oversight

HUD's Monitoring of State CDBG

Published by the Department of Housing and Urban Development, Office of Inspector General on 2017-07-10.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

           Community Planning and
         Development, Washington, DC
                 HUD’s Monitoring of State CDBG




Office of Audit, Region 6        Audit Report Number: 2017-FW-0001
Fort Worth, TX                                         July 10, 2017
To:            Cliff Taffet, General Deputy Assistant Secretary of Community Planning and
               Development, D


               //signed//
From:          Kilah S. White, Regional Inspector General for Audit, 6AGA

Subject:       HUD’s Office of Community Planning and Development Did Not Appropriately
               Assess State CDBG Grantees’ Risk to the Integrity of CPD Programs or
               Adequately Monitor Its Grantees


Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our review of HUD’s Monitoring of State Community
Development Block Grants.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG website. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
817-978-9309.
                    Audit Report Number: 2017-FW-0001
                    Date: July 10, 2017
                    HUD’s Office of Community Planning and Development Did Not
                    Appropriately Assess State CDBG Grantees’ Risk to the Integrity of CPD
                    Programs or Adequately Monitor Its Grantees


Highlights

What We Audited and Why
We audited the U.S. Department of Housing and Urban Development’s (HUD) Office of
Community Planning and Development’s (CPD) risk assessment and monitoring of its State
Community Development Block Grant (CDBG) recipients. We started this assignment due to
significant findings reported on the State of Oklahoma CDBG-Disaster Recovery (CDBG-DR)
audit (2016-FW-1010) and HUD’s lack of monitoring the State since fiscal year 2011. Our
reporting objective was to determine whether CPD appropriately assessed State CDBG grantees’
risk to the integrity of CPD programs and adequately monitored its grantees.

What We Found
CPD did not appropriately assess State CDBG grantees’ risk to the integrity of CPD programs or
adequately monitor its grantees. This condition occurred because its field office staff did not
follow CPD risk assessment and monitoring requirements and field office management
responsible for reviewing staff performance did not correct noncompliance of staff performing
these responsibilities. In addition, the headquarters desk officer review function was
administrative in focus and failed to note noncompliance. As a result, CPD cannot be assured
that its field offices correctly identified the high-risk grantees or conducted adequate monitoring
to mitigate risk to the integrity of CPD programs.

What We Recommend
We recommend that the General Deputy Assistant Secretary for Community Planning and
Development (1) develop and implement a review process at the headquarters level to ensure
compliance with established policy for risk analysis and monitoring, (2) require referenced
supporting documentation be uploaded into its system and implement guidance for field offices
to maintain supporting documentation in their official files, (3) develop and implement a policy
that requires field offices to rate grantees of at least medium risk that have not been monitored
within the last 3 years, and (4) update monitoring exhibits to guide staff to document procedures
performed and provide sufficient explanation to verify procedures performed and conclusions
drawn.
Table of Contents

Background and Objective......................................................................................3

Results of Audit ........................................................................................................4
         Finding: CPD Did Not Appropriately Assess State CDBG Grantees’ Risk to the
         Integrity of CPD Programs or Adequately Monitor Its Grantees ............................... 4

Scope and Methodology .........................................................................................19

Internal Controls ....................................................................................................21

Appendix .................................................................................................................22
         Auditee Comments and OIG’s Evaluation ................................................................... 22




                                                             2
Background and Objective
The U. S. Department of Housing and Urban Development’s (HUD) Office of Community
Planning and Development (CPD) oversees 50 State Community Development Block Grant
(CDBG) recipients. During fiscal years 2015-2016, HUD allocated approximately $1.8 billion to
State CDBG recipients. To protect these funds and ensure compliance with program
requirements, CPD implemented a risk analysis and monitoring review process to ensure that it
monitored those grantees that posed the highest risk to the integrity of CPD programs.
CPD’s risk analysis is a biennial process that assesses risk factors for all CPD program
participants and programs and then ranks these grantees from highest to lowest by risk score.
Once ranked, CPD develops an annual office work plan for each field office to identify which
grantees it will monitor. CPD did not document how it determined the number of grantees each
field office was to monitor. Field offices have two options for selecting grantees to monitor: (1)
select grantees in rank order or (2) select 70 percent of the grantees in rank order, with the
remaining 30 percent selected at the discretion of the field office. With limited exception, CPD
policy required monitoring of all high-risk grantees; however, CPD’s Office of Field
Management (OFM) in headquarters noted that it did not have the resources to conduct onsite
monitoring of all high-risk grantees.
CPD’s policy encouraged staff to view monitoring as an ongoing process involving continuous
communication and evaluation. According to CPD policy, 1 “Monitoring is an integral
management control technique and a Government Accountability Office (GAO) standard.
Monitoring assesses the quality of a program participant’s performance over time. In addition,
monitoring provides information about program participants that is critical for HUD and others
to make informed judgments about program effectiveness and management efficiency. It also
helps in identifying instances of fraud, waste, and abuse.” CPD policy provided detailed
guidance concerning the management and performance of monitoring activities and required all
monitoring conclusions, positive or negative, to be supportable, defensible, and adequately
documented. 2
Between April 2007 and September 2014, CPD trained more than 500 field office staff members
on CPD’s monitoring policies and processes. In March 2016, CPD presented a refresher
monitoring training for its directors. CPD provided a training PowerPoint presentation and
requested its directors to train their staff as needed.
Our reporting objective was to determine whether CPD appropriately assessed State CDBG
grantees’ risk to the integrity of CPD programs and adequately monitored its grantees.




1
    HUD Handbook 6509.2, REV-6, CHG-2, chapter 1.
2
    Ibid., chapter 2.
                                                    3
Results of Audit

Finding: CPD Did Not Appropriately Assess State CDBG Grantees’
Risk to the Integrity of CPD Programs or Adequately Monitor Its
Grantees
CPD did not appropriately assess the risk that its State CDBG grantees posed to the integrity of
CPD programs, nor did it adequately monitor its grantees. Specifically, risk analyses did not
accurately assess grantee risk, resulting in misstated risk scores and inaccurate annual work
plans; and did not include adequate documentation to support risk determinations. Further, the
monitoring reviews did not adequately document or support conclusions. This condition
occurred because field office staff did not follow CPD guidance and field office management did
not correct noncompliance by field staff performing risk assessments and monitoring.
Compounding the field office deficiencies, the headquarters OFM desk officer review was solely
administrative 3 and failed to identify and correct noncompliance and inconsistencies. As a result,
CPD cannot be assured that it appropriately identified the high-risk grantees, conducted adequate
monitoring, and provided guidance to better ensure proper administration of Federal funds.

CPD Did Not Properly Prepare Risk Analyses
CPD failed to properly assess grantee risk. 4 The risk analyses of three State CDBG programs
reviewed contained errors or omissions that misstated the overall risk scores for grantees. These
errors impaired the accuracy of the field offices annual work plans compiled from ranking
grantee risk scores to identify grantees for review.
Denver, CO, Field Office (North Dakota) Risk Analyses
The Denver field office did not appropriately assess the risk level for the State of North Dakota’s
CDBG program for fiscal years 2015 and 2016. Specifically, the North Dakota risk analyses for
both years included assessments that conflicted with documents in the field office’s possession
and questionable assessments that should have required further investigation and explanation.
For example,

    •    Risk Factor 1A, Grantee Reporting: 5 If the State was late with a required report within
         the last 3 years, CPD Notice 14-04 required a medium-risk rating. For both fiscal years,
         the State submitted at least one late report; however, the field office incorrectly rated the
         State as low risk.

3
    Administrative matters included reviewing for signed letters, checking tasks completed within certain
    timeframes, and uploading of exhibits without review of content.
4
    CPD Notice 14-04.
5
    These are the risk factors from Attachment A-1 of CPD Notice 14-04.




                                                          4
    •    Risk Factor 2F, Grantee’s Portfolio Includes RLF(s) 6 or Float-Funded Activities: The
         fiscal year 2016 risk analysis reported that the State had a revolving loan fund with more
         than $1 million. However, the fiscal year 2015 risk analysis did not report the revolving
         loan fund. The field office rated this factor as high risk in fiscal year 2016 but low risk in
         fiscal year 2015. It was possible that the State had established a revolving loan fund in
         2016; however, with more that $1 million per year noted in the comments section, it was
         unclear why the field office did not explain this loan fund in its risk analysis.
Despite these errors, for fiscal year 2016, the field office did rate three risk factors higher than
required due to the lack of monitoring within the last 3 fiscal years. These risk factors included
grantee staff, programmatic, and financial staff capacity issues. The explanation stated that
while there were no indicators of known issues, the lack of monitoring in 3 years required a
medium-risk rating. CPD should consider this a best practice and require at least a medium-risk
rating for States that it has not monitored in the last 3 years.
Baltimore, MD, Field Office Risk Analyses
The Baltimore field office’s files did not support its risk analyses of the State of Maryland. For
13 of 16 risk factors, this required examining 3 fiscal years of information. 7 The field office
posted the fiscal years 2015 and 2016 risk analyses to the Grants Management Process-
Reengineered (GMP-R) system as required. The GMP-R system did not allow for the uploading
of supporting documents. The field office also did not have documents supporting its
conclusions in its office files. Further, the CPD representative provided no comments in the
space provided on the risk analysis form to note the procedures performed to make the risk
assessment.
In the absence of supporting documentation and explanatory comments noting procedures
performed and conclusions reached to support the assessed risk level, the accuracy and reliability
of the assessment could not be determined.

    •    The field office representative incorrectly assessed Risk Factor 1E: Grantee Monitoring
         and Sanctions (Monitoring and OIG). A low risk was assigned; however, CPD had not
         monitored the State for 5 years. HUD policy required a risk assessment of high risk for
         grantees not monitored in the last 3 years.
    •    In other instances, the field office representative failed to support the assessed risk for
         Risk Factor 2A: Grantee Financial Staff Capacity. HUD policy required review and
         analysis of grantee financial staff information from the preceding 3 years. The field
         office provided no documentation or explanatory comments on procedures performed to
         support the low-risk assessment.




6
    Revolving loan fund.
7
    See footnote 4 on page 4.




                                                   5
Oklahoma City, OK, Field Office Risk Analyses
The Oklahoma City field office’s files did not support its risk analyses for the State of
Oklahoma. The field office posted the fiscal years 2015 and 2016 risk analyses to its grant
monitoring system but did not have documents in its office files to support its conclusions.
Thirteen of sixteen risk factors required examining 3 years of information. 8 During our review,
the field office could not provide what should have been readily available supporting documents
and reports required to complete its risk analyses. After several requests and discussions, the
field office still was unable to do so.

CPD’s fiscal years 2015 and 2016 risk analyses did not comply with requirements. Specifically,
certain assessments were

    •    Unsupported due to lack of documentation. For example, Risk Factor 1B: Grantee
         Capacity and Program Design deals with turnover in key positions and program design of
         complexity in excess of the capacity and programmatic knowledge of grantee staff during
         the past 3 years. The CPD representative ranked this factor as low risk. In the absence of
         supporting documentation, the assessment of low risk was not supported.
    •    Incorrect due to application of wrong risk-level selection criteria. For the Risk Factor 1F:
         Grantee’s Management of Subrecipients, the field office representative assessed low risk,
         which was applicable only for States with no subrecipients. However, the State had
         subrecipients, which required a minimum assessment of medium risk.
    •    Flawed due to risk assessment analysis. For example, the field office representative
         assessed the Risk Factor 2B: Monitoring Finding Resulting in Repayment or Grant
         Reduction as low risk. However, CPD had not monitored the State for 5 years. In the
         absence of monitoring during the preceding 3-year assessment period, the need for any
         repayment or reduction of funds could not be determined. The assessment of low risk
         under CPD Notice 14-04 was technically correct but flawed because the field office
         assessed a factor as low risk although it had not monitored the State in 5 years.
Overall, the field offices needed to assess each factor accurately to ensure that it ranked each
grantee appropriately to develop the field office annual work plan and monitor those grantees
posing the highest risk. Otherwise, the field office could not accurately and reliably develop an
annual work plan to set grantee monitoring priorities. Field office risk analyses were not always
supportable, defensible, or adequately documented. 9

CPD Did Not Adequately Monitor State CDBG Program Grantees
Field offices failed to adequately monitor State CDBG programs, to include failure to (1)
consistently prepare and approve individual monitoring strategies, (2) document monitoring
procedures and support bases for conclusions, and (3) address sampling and sampling selection


8
    See footnote 4 on page 4.
9
    See footnote 2 on page 3.




                                                   6
methods. Based on the results of their risk analyses, field offices monitored high-risk grantees
onsite and non-high-risk grantees onsite or remotely. For all five State CDBG monitoring
reviews examined, 10 monitoring conclusions and findings, positive or negative, were not
supportable, defensible, or adequately documented 11 due to a lack of procedures performed,
absence of supporting documentation, and inadequate explanation.
Individual Monitoring Strategies Not Consistently Prepared and Approved
Field offices failed to consistently prepare and approve monitoring strategies when they
monitored State CDBG programs. CPD policy required the field office to prepare an individual
monitoring strategy to define the scope and focus of the monitoring effort before its staff
performed the review. Of the five strategies reviewed,

     •    the Greensboro, NC, field office did not prepare a strategy;
     •    the Chicago, IL, field office prepared a strategy, but the CPD director did not approve it;
     •    the Birmingham, AL, field office prepared a strategy, but the CPD director did not
          approve it until after the monitoring engagement; and
     •    the Denver, CO, and Jackson, MS, field offices prepared and approved its strategy in a
          timely manner.
Procedures and Support Bases for Conclusions Not Documented
The monitoring work maintained in its grants management systems or its field offices did not
support conclusions, findings, or concerns. 12 As discussed by field office below, each one did
not maintain sufficient monitoring work to support conclusions, findings, and concerns. In
addition, the monitoring work did not address sampling or sampling selection methods.
HUD policy stated, “It is essential that each step of the monitoring process be adequately
documented. Documenting preserves the valuable results, both positive and negative. All
correspondence, documentation and working papers relating to the monitoring and conclusions
are to be maintained in the official Field Office files. Where appropriate or required, information
can be maintained in electronic form (e.g., GMP).” 13
To guide State CDBG monitoring efforts, CPD established exhibits for staff use. HUD policy
stated, “The responses to the questions in this Handbook Exhibits form the basis for monitoring
conclusions and are supplemented by program participant records copied or reviewed during the
monitoring. All exhibit questions must be clearly answered (both the ’Yes/No/N/A’ box and the
’Basis for Conclusion’ text box). For example, an N/A response could indicate either that the
question did not apply or the reviewer was unable to answer it (due to time constraints,




10
     Alabama, Colorado, Illinois, Mississippi, and North Carolina.
11
     See footnote 2 on page 3.
12
     Ibid.
13
     Ibid.




                                                          7
unexpected problems in other areas, etc.). The ’Basis for Conclusion’ needs to succinctly but
explicitly explain this.” 14
HUD policy also stated, “Specific responses to the Exhibit questions are expected. Although this
approach can take more time up-front, it yields higher quality reviews that provide a better
picture of a program participant’s grant program for supervisory staff, future CPD
Representatives, for the program participant, and others who have a need to review the program
participant’s performance or HUD’s monitoring efforts.” 15
HUD policy further stated that personnel should “Keep in mind that people unfamiliar with the
program participant, or the program/area being monitored, assess CPD monitoring efforts (e.g.,
staff participating in a Quality Management Review, or from HUD’s OIG or GAO). Field Office
changes may also result in reassignment of program participants to different CPD staff.
Therefore, monitoring conclusions must be clear to persons unfamiliar with the participant,
program or technical area.” 16 As shown below, each field office had different and multiple
instances where the monitoring documents did not support findings, conclusions, or concerns. 17
Birmingham Field Office Monitoring Review
The Birmingham field office failed to adequately monitor the State of Alabama. The field office
monitored the State’s CDBG program in August 2016. As required, 18 the field office prepared an
individual monitoring strategy; however, the field office CPD director did not approve the
strategy until after the monitoring review. Program elements identified for monitoring were (1)
eligibility and national objective, (2) conformance to method of distribution, (3) grant recipients,
and (4) administrative financial management requirements.
In the eligibility and national objective exhibit, 19 a question asked whether all projects met
eligibility and national objective requirements. The field office responded, “Any file will have to
have the required information if they have been monitored. Files were reviewed and contained
correct information.” This conclusion did not detail the procedures performed, number of files
reviewed, specific files reviewed, or results of testing by the CPD representative. Another
standard question asked whether the State CBDG grantee was accurately entering data into the
Integrated Disbursement and Information System (IDIS). 20 The field office representative wrote,
“By the staff member. No mistakes sited [sic] by Washington, so everything must be done
correctly.” Appearing to shift its responsibility to headquarters showed that the staff did not
understand its responsibility to review, document, and verify reported information.



14
     Ibid.
15
     Ibid.
16
     Ibid.
17
     Ibid.
18
     Ibid.
19
     HUD Handbook 6509.2, REV-6, CHG-2, chapter 4, exhibit 4-1, question 10.
20
     Ibid., question 15.




                                                       8
The grant recipients exhibit 21 asked about the State’s applying remedies for noncompliance
consistently and fairly. The CPD representative answered, “Yes-all is consistent and fair.
Information from group of managers reviewing the files.” Depending only on the State’s
comments without performing procedures to verify information can lead to incorrect
conclusions.
In the administrative financial management exhibit, 22 the CPD representative answered 16 of 22
questions with the same answer, “Interview with [State employee] and subrecipient audit review
documentation.” This explanation did not describe the interview or procedures performed to
verify the information. Further, in March 2016, OFM trained its CPD directors on monitoring
reviews. 23 In the training, it directed staff not to have the same answer for different questions.
The training further directed field office personnel to make clear what they had reviewed and
why they thought the grantee was or was not in compliance. In addition, failing to support the
conclusions drawn, the unacceptable use of the same, incomplete explanation for 16 questions
indicates that the field office ignored the OFM training guidance.
The monitoring of the State’s CDBG program produced no findings. The field office noted one
concern, recommending that the State update its policies and procedures to comply with current
regulations. The field office did not record this concern in the related exhibit for review of
administrative financial management requirements 24 or in supporting documents.
Denver Field Office Monitoring Review
The Denver field office failed to adequately monitor the State of Colorado. The field office
monitored the State’s CDBG program in May 2015. It prepared and approved the monitoring
strategy in a timely manner but incorrectly filed it in the wrong system. The program elements
identified for monitoring were (1) eligibility and national objective, (2) timely distribution, and
(3) grant review recipients.
In the eligibility and national objective exhibit, 25 one question asked about the State’s method for
determining the total amount of funds benefiting low- to moderate-income persons for the period
selected. The CPD representative wrote, “Review of each application to determine whether area
benefit which must be 51% or higher or limited clientele.” This statement appeared to refer to
the criteria rather than procedures performed by the CPD representative to determine whether the
State met the criteria. In addition to a specific answer to the question, the CPD representative
could have obtained the most recent overall funding decisions showing that the State’s planned
activities met the required percentage.
In the same exhibit, another question asked whether the State had shown that the projects were
eligible and met a national objective. 26 The field office used information from the State’s
application review records, monitoring reviews, and information from IDIS to support its


21
     Ibid., exhibit 4-6, question 22.
22
     Ibid., exhibit 4-7.
23
     Headquarters provided the PowerPoint guidance to field office CPD directors for dissemination.
24
     See footnote 22 on page 9.
25
     See footnote 19 on page 8, question 11.
26
     24 CFR (Code of Federal Regulations) 570.201 and 570.208.
                                                          9
conclusion for its review of three activities. The application review records and unverified
information from IDIS would not be sufficient to verify eligibility and national objective
compliance. In addition, the monitoring reviews did not have the level of detail needed to
confirm eligibility and national objective compliance according to CPD guidance. For instance,
the field office collected one page of a State-prepared file review for a single-family
rehabilitation project. The State’s review contained conflicting information concerning
ownership and the location of the project. Further, the owner’s income information consisted of
a question mark with a note stating that the reviewer did not have recent owner income data.
Without clarifying the location and owner income, the field office did not support its conclusion
that the State funded an eligible project that met a national objective.
The grant recipients exhibit asked whether the State maintained adequate records to document
that recipients complied with the provisions of Title I and other applicable laws. 27 The CPD
representative stated that the State had maintained adequate documentation for its monitoring
reviews. The CPD representative wrote that the State maintained monitoring checklists and
reports in its records but did not address whether the State maintained appropriate documentation
to support its monitoring checklists or conclusions drawn. The State is required to maintain and
the CPD representative would need to verify and document the existence and accuracy of
pertinent documentation to support national objective compliance, activity eligibility, and
expenditures.
In the field office’s monitoring report to the State, the field office stated that it reviewed all
vouchers and invoices for the three selected activities. However, the exhibits and supporting
documentation did not provide evidence of this type of review. Although this procedure would
support that the State spent funds appropriately, the CPD representative did not document the
scope of the procedures to support the field office’s conclusions. In addition, the field office did
not document one of the noted concerns in the monitoring report.
Chicago Field Office Monitoring Review
The Chicago field office failed to adequately monitor the State of Illinois. The field office
monitored the State’s CDBG program in fiscal year 2015, prepared an individual monitoring
strategy, and posted it to its grants management system as required; however, the field office
CPD director did not approve the strategy. Program elements identified for monitoring review
were (1) eligibility and national objective, (2) review of grant recipients, and (3) review of
administrative and financial management requirements.
A question in the eligibility and national objective exhibit asked whether the State entered
performance measurement data into IDIS. 28 The CPD representative noted, “Review of internal
records and a comparison with the Integrated Disbursements [sic] and Information System
(IDIS) showed the State is entering the performance measurement data.” However, the CPD
representative failed to specify the “internal records” reviewed, how many records were
reviewed, what procedures were performed, the data from the internal records that were
compared to and agreed with IDIS, or the overall test results. Further, IDIS consisted of self-


27
     See footnote 19 on page 8, exhibit 4-5, question 27.
28
     See footnote 19 on page 8, exhibit 4-1, question 14.
                                                            10
reported, unverified information provided by the State, which raises additional questions
regarding accuracy and reliability.
In the grant recipients exhibit, a question asked whether the State’s procedures included
reasonable means and criteria by which it made the required determination that recipients had a
continuing capacity to carry out CDBG programs. 29 The CPD representative wrote, “This is
determined by the Application Process, the Risk Analysis elements, and on-site desk findings.
Any capacity issues are transmitted in the monitoring review.” The CPD representative entered
a summary of sources of means and criteria but failed to specify the actual means and criteria
requirements in use by the grantee. Further, the CPD representative did not address procedures
performed, programs or activities reviewed, and results of testing. Finally, there was no
conclusion as to whether the means and criteria were reasonable. The field office did not attach
supporting documentation.
The CPD representative did not complete the administrative and financial management exhibit. 30
The field office completed the exhibit’s first worksheet but then waived completion of the
remainder of the document, which consisted of 24 questions and 3 additional worksheets,
commenting, “Note: Due to time constraints, HUD did not complete the upcoming sections of
this exhibit.” By limiting the monitoring engagement in this manner, the field office undermined
its monitoring strategy, limited its monitoring engagement’s effectiveness, and failed to meet the
intent of its oversight responsibilities.
The monitoring review produced one finding and one concern. The CPD representative
identified both items as such with the applicable questions in the eligibility and national
objective exhibit. 31 However, the field office did not post the supporting documentation to its
grants management system or maintain supporting documents in the field office files.
Jackson Field Office Monitoring Review
The Jackson field office failed to adequately monitor the State of Mississippi. The field office
monitored the State’s CDBG program in fiscal year 2016, prepared an individual monitoring
strategy, and submitted it as required. The field office CPD director approved the strategy in a
timely manner. The field office limited its review to eligibility and national objective as the
engagement focused on one activity only: an economic development project shown on the IDIS
PR59 - CDBG Activities at Risk and Cancelled with Draws Reports as fully expended but
canceled.
The basis for conclusion for several questions regarding eligibility and national objectives
referenced only discussion with and representations of the director of the Community Services




29
     Ibid., exhibit 4-6, question 17.
30
     Ibid., exhibit 4-7.
31
     Ibid., exhibit 4-1.




                                                 11
Division. 32 The CPD representative noted no procedures to confirm these representations, and
without validating procedures, the conclusions were unsupported.
A number of requirements questions dealing with preapproval and post approval for eligibility
and national objectives implied that the CPD representative had performed procedures, but the
CPD representative failed to list the procedures performed. 33 Without noting the procedures
performed, items examined, and results, the conclusions were unsupported.
The monitoring report prepared by the field office and provided to the grantee noted three
findings. 34 According to HUD policy, findings must include five elements: condition, criteria,
cause, effect, and corrective action. Policy guidance further explained the elements. 35 A review
of the monitoring letter to the grantee determined that the field office failed to properly address
required components, in particular regarding condition (what was wrong or what the problem
was) and cause (why the condition occurred). For example, for finding 1, the condition was a
failure to meet a national objective, but the cause given was that the company closed without
creating jobs. The statement given as a cause was factual but did not explain how or why the
condition occurred. The written findings did not comply with HUD policy. 36
The monitoring of the State’s CDBG program produced three findings and no concerns. The
field office did not clearly reference the findings to the applicable questions in the body of the
eligibility and national objective exhibit. Further, the three findings were not supported.
Greensboro Field Office Monitoring Review
The Greensboro field office failed to adequately monitor the State of North Carolina. The field
office monitored the State’s CDBG program in fiscal 2015 but failed to prepare, approve, or post
an individual monitoring strategy to its grants management system as required. Program
elements identified for monitoring review were (1) eligibility and national objective, (2)
eligibility and national objectives: economic development supplement, (3) overall benefit test,
(4) conformance to method of distribution, (5) timely distribution, and (6) grant recipients.
In the eligibility and national objective exhibit, a question asked whether all of the State’s funded
projects met eligibility and national objective requirements, to which the CPD representative
responded, “State program guidelines for eligible activities are designed around federal
requirements.” 37 The CPD representative did not document procedures performed, if any, or the
results of testing to determine State compliance with the requirement.
In the economic development supplement exhibit, a question asked whether the State had an
adequate process to ensure that all funded activities complied with State or local underwriting

32
     See footnote 31 on page 11, questions 3, 6, 7, and 8.
33
     Ibid., questions 10, 11, 12, 13, 14, and 16.
34
     CPD monitoring report to the Mississippi Development Authority, dated September 29, 2016.
35
     For example, condition: what was wrong or what the problem was.
36
     See footnote 2 on page 3.
37
     See footnote 31 on page 11, exhibit 4-1, question 10.




                                                        12
guidelines. The CPD representative’s basis for conclusion noted, “In addition to the guidelines,
all activities are monitored regularly.” 38 The CPD representative did not document how this was
determined or whether the activities complied with underwriting guidelines.
The overall benefits test basis for conclusion noted, “For 2012, 94% of funds benefited LMI [low
and moderate income].” 39 The field office showed a calculation but did not detail the procedures
for determining the accuracy of the financial data used in the calculation or the results of any
related testing and validation. The CPD representative also noted that the calculation was for
2012, when the notification letter specified program year 2013.
In the conformance to method of distribution exhibit, a question asked about the State’s
communication of its method of distribution to units of general local government. 40 The CPD
representative responded, “Announced with NOFA [notice of funding availability] workshops
and application.” The CPD representative’s basis for conclusion did not support a conclusion. It
did not note the specific documentation reviewed or the results of testing that verified official
notification of the subrecipients in question or documentation of this notification in the field
office files.
For timely distribution, a question asked whether the State had complied with the timely
distribution requirements, to which the CPD representative noted, “Submission of Timeliness
Report; Reviewed 20 activities for IF-2013; Reviewed 5 activities for CD-2012.” 41 The CPD
representative provided no support or explanation for the underlying financial and administrative
data and did not address the specific reports or activities reviewed, procedures performed, or
results of testing.
In the grant recipients exhibit, a question asked whether the State’s procedures included
reasonable means and criteria to determine that recipients had continuing capacity to carry out
CDBG programs. 42 The CPD representative noted, “Per SOP [standard operating procedure], the
State conducts regular on-site and desk reviews of on-going activities. In addition, the State
reviews progress and implementations reports to determine whether sufficient activity is being
undertaken relative to expenditure to date. The State views this as a way to determine continued
capacity. Additionally, threshold capacity is a factor used with all applications prior to funding.”
The CPD representative entered a summary of the means and criteria used but failed to note
procedures executed, specific programs and activities reviewed, and results of testing.
The monitoring of the State’s CDBG program produced no findings and one concern related to
expeditious distribution of program income. The CPD representative failed to note the concern



38
     See footnote 19 on page 8, exhibit 4-2, question 13.
39
     Ibid., exhibit 4-3, question 4.
40
     Ibid., exhibit 4-4, question 3.
41
     Ibid., exhibit 4-5, question 1.
42
     Ibid., exhibit 4-6, question 17.




                                                            13
related to expeditious distribution of program income in the timely distribution exhibit 43 with
supporting documentation.
Sampling and Sampling Selection Methods Not Addressed
CPD representatives failed to address sampling and sampling selection methods in their
monitoring reviews. To reach their conclusions, field offices needed to select a sample of files to
review. CPD policy stated, “…sampling is generally expected to form the basis for drawing
conclusions about the program participant’s performance.” 44 Without sufficient explanation of a
sample selection method or listing of sample items, a reviewer or an approver would be unable to
assess the validity or adequacy of the sample. Only the Denver field office addressed sampling
and sample selection methods. The Jackson field office focused its review on one activity. The
remaining three field offices either did not list sample items, did not explain the sample selection
method, or both.
In summary, field offices reviewed did not adequately monitor State CDBG grantees. Individual
monitoring strategies did not consistently show timely preparation, review, or approval. Field
office staff did not perform procedures in some instances and in other instances indicated they
performed procedures but failed to document them. The field offices also did not post
supporting documents in GMP-M or maintained documents in the field office files. In addition,
the CPD representatives failed to document sampling applications. Field office monitoring
procedures failed to produce conclusions, findings, and concerns that were supportable,
defensible, or adequately documented. 45
Monitoring Exhibits Need Improvement to Enhance Grantee Monitoring
The State CDBG exhibits 46 need enhancements as they did not guide CPD staff to adequately
support, defend, and document monitoring conclusions. Under CPD’s process, a series of
monitoring exhibits functioned as guides for the CPD representative in the performance of a
comprehensive review of the area(s) identified for monitoring and the development of sound
conclusions regarding compliance with requirements. 47 The exhibits in use during the
examination period had a number of deficiencies, which weakened the monitoring process that
they were intended to facilitate. These issues included the (1) use of closed-ended questions, (2)
reliance on unverified data, (3) lack of emphasis on testing of controls, (4) omission of criteria,
(5) reliance on opinions, and (6) lack of sampling guidance.
Closed-Ended Questions Leading To Yes or No Answers Instead of Procedures
The exhibits placed heavy emphasis on closed-ended questions and failed to direct substantive
procedures. The questions led CPD representatives toward yes or no answers based solely on
interviews. The questions should have included performing procedures to verify, review, and


43
     Ibid., exhibit 4-5, question 2.
44
     Ibid.
45
     Ibid.
46
     With the exception of Exhibit 4-9, Colonias Set-Aside, which applies to four States only.
47
     See footnote 2 on page 3.




                                                           14
confirm answers provided to document and support conclusions drawn. For instance, a question
in the eligibility and national objective exhibit asked whether the State accurately entered data
into IDIS. 48 As IDIS consists of self-reported data, this was an important question to ask;
however, the exhibit did not require CPD representatives to perform procedures to verify the
validity of the answer. As written, the question relied only on the State’s representations.
In another instance, the timely distribution exhibit asked whether the State complied with timely
distribution requirements. 49 The exhibit did not specify the criteria or information identified for
review. Inquiry alone was not sufficient to support a determination of timely distribution.
Reliance on Unverified Data
The reliance on self-reported unverified data, mostly IDIS, to support compliance with
requirements increased the probability of an incorrect conclusion. CPD should not have allowed
sole reliance on IDIS or other forms of unverified data without performing procedures to validate
the information.
For example, in the overall benefit test exhibit, the table for calculation of the 70 percent test 50
had no requirement to verify the financial data used in the calculation. 51 No supportable
conclusion was possible given reliance on nonvalidated information.
Failure To Require Testing of Controls
The exhibits did not mandate testing of controls, which increased the probability of invalid
conclusions. Instead, questions often focused on identification of controls. CPD should have
focused on determining whether controls operated and functioned as designed. Valid
conclusions required objective and substantive procedures.
The exhibit for administrative and financial management requirements included a number of
questions that focused on the State’s controls. For example,

     •    Does the system have a procedure for informing…?
     •    Does the system have a way of ensuring…?
     •    Does the system include a process for reviewing…?
     •    Does the system have a means for deciding…?
     •    Does the system require each local government to permit…?
None of the questions required CPD representatives to perform procedures to determine whether
the particular control functioned as designed. 52


48
     See footnote 19 on page 8, exhibit 4-1, question 15.
49
     Ibid., exhibit 4-5, question 1.
50
     To ensure that not less than 70 percent of their funds were used for activities, which benefited low- and
     moderate-income persons over a period not to exceed 3 years.
51
     See footnote 19 on page 8, exhibit 4-3, question 3.
52
     Ibid., exhibit 4-7, questions 1, 5, 9, 13, 15, 16, and 17.




                                                            15
Omission of Criteria
Exhibits omitted detailed criteria that possibly led CPD representatives to miss requirements.
Certain questions involved a substantial number of items to meet a requirement but failed to
detail all items of the requirement and, therefore, increased the risk of omission or error.
For example, the eligibility and national objective exhibit asked whether all of the State’s funded
projects met eligibility and national objective requirements. 53 The underlying requirements
detailed many items that required an individual assessment. Failure to address each requirement
individually on the exhibit increased the possibility of error or omission.
As another example, the conformance to method of distribution exhibit asked whether the State’s
process for reviewing and approving project amendments complied with the local government
citizen participation requirements specified in the State’s citizen participation plan and in 24
CFR (Code of Federal Regulations) 570.486(a)(6), which detailed many local government
requirements. 54 Simply including the reference instead of listing the applicable items did not
address comprehensive participation requirements.
Reliance Upon Opinion
Some questions invited subjective opinion rather than substantive procedures. For example, the
eligibility and national objective: economic development supplement exhibit asked whether the
State had an adequate process to ensure that all funded activities complied with State or local
underwriting guidelines. 55 The issue was whether the State system functioned to ensure
compliance with underwriting guidelines: yes or no. As written and without directed
procedures, the question invited subjective opinion, not a conclusion based on fact.
In another example, the review of closeout system exhibit asked CPD representatives if, based on
the results of their review, including any sampled files, the State’s procedures appeared to be
implemented in both of the following situations: cause and convenience. 56 The objective should
be to determine whether the system worked, yes or no, according to requirements, not whether
the system “appeared” to have been implemented.
Failure To Provide Guidance or Require Documentation of Sampling and Sampling Selection
Methods
The exhibits failed to provide guidance or require documentation of sample selection method and
testing. Without specifying sampling documentation requirements or providing guidance on
them, CPD representatives were not able to meet requirements.




53
     Ibid., exhibit 4-1, question 10.
54
     Ibid., exhibit 4-4, question 4(c).
55
     Ibid., exhibit 4-2, question 13.
56
     Ibid., exhibit 4-8, question 13.




                                                 16
Certain exhibit sections required sampling for completion. For the conformance to method of
distribution exhibit, the sample review and file analysis section did not provide guidance for
sampling method selected, adequacy of sample size, or summarization of sampling results. 57
In addition, certain worksheets required sampling for completion. A worksheet in the review of
grants recipients exhibit that required sampling did not require support for the sampling method
selected or documentation of testing or provide for specific procedures performed and the
attachment of supporting documents with references. 58 The worksheet instructions were to attach
“comments/explanation(s) to describe sampling method and support responses and conclusions.”
Deficiencies in Revised Exhibits Issued With CPD Monitoring Handbook 6509.2, REV-7
The revised exhibits issued in February 2017 did not correct the deficiencies. In addition to
analysis of the exhibits in use during the audit period, review of these new exhibits 59 noted the
same deficiencies. Without required performance of procedures, verification of self-reported
State data, and documentation of testing and test results, the new exhibits did not provide a
monitoring framework for conclusions that were supportable, defensible, or adequately
documented.
The exhibits in use during the audit period need improvement to provide CPD representatives
with better guidance that directs them (1) away from yes or no answers, (2) to not rely on inquiry
only, (3) to emphasize system characteristics as opposed to function, and (4) to avoid subjective
opinion. The exhibits should aid CPD representatives in performing substantive procedures to
obtain objective information to support conclusions. The updated exhibits, issued in February
2017 do not provide the required basis for compliance with HUD requirements that all
conclusions, positive or negative, be supportable, defensible, and adequately documented. 60
Conclusion
These conditions occurred because CPD did not have controls in place to ensure consistent
compliance with these requirements by the field offices or that headquarters could identify and
correct noncompliance with requirements. Field office staff did not follow HUD risk assessment
and monitoring requirements, and there were indications that staff ignored OFM training
guidance provided in March 2016. In addition, field office management did not correct
noncompliance by field staff performing these oversight duties. In all three field offices
reviewed for their risk assessment efforts, the field office CPD director approved the risk
analyses without correcting errors or omissions or explaining discrepancies. In addition, the files
provided for the five field offices tested for monitoring efforts did not contain evidence that field
office management identified or corrected monitoring deficiencies. Compounding the field
office deficiencies, the headquarters OFM desk officer review was solely administrative and
failed to identify and correct noncompliance and inconsistencies. Further, CPD failed to require
uploading of supporting documents into its grants management system, and field offices did not
maintain these documents in their office files. Without supporting documentation, a reviewer,


57
     Ibid., Exhibit 4-4, Section C-Sample Review and File Analysis.
58
     Ibid., Exhibit 4-6, State Recipient Review Worksheet.
59
     With exception to HUD Handbook 6509.2, REV-7, exhibit 4-9.
60
     See footnote 2 on page 3.
                                                          17
approver, or other parties reviewing the monitoring review would not be able to verify the
reported information. Also, HUD would not be able to defend its conclusions if disagreements
arose. As a result, CPD cannot be assured that it appropriately identified the high-risk grantees,
conducted adequate monitoring, and provided guidance to better ensure proper administration of
Federal funds.
Recommendations
We recommend that the General Deputy Assistant Secretary for Community Planning and
Development

       1A.     Develop and implement a quality review process at the headquarters level to
               ensure consistent compliance with its policy for risk analysis, to include but not
               be limited to reviewing supporting documentation for conclusions drawn.
       1B.     Develop and implement a policy requiring field offices to rate grantees of at least
               medium risk that have not been monitored in their respective program area within
               the last 3 years on factors that require assessments of capacity, program
               complexity, and monitoring findings resulting in repayment or grant reductions.
       1C.     Develop and implement guidance for field offices to maintain supporting
               documentation in their official files with an adequate explanation of procedures
               performed to verify risk scores assigned, which could include upgrading CPD’s
               systems to allow for the attachment of supporting documentation for risk
               analyses.
       1D.     Develop and implement a quality control review process at the headquarters level
               to ensure compliance with monitoring requirements for reports and exhibits, to
               include but not be limited to explaining procedures performed and adequately
               explaining and providing supporting documentation for conclusions drawn.
       1E.     Require field offices to upload referenced supporting documentation into CPD’s
               system for findings and concerns developed during the monitoring review.
       1F.     Update exhibits to require staff to document procedures performed, provide
               sufficient explanation to verify procedures performed and conclusions drawn, and
               reference appropriate supporting documentation.




                                                 18
Scope and Methodology
We performed our audit work from November 2016 through April 2017 at HUD headquarters in
Washington, DC, and remotely via telephone, email, or both with the Birmingham, AL, Denver,
CO, Chicago, IL, Baltimore, MD, Jackson, MS, Greensboro, NC, and Oklahoma City, OK, CPD
field offices. Our review period was from October 2014 through September 2016.
To accomplish our audit objective, we

          •   reviewed relevant Federal laws and regulations,
          •   examined HUD policies and procedures,
          •   interviewed headquarters and field office CPD personnel, and
          •   analyzed State CDBG exhibits. 61

Sample Selection
During the audit period, CPD had 50 State CDBG entities. Among the population of grantees,
we noted

     •    21 State CDBG monitoring reviews,
     •    8 monitoring reviews with findings,
     •    13 monitoring reviews without findings, and
     •    6 States with no review since fiscal year 2011.

We selected

     •    three State CDBG grantees with no monitoring since at least fiscal year 2011 for review
          of their fiscal years 2015-2016 risk analyses and
     •    five State CDBG grantees monitored during fiscal years 2015-2016:
              o three monitoring reviews with findings
                        Colorado – Numerous findings with corrective action listed as “other.”
                        Illinois –Financial management exhibit was not completed, but the other
                           exhibits contained findings and concerns.
                        Mississippi – Only one exhibit reviewed with three findings resulting in
                           reimbursement.
              o two monitoring reviews without findings
                        Alabama – One concern in financial management exhibit.
                        North Carolina – Notified of issues concerning ineligible activity
                           occurring.

Our sample selection was based in part on analysis of findings, interviews with HUD staff, and
previous audit experience. While individual results could not be projected, the selections did

61
     See footnote 46 on page 14 and footnote 59 on page 17.
                                                         19
provide sufficient evidence to conclude whether CPD followed its requirements and its guidance
was effective to ensure that CPD accurately rated and ranked grantees and appropriately
monitored those grantees selected.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                20
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to
•   effectiveness and efficiency of operations,
•   reliability of financial reporting, and
•   compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:
•   Program operations – Policies and procedures that management has implemented to
    reasonably ensure that a program meets its objectives.
•   Validity and reliability of data – Policies and procedures that management has implemented
    to reasonably ensure that valid and reliable data are obtained, maintained, and fairly
    disclosed.
•   Compliance with laws and regulations – Policies and procedures that management has
    implemented to reasonably ensure that resource use is consistent with laws and regulations.
We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiencies
Based on our review, we believe that the following items are significant deficiencies:
•   CPD did not have adequate controls to ensure compliance with risk analysis or monitoring
    reviews requirements.
•   CPD did not have adequate controls for the collection, validation, and analysis of source data
    sufficient to draw conclusions, findings, and concerns that were supportable, defensible, and
    adequately documented.


                                                  21
Appendix
             Auditee Comments and OIG’s Evaluation


                       Auditee Comments


Ref to OIG
Evaluation




Comment 1




Comment 2




                               22
             Auditee Comments




Ref to OIG
Evaluation




Comment 3
Comment 1


Comment 4




Comment 5
Comment 4




                    23
             Auditee Comments




Ref to OIG
Evaluation



Comment 6
Comment 1




Comment 7




Comment 8




                    24
                                 OIG Evaluation of Auditee Comments
Comment 1         HUD did not disagree with the finding, but explained that the condition existed
                  partly because of suspension of its Quality Management Reviews (QMRs) in
                  2011. 62

                  HUD’s response did not state why it stopped performing QMRs in 2011.
                  Although the suspension of QMRs occurred in 2011, CPD headquarters decided
                  the type and extent of reviews that it would perform or not perform. CPD had the
                  policies to perform the risk analysis and monitoring, but as stated in the finding,
                  CPD did not have any procedures to determine compliance with requirements.
                  Further, our recommendation was not to review the field offices on an ad hoc
                  basis, but implement a quality review process at the headquarters level to ensure
                  consistent compliance with its policy.

Comment 2         HUD stated that we erroneously applied an auditing standard in evaluating the
                  effectiveness of CPD’s monitoring of State CDBG, and that its monitoring
                  reviews were based on HUD Handbook 6509.2.

                  Throughout the report, we referenced CPD’s criteria that it was to use in rating
                  and monitoring the programs, including HUD Handbook 6509.2. As HUD’s
                  response stated, the standard was “…defensible and supportable explanations for
                  conclusions drawn.” This standard appeared to be a responsible and reasonable,
                  and it was the standard, along with other CPD criteria, that we used to evaluated
                  them. The noted deficiencies in the monitoring exhibits prevented them from
                  serving as sole support for conclusions drawn. For instance, a “yes” or “no”
                  answer stated an only conclusion, and did not provide an explanation of how the
                  CPD representative drew the conclusion. CPD needs to document its compliance
                  with its requirements by documenting support for conclusions drawn, including
                  what the CPD representative did to draw the conclusion.

Comment 3         HUD indicated that it would re-establish the QMR process for regional and field
                  offices to address recommendation 1A.

                  Re-establishment of the QMRs for regional and field offices would address the
                  deficiencies noted in the finding, However, in its comments regarding
                  recommendation 1D, HUD stated that re-establishment of the QMRs was beyond
                  CPD’s authority. Regardless, CPD had the obligation to ensure that the risk
                  analyses and monitoring not only complied with policies but were also effective.
                  CPD could take other actions to review the field offices performance such as
                  making the desk officer’s role and responsibilities more substantive and
                  programmatic rather than administrative.


62
     HUD’s response stated it implemented the QMRs to address GAO concerns pertaining to monitoring
     deficiencies, when it designated HUD as high risk in 1994.
                                                       25
Comment 4   HUD’s response stated that, in part, due to the Enterprise Risk Management
            process underway, why it would be premature or could not take actions to address
            deficiencies with its monitoring of State CDBG programs (recommendation 1B).

            HUD’s response did not provide information on the relationship of the Enterprise
            Risk Management process on its risk analyses and monitoring of State CDBG
            grantees. Further, the response was silent on when it was expected to be
            completed. Nevertheless, if HUD does not take action, it will continue to
            incorrectly assess the risk in States CDBG programs, which adversely impacts the
            ranking of grantees and the field offices’ annual work plan.

Comment 5   HUD commented that it wanted to wait until its re-imaging process related to the
            Enterprise Risk Management effort was completed before determining what
            changes were needed; and, will continue to emphasize appropriate documentation,
            but not to auditing standards (recommendation 1C).

            HUD’s comments did not address the deficiencies cited in the finding. In its
            response, HUD indicated that it has not done any substantive reviews of field
            offices since 2011. However, HUD should not continue to postpone determining
            and verifying what documentation the field office needs to retain to support its
            risk ratings.

Comment 6   HUD commented that it was beyond the authority of CPD to re-established QMRs
            and CPD did not require reviewers to document procedures performed as CPD
            considered this to be akin to an auditing standard (recommendation 1D).

            HUD policy stated, “It is essential that each step of the monitoring process be
            adequately documented.” Therefore, HUD had the obligation to establish a
            process to determine whether the field offices had “supportable and defensible”
            conclusions. HUD’s response did not indicate how field offices could support or
            defend conclusions reached without documenting what was reviewed.

Comment 7   HUD commented that the field offices were responsible for documenting
            monitoring results and uploading documents to the GMP Monitoring Module
            (recommendation 1E).

            We agree with HUD’s comments, but as discussed throughout the finding, HUD
            had no process to verify that this occurred.

Comment 8   HUD commented that compliance with the monitoring exhibits was a training and
            enforcement issue, and HUD should not be held to an auditing standard
            (recommendation 1F).



                                             26
We agree with HUD’s response in that CPD needs to provide training on the
monitoring exhibits and enforce the requirements. Contrary to HUD’s assertion,
it is reasonable and responsible to expect HUD to have processes in place to
determine and verify compliance with requirements. As stated in the finding,
CPD had sufficient policy on what information that the field offices had to retain
to support its conclusions. Further, the policy provided field offices with the
option to either upload this information or retain in its office. However, as
discussed throughout the finding, CPD headquarters did not determine or verify
compliance with its requirements.




                                  27