          3/16/2012
0003-
               recapture excess funds for expired contracts,
004-A
               which have not been granted extensions.




                                         86
Appendixes

Appendix A


                       Schedule of Funds To Be Put to Better Use
                       Recommendation       Funds to be put to
                           number              better use1
                               8A                  $162,715,936
                               8B                    17,986,109
                               8E                     6,966,585
                               8F                    21,710,718
                               8G                     34,720,56
                               8H                         83,501
                               8I                       360,907
                               8J                       152,211
                               8K                       619,322
                               8L                         85,782
                               8Q                    86,987,505
                              12A                   168,300,000
                             Totals                 500,689,142


1/   Recommendations that funds be put to better use are estimates of amounts that could be
     used more efficiently if an OIG recommendation is implemented. These amounts include
     reductions in outlays, deobligation of funds, withdrawal of interest, costs not incurred by
     implementing recommended improvements, avoidance of unnecessary expenditures
     noted in preaward reviews, and any other savings that are specifically identified.




                                              87
Appendix B


          Departmentwide Obligation Review – Schedule of Recommended Deobligations

      HUD’s departmentwide unliquidated obligation review – invalid obligations identified
                         by HUD but not deobligated as of 9/30/16

                                 Administrative           Program
                                                                                   Total
       Program office              obligations           obligations
                                #           $         #           $           #          $
      Housing                  307      18,290,686   202       3,420,032    509       21,710,718
      CPD                                            234      10,996,784    234       10,996,784
      FHEO                      27        384,703     6          234,619     33          619,322
      Ginnie Mae                 3        587,505                             3          587,505
      OCHCO                    125        360,907                           125          360,907
      Admin                    108        152,211                           108          152,211
      FP                         5         85,782                             5           85,782
      OCIO                     124         83,501                           124           83,501
      Total 102                699    19,945,295     442    14,651,435     1,141      34,596,730
* Immaterial differences in totals due to rounding
OCHCO – Office of the Chief Human Capital Officer
FHEO – Office of Fair Housing and Equal Opportunity
DEEO – Office of Departmental Equal Employment Opportunity
PD&R – Office of Policy Development and Research




102
      Differences due to rounding



                                                     88
Appendix C

 Federal Financial Management Improvement Act Noncompliance, Responsible Program
                     Offices, and Recommended Remedial Actions

This appendix provides details required under FFMIA reporting requirements. We noted
instances in which HUD’s systems did not substantially comply with FFMIA requirements.
Specifically, we noted instances of substantial noncompliance with (1) Federal financial system
requirements, (2) Federal accounting standards, and (3) the USSGL at the transaction level. The
details about non-FFMIA-compliant systems, responsible parties, primary causes, and HUD’s
intended remedial actions are included in the following sections.

Systems That Do Not Comply With Federal Financial Systems Requirements
New Core Interface Solution
NCIS does not comply with Federal financial system requirements. Specifically, NCIS does not
capture or record required general ledger account transaction information to enable traceability
between program accounts and the general ledger.

NCIS is a custom-developed system owned by HUD and hosted by Oracle Managed Cloud
Services. NCIS performs the extract, transform, and load functions as well as a variety of error-
processing, reconciliation, and interface file management functions to support the interface of
HUD systems with ARC’s systems. OCFO is responsible for NCIS. While NCIS is a key
interchange between legacy systems and ARC’s Oracle Federal Financials, it is not a long-term
interface solution, and HUD can compensate for existing weaknesses with efforts to establish
and improve manual reconciliation procedures.

HUD Procurement System, Small Purchase System, and HUD Integrated Acquisition Management
System
As of September 30, 2016, HUD reported that three OCPO procurement systems, HPS, SPS, and HIAMS,
were not substantially compliant with FFMIA. These systems have been replaced; however, OCPO needs
to perform procurement closeout actions in HPS and HIAMS and validate SPS data before
decommissioning. HUD hopes to complete decommissioning for these three systems during fiscal year
2017.

Systems That Do Not Comply With Federal Accounting Standards and the U.S. Standard
General Ledger
Integrated Disbursement and Information System Online
The IDIS system does not comply with applicable Federal accounting standards or the USSGL at
the transaction level. IDIS is in noncompliance because the system is configured to account for
grants using the attribution methodology known as FIFO. While CPD had made progress in
addressing this issue, updating the IDIS application to specifically identify grants initiated during
2015 and going forward, funding constraints delayed further remediation and FFMIA
compliance. CPD is responsible for IDIS.



                                                  89
We previously recommended that HUD modify IDIS to account for grant disbursements by the
specific identification method and configure the system to record transactions in compliance with
the USSGL. CPD has eliminated the FIFO method of funds attribution from the IDIS Online
system for fiscal year 2015 and future grants only. The FIFO method will continue to be used
for fiscal year 2014 grants and earlier. Additional changes need to be made to the IDIS system
to remediate IDIS’ FFMIA noncompliance.
Systems That Do Not Comply With Financial System Requirements, Federal Accounting
Standards, and the U.S. Standard General Ledger
Ginnie Mae Financial and Accounting System
We noted continuing noncompliance with the three elements of FFMIA within Ginnie Mae as of
September 30, 2016. During our fiscal year 2014 audit of Ginnie Mae’s financial statements, we
were unable to obtain sufficient, appropriate evidence to express an opinion on the fairness of
$6.6 billion in nonpooled loan assets from Ginnie Mae’s defaulted issuers’ portfolio. We also
noted four material weaknesses and recommendations to Ginnie Mae management.

In addition, we noted weaknesses related to the budgetary accounting module of the GFAS
application during the course of the 2015 financial statement audit and made recommendations
to Ginnie Mae to address these weaknesses. Specifically, because of system configuration
issues, large on-top adjustments were needed to reconcile budgetary balances. While progress
had been made to remediate GFAS’ FFMIA noncompliance during fiscal year 2016, Ginnie Mae
will need to address the remaining issues related to the budgetary accounting module and the
four material weaknesses related to loan accounting.




                                                90
Appendix D
                Auditee Comments and OIG’s Evaluation



 Ref to OIG
 Evaluation      Auditee Comments




    Comment 1




    Comment 2


    Comment 2




    Comment 3




                                  91
Ref to OIG
Evaluation




Comment 4




Comment 5




Comment 6




Comment 7




Comment 8




             92
Ref to OIG
Evaluation




Comment 9




Comment 10




Comment 11


Comment 12




Comment 13


Comment 14


Comment 15

Comment 16




             93
94
                         OIG Evaluation of Agency Comments


Comment 1   Progress was made on two material weaknesses, and a third was not resolved, but
            instead, consolidated with other new findings identified during fiscal year
            2016. However, two new material weaknesses were identified during the course
            of the year, one of which contributed to HUD’s inability to timely complete and
            deliver final consolidated financial statements and accompanying notes. This
            material weaknesses could have been identified and remediated by management
            early in the fiscal year, allowing for the detection and prevention of the errors and
            issues identified by OIG at third quarter and possibly ensuring timely delivery of
            final consolidated financial statements and accompanying notes.
Comment 2   This year, management disagreed with a number of preliminary assessments and
            OIG findings and recommendations that were identified and provided to OCFO
            early in the audit cycle. The primary basis of many of the disagreements cited
            OIG’s use of “best practice” standards or criteria that HUD believed was
            optional. HUD’s continued minimization and diminishment of issues throughout
            the course of the year resulted in inaction and a failure to escalate the need to
            remediate internal control weaknesses in a timely manner. Consequently,
            significant delays in the completion and delivery of final consolidated financial
            statements and accompanying notes occurred and as a result, OIG was compelled
            to issue a disclaimer of opinion on HUD’s 2016 and 2015 (restated) consolidated
            financial statements with a primary basis that OIG was unable to audit them in
            their entirety due to their untimely delivery.
            In addition, detailed comments regarding substantive and technical comments
            were not provided to OIG for consideration prior to the issuance of the final
            report.
Comment 3   HUD generally agrees with our finding. While, we agree that implementing a new
            system and process are challenging and changes were needed, better governance,
            planning, and established financial management and accounting policy and
            procedures would have made the transition smoother. Even under the new
            environment, HUD is reliant on legacy systems and the process is even more
            complex than prior to the transition because information from the legacy systems
            must go through a new financial management system, NCIS. We believe that
            deficiencies cited require more substantive work than what is implied by “fine-
            tuning” since HUD was unable to timely deliver final consolidated financial
            statements and accompanying notes, resulting in OIG’s inability to audit them and
            a disclaimer of opinion. This is indicative of a fundamental problem with HUD’s
            control and reporting environment.




                                              95
Comment 4   HUD generally agrees with our findings. While we agree that the most significant
            aspect of this material weaknesses was substantially resolved, there were still
            errors in its calculation of PIH prepayments and HUD did not properly reclassify
            amounts to be offset as accounts receivable. In addition, we noted several new
            deficiencies related to HUD’s accounting for property plant and equipment and
            non-FHA loan guarantees. Lastly, there has been no progress on the finding
            related to HUD’s grant accrual estimates and our inability to audit these balances
            remain.
Comment 5   We documented that in July of 2016, HUD initiated an effort to resolve
            differences between the subsidiary records and general ledger. As consistent with
            the comment above, OCFO established a subledger project workgroup to resolve
            the differences with a completion date of September 30, 2016. Although the
            workgroup was conducting analysis to identify the cause of the reconciling
            differences and impact on the financial statements, the $29.38 billion balance was
            not resolved by fiscal year end. We concluded the potential impact of unresolved
            differences in the subledger and general ledger could be material to the financial
            statements as a whole. Despite HUD’s efforts and plans to have the differences
            resolved in the forthcoming months, this is outside the scope of the fiscal year
            2016 audit i.e. the differences will not be resolved until fiscal year 2017.
            Therefore, as of the date of the internal control report, we conclude this finding
            exists with a potential material impact. We will continue to evaluate HUD’s
            progress with refining their reconciliation business model during the FY2017 CFS
            Audit.
Comment 6   CPD has previously stated that it is not feasible to estimate and rectify any
            misaligned values in the financial statements for affected FY14 and prior year
            grant balances. As a result, CPD elected to remove the FIFO methodology for
            commitments and disbursements made from FY15 and future grants only. OIG
            will continue to report that the effects of not removing the FIFO method
            retroactively will continue to have implications on future years’ financial
            statement audit opinions until the impact is assessed to be immaterial.
Comment 7   Management’s response implicitly reflects agreement with OIG finding 5; the
            need to resolve legacy system issues, implement systems to meet business needs,
            and continue to address issues related to the transition to the FSSP.
Comment 8   While management did not directly address specific deficiencies, they noted the
            need for continued work to improve their financial governance structure, citing
            the establishment of the Financial Management Council as a key step. These
            efforts are aligned with the actions we have recommended this year and in prior
            years, including efforts to enhance internal controls and streamline operations.
Comment 9   Although OIG noted some improvements in the ARC’s documentation for
            policies and procedures, the critical financial reporting elements of program code
            and program class were not transparent in the funds control documentation i.e
            Process Guidance to provide accountability to the financial system of record. The


                                             96
              interim funds control approach did not ensure accountability or traceability to the
              policies and procedures governing budget execution, obligations and expenditure
              of funds. The procedures identified in the Process Guidance did not provide
              traceability to the applicable funds or program office transactions and
              accountability to the responsible officials.
              Further, the lack of compliance reviews throughout fiscal year 2016 limited
              HUD’s ability to monitor and fully implement a complete administrative control
              of funds system that would ensure oversight of the agency’s obligations and
              disbursements. We noted compliance review procedures did not begin until
              August 2016, which did not allot the appropriate amount of time to identify
              inconsistencies.
              As of October 1, 2016, HUD did not complete their transition to the funds control
              matrices and were still operating under the interim funds control structure. HUD’s
              OCFO office issued a September 30, 2016 memorandum stating that there has
              been an extension for program offices to submit their matrices to OCFO for
              approval. OIG concluded that HUD did not make significant progress in
              completing the transition to the funds control matrix as of September 2016, which
              was the original completion date.
              We will continue to evaluate HUD’s progress with full implementation in fiscal
              year 2017 consolidated financial statement audit.
Comment 10 HUD’s response to Finding 8 addresses OIG’s concerns; namely, that HUD will
           work to improve monitoring of unliquidated obligations. We will evaluate
           additional procedures and guidelines implemented as part of the fiscal year 2017
           consolidated financial statement audit.
Comment 11 We will review progress made in this area as part of our fiscal year 2017 audit
           work.
Comment 12 While it doesn’t address the specific instances of FFMIA noncompliance, HUD’s
           response notes that ongoing development activities should help the department
           move towards resolving long-standing noncompliance. We will monitor these
           initiatives and provide timely feedback on the extent to which these projects meet
           HUD’s stated goals.
Comment 13 The comments provided indicates that the continued use of the cumulative
           method for determining compliance with the HOME Statute was not an ADA
           violation. However, the noncompliance noted in this finding relates to
           noncompliance with the HOME Statute, and not ADA. This has been a long
           standing noncompliance issue which has not been remediated because CPD
           continues to use the cumulative method for determining compliance for fiscal
           year 2014 grants and prior. Therefore, noncompliance with the HOME Statute
           remains.




                                                97
Comment 14 HUD has implemented tracking and monitoring tools, but due to the manual
           process and not tracking MTW advances in the past, it is still not in compliance
           with cash management.
Comment 15 This finding was placeholder due to the untimely receipt of requested information
           from the Department. Since the issuance of the draft report, we have received the
           requested information and concluded that this finding would be removed from the
           report.
Comment 16 Improvements in this area will be assessed as part of OIG’s annual audit of
           HUD’s compliance with the improper payments and elimination and recovery act
           of 2010, as amended.




                                              98