U.S. Department of Housing and Urban Development, Washington, DC Compliance With the Improper Payments Elimination and Recovery Act Office of Audit, Financial Audits Division Audit Report Number: 2018-FO-0006 Washington, DC May 15, 2018 To: Irving Dennis, Chief Financial Officer, F //signed// From: Thomas R. McEnanly, Director of Financial Audits Division, GAF Subject: HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010 Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of HUD’s fiscal year 2017 compliance with the Improper Payments Elimination and Recovery Act of 2010. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG website. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. Audit Report Number: 2018-FO-0006 Date: May 15, 2018 HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010 Highlights What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2017 compliance with the Improper Payments Elimination and Recovery Act of 2010 (IPERA). IPERA was enacted to eliminate and recover improper payments by requiring agencies to identify and report on programs that are susceptible to significant improper payments. IPERA also requires each agency’s inspector general to perform an annual review of the agency’s compliance with IPERA. Our audit objective was to determine whether HUD complied with IPERA reporting and improper payment reduction requirements according to guidance from Office of Management and Budget (OMB) Circular A-123. What We Found In fiscal year 2017, HUD did not comply with IPERA. HUD also did not comply with IPERA in fiscal years 2013, 2014, 2015, and 2016. In 2017, HUD failed to comply with two compliance determinations. Specifically, HUD failed to (1) conduct risk assessments according to OMB requirements and (2) publish improper payment estimates. Our results are reflected in the table below. We recognize HUD’s ongoing efforts to remediate the improper payment-related issues noted in this and prior-year reports and look forward to working with HUD on these matters in fiscal year 2018. Fiscal year 2017 IPERA compliance reporting table Published Published Reported an Published Conducted risk Published an and is improper an agency assessments corrective improper meeting payment rate financial according to action payment reduction of less than report requirements plans estimate targets 10 percent Yes No No N/A N/A N/A What We Recommend We are not making additional audit recommendations. If implemented, we expect that all prior- year audit recommendations, which have not been closed, will continue to help HUD remediate repeat findings identified in this year’s report. Table of Contents Background and Objective......................................................................................3 Results of Audit ........................................................................................................5 Finding 1: HUD Did Not Comply With IPERA ............................................................ 5 Finding 2: HUD Had Unresolved Prior-Year IPERA Audit Findings ....................... 9 Scope and Methodology .........................................................................................11 Internal Controls ....................................................................................................13 Followup on Prior Audits ......................................................................................15 Appendixes ..............................................................................................................19 A. Auditee Comments and OIG’s Evaluation ............................................................. 19 2 Background and Objective The Improper Payments Information Act of 2002 (IPIA) required the head of each agency to annually review all programs and activities administered by the agency, identify all such programs and activities that may be susceptible to significant improper payments, estimate the annual amount of improper payments for each program or activity identified as susceptible, and report those estimates. For programs with estimated improper payments exceeding $10 million, IPIA required agencies to report the causes of the improper payments, actions taken to correct those causes, and results of the actions taken. The Improper Payments Elimination and Recovery Act of 2010 (IPERA) decreased the frequency with which each agency was required to review all of its programs but increased the responsibilities and reporting requirements. IPERA also required each agency inspector general to determine whether the agency complied with IPIA as amended by IPERA. IPIA was further amended by the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA). Under IPERIA, the inspector general is required to review the assessed level of risk associated with high-priority programs, as determined by the Office of Management and Budget (OMB); the quality of the improper payment estimates and methodology for high-priority programs; and the oversight of financial controls to identify and prevent improper payments under high-priority programs. The inspector general must then submit recommendations to Congress for modifying any agency plans relating to improper payments determination and estimation methodology. OMB issued appendix C to Circular No. A-123, Requirements for Effective Estimation and Remediation of Improper Payments, on October 20, 2014, to provide guidance for agencies in implementing IPIA, IPERA, and IPERIA requirements. The U.S. Department of Housing and Urban Development’s (HUD) Secretary designated the Chief Financial Officer as the lead official overseeing HUD’s actions to address improper payment issues and complying with the requirements of IPERA. OMB Circular A-123, appendix C, requires agencies to follow a four-step process. Step 1 is to review all programs and activities and identify those that are susceptible to significant improper payments. Beginning with fiscal year 2014 reporting, “significant improper payments” are identified as gross annual improper payments1 in the program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or activity payments made during the fiscal year reported or (2) $100 million (regardless of the improper payment percentage of total program outlays). Step 2 is to obtain a statistically valid estimate of the annual amount of improper payments in programs and activities for those programs identified in step 1 as susceptible to significant improper payments. Step 3 is to implement a plan to reduce improper payments, and step 4 is to report annually in the agency financial report (AFR) or the performance and accountability report (PAR). 1 Gross annual improper payments are the total amount of overpayments and underpayments. 3 HUD reported improper payment rates in its AFR for two2 programs: its rental housing assistance programs (RHAP) and its Disaster Relief Appropriations Act supplemental appropriation. RHAP consists of three high-risk program areas – HUD’s public housing, Section 8 Housing Choice Voucher, and Moderate Rehabilitation programs – and owner-administered project-based assistance programs. HUD has reported an improper payment rate for RHAP since 2000. The Disaster Relief Appropriations Act of 2013 designated the Community Development Block Grant Disaster Recovery (CDBG-DR) program as susceptible to significant improper payments. On that basis, HUD is required to report an improper payment rate. HUD uses an alternative estimation approach approved by OMB to estimate improper payments for the CDBG-DR program. Our audit objective was to determine whether HUD complied with IPERA reporting requirements according to guidance from OMB Circular A-123. 2 The annual improper payment estimates for the third HUD program, the Federal Housing Administration’s (FHA) single family mortgage insurance program, identified as being susceptible to significant improper payment, was mistakenly omitted by HUD in its fiscal year 2017 AFR. 4 Results of Audit Finding 1: HUD Did Not Comply With IPERA Fiscal year 2017 marked the fifth consecutive year in which we determined that HUD did not comply with IPERA. We reviewed HUD’s compliance with the six IPERA requirements. Of the six IPERA requirements, HUD did not comply with two (b and c). Additionally, we found that HUD complied with one, but could not make compliance determinations on the remaining three (d, e and f). Areas of noncompliance were related to HUD’s failure to (1) conduct risk assessments according to OMB requirements and (2) publish improper payment estimates for all programs and activities identified as susceptible to significant improper payments. This condition occurred because HUD’s remediation plans3 intended to address many of the IPERA compliance issues noted in this report were not in place at the end of fiscal year 2017. Until all of the prior-year IPERA issues have been remediated, HUD will likely continue to miss opportunities to prevent, identify, reduce, and recover improper payments. HUD Did Not Comply With IPERA According to OMB Circular A-123, part II, section (A)(3), an agency must meet all six requirements to comply with IPERA. Based upon our review of the six requirements, HUD did not comply with IPERA because it failed to meet two (b and c) of the six requirements. a. Published an agency financial report – HUD complied with this requirement. The agency published an AFR for the most recent fiscal year and posted that report and accompanying materials required by OMB on the agency website. b. Conducted a compliant program-specific risk assessment process – HUD did not comply with this requirement. Specifically, we identified 14 programs in 2017 that were either not risk assessed initially or not risk assessed according to its three-year risk assessment cycle. c. Published improper payment estimates – HUD did not comply with this requirement. HUD failed to publish improper payment estimates for all of its high-risk programs. Specifically, HUD did not publish annual improper payment estimates for its Federal Housing Administration’s (FHA) single family insurance claims program, a high-risk program identified in HUD’s fiscal year 2016 AFR. According to FHA, its annual improper payment estimates for this program was $837 million. Two other high-risk programs (CDBG entitlement grants and the HOME Investment Partnerships program), identified as susceptible to significant improper payments in HUD’s 2016 AFR, also did not have improper payment estimates reported in 2017. Additionally, HUD did not publish a valid estimate of improper payments for its RHAP in its fiscal year 2017 AFR 3 In 2017, HUD made plans to change its IPERA compliance program to address many years of noncompliance with IPERA. At the end of fiscal year 2017, the plans were in the early planning stages. 5 due to its comprehensive effort in 2017 to restructure its improper payment compliance program. With regard to HUD’s CDBG-DR program, no estimation and methodology issue came to our attention during the audit. d. Published corrective action plans – We could not determine HUD’s compliance or noncompliance with this requirement. Although HUD published its corrective action plan in its fiscal year 2017 AFR, we could not determine whether the plan as published would achieve the intended goal of reducing improper payments because the root cause assessment was ongoing at the end of 2017. HUD was in the process of restructing its IPERA program in 2017, which would require it to reassess the root causes of the improper payments. e. Published and met reduction targets – We could not determine HUD’s compliance or noncompliance with this requirement. Although HUD published its RHAP improper payment estimate in fiscal year 2017, the estimation method used did not produce statistically valid improper payment estimates. As a result, the improper payment estimates that HUD reported in its fiscal year 2017 AFR could not be used to determine whether HUD met its reduction targets in that same year. f. Reported an estimate below 10 percent – Like requirement e above, a determination could not be made to assess HUD’s compliance or noncompliance with this requirement because HUD did not publish a valid improper payment estimate in its fiscal year 2017 AFR. HUD’s Risk Assessments Were Not Performed in Accordance With OMB Guidance For the past 2 years, we cited HUD for noncompliance with OMB’s risk assessment requirement. In 2017, we again found HUD noncompliant with the requirement. Specifically, we noted that in 2017, 14 HUD programs were not risk assessed.4 Additionally, HUD mistakenly reported in its fiscal year 2017 AFR5 that these 14 programs were risk assessed, which was misleading. We attributed HUD’s noncompliance with the risk assessment requirement and mistaken reporting due to an oversight. Our analysis showed that of 55 programs that needed a risk assessment, only 41 assessments had been completed. HUD did not realize that it had failed to perform risk assessments for the remaining 14 programs. As a result of HUD’s failure to risk assess all of its programs, opportunities to identify HUD programs vulnerable to significant improper payments would likely be missed, which could lead to the unnecessary waste of government resources. 4 The following 14 programs were not risk assessed in fiscal year 2017: Disaster – Federal Emergency Management Agency, Disaster Housing Assistance Program; U.S. Department of Transportation Surface Transportation Project; HOME Investment Partnerships program; Housing Trust Fund; Hurricane Ike, Other Disasters; Self Help and Assistance Homeownership; Master Subservicer Default Activity; American Recovery and Reinvestment Act - Energy and Green Retrofit Loan Financing; Emergency Home Loan Program (EHLP); EHLP - Direct Loan Financing Account; Homeownership and Rental Housing Solutions Grant Assistance, Section 236; Housing Counseling; Housing for Special Populations - Capital Advance portion of expenditures, Section 202; and the Housing for the Elderly and Handicapped. 5 HUD fiscal year 2017 AFR, page 177 6 HUD Did Not Report an Improper Payment Estimate for the Single Family Insurance Claims Program in its Fiscal Year 2017 Agency Financial Report In 2017, HUD did not comply with IPERA because it failed to report in its AFR the $837 million improper payment estimate for its single family insurance claims program. In HUD’s 2016 AFR,6 it identified FHA’s single family insurance claims program as susceptible to significant improper payment risks.7 Accordingly, in 2017, FHA estimated the annual amount of improper payments associated with this program. FHA reported this information to HUD in October 2017. However, HUD mistakenly omitted this information when it finalized its fiscal year 2017 AFR. This condition occurred because HUD did not have effective control in managing its AFR processing risks. In our fiscal year 2016 IPERA audit report,8 we also identified an instance of HUD’s failure in IPERA reporting. Although the example of HUD’s IPERA reporting failure in 2016 was different from that in 2017, the underlying cause of the IPERA failure (that is, weak IPERA reporting control) was the same. HUD Did Not Report a Statistically Valid Rental Housing Assistance Program Improper Payment Estimate With respect to RHAP, HUD did not comply with IPERA because the amount of the RHAP improper payment estimate reported in its AFR for fiscal year 2017 was not based on a statistically valid estimate as required by OMB Circular A-123, appendix C. HUD disclosed this information in its fiscal year 2017 AFR, which states that “the disclosed amounts for RHAP do not provide a statistically valid estimate of improper payments.”9 In accordance OMB Circular A-123, appendix C, part I(A)(9), agencies are required to obtain a statistically valid annual amount of improper payment estimates for all programs and activities that are identified as susceptible to significant improper payments. Before fiscal year 2017, the RHAP annual improper payment estimates were based on the quality control, income match, and billing studies performed by a HUD contractor. These studies were designed to provide HUD with a nationally representative statistical estimate of improper payments. These data were then used to populate the AFR to comply with IPERA requirements. However, in 6 In HUD’s fiscal year 2016 AFR, HUD also identified two other HUD programs (CDBG entitlement grants and the HOME Investment Partnerships program) as susceptible to significant improper payments (that is, high risk) in addition to FHA’s single family insurance claims program. In accordance with OMB guidance, HUD should have developed improper payment estimates for these programs. Our 2017 audit found that no improper payment estimates had been developed on these two programs. Instead, HUD downgraded its assessment on the CDBG entitlement grant program in 2017 from high risk to medium risk based on HUD’s revised risk assessment procedures. HUD’s analysis to support the medium-risk rating was not adequately documented, and we did not agree with HUD’s overall risk assessment on the program. HUD’s risk assessment on the HOME program, based on HUD’s revised risk assessment, was not complete at the end of fiscal year 2017. Therefore, we considered this program to be high risk in 2017. 7 HUD fiscal year 2016 AFR, page 234 8 Office of Inspector General (OIG) audit report 2017-FO-0006, page 9 9 HUD fiscal year 2017 AFR, page 178 7 connection with HUD’s coordinated effort to revamp its IPERA compliance program in response to our prior-year audit recommendations, HUD did not have these studies conducted in fiscal year 2017. HUD’s decision to discontinue conducting these various RHAP studies contributed to its lack of statistically valid RHAP improper payment estimates. HUD planned to be compliant starting in fiscal year 2018. To achieve an IPERA-compliant improper payment estimation methodology, according to HUD, it needed to gain an indepth understanding of various processes related to the RHAP subsidy. Therefore, as an alternative to quality control, income match, and billing studies, HUD’s strategy in fiscal year 2017 was to conduct a nonstatistical review10 of RHAP with the end goal of providing HUD a roadmap to IPERA compliance in fiscal year 2018. While HUD made good faith effort to make the alternative plan to work in 2017, we found that HUD was not able to fully implement the alternative plan as agreed to with OMB. Conclusion Fiscal year 2017 marked the fifth consecutive year in which we determined that HUD did not comply with IPERA. Therefore, HUD’s programs continued to be vulnerable to the adverse effects of improper payments. As a result, HUD’s limited program funds could not be maximized to benefit all of its intended recipients. Recommendations Because this is an update of a prior-year finding, we are not making additional audit recommendations this year. See the Followup on Prior Audits section of this report for the status of open audit recommendations made in prior years. 10 In 2017, OMB acknowledged HUD’s request to use an alternative plan, which included the use of non-statistical sampling. 8 Finding 2: HUD Had Unresolved Prior-Year IPERA Audit Findings In fiscal year 2017, we noted a few prior-year IPERA audit issues, which remained unresolved. They included issues related to (1) the accuracy and completeness of HUD’s disclosure related to payment recovery audit plans and supplemental measures in accordance with OMB requirements and (2) the nonreporting of HUD’s high-dollar overpayments. According to HUD, this condition occurred because it had other competing priorities, which prevented it from addressing these recurring issues in 2017. HUD stated that it was committed to resolving these issues in the future when a program reset is implemented. Until these prior-year findings are fully remediated, HUD will likely continue to miss opportunities to reduce improper payments in its programs. Current-Year Status of Prior-Year Audit Matters Our review of prior-year IPERA audit findings found that HUD had resolved 3 prior-year audit findings and recommendations. Specifically, we noted in 2017 that (1) the Office of the Chief Financial Officer (OCFO) ensured that payments to Federal employees were risk assessed and appropriately included in HUD’s 3-year periodic risk assessment cycle, (2) OCFO established policies and procedures that required program offices to maintain adequate documentation on their risk assessment process, and (3) FHA revised its risk assessment process so that all FHA programs are now risk assessed in accordance with OMB requirements.11 While OCFO and FHA made progress in addressing some prior-year audit recommendations and findings in 2017, a number of repeat prior-year IPERA audit findings remained unresolved at the end of fiscal year 2017. Specific details of these issues are provided below. Issues Related to Payment Recovery Audit Plans Continued For the past 2 fiscal years, we have had an ongoing concern regarding HUD’s payment recovery audit program. In fiscal year 2015, we reported that HUD lacked support to show that all of its programs and activities that spent $1 million or more during the fiscal year were considered for payment recapture audits or excluded based on cost-benefit considerations.12 Further, our fiscal year 2016 review confirmed recurrence of the same issue identified in 2015 and additionally found that the cost justifications disclosed were not reasonable or valid. In 2017, we reviewed HUD’s fiscal year 2017 AFR disclosure regarding recovery audit plans and found no progress in addressing previously identified issues and possible regression in some areas. For example, in determining what programs would be subject to recovery audits, an agency is required to compare program disbursements to a $1 million threshold. However, HUD officials stated that the agency had not performed this threshold analysis to determine whether a payment recapture audit was warranted for its programs. Additionally, we found that of 26 programs with recovery plans in HUD’s fiscal year 2016 AFR, 14 were excluded in HUD’s 11 Recommendations 2017-FO-0006-001-A, 2016-FO-0005-001-B, and 2016-FO-0005-001-E, respectively 12 OIG audit reports 2017-FO-0006, page 10, and 2016-FO-0005, page 12 9 fiscal year 2017 AFR. The cost-benefit analysis was not provided to support exclusion of these 14 programs in HUD’s 2017 AFR. This condition occurred because HUD had competing priorities in 2017, such as establishing risk assessment policies and procedures and performing other preliminary improper payment test work. These competing priorities shifted HUD’s focus in taking appropriate corrective action in 2017. Until all prior-year payment recovery audit remediation plans are fully implement, it is likely that HUD will continue to miss opportunities to recover funds from programs with improper payments. Detailed Information Regarding HUD’s Supplemental Measures Were Not Reported on a Centralized Government Website In 2017, HUD did not upload detailed information regarding its supplemental measures to the PaymentAccruacy.gov website as required by OMB. In 2017, OMB made significant changes to the IPERA disclosure requirement under OMB Circular A-136. In previous years, OMB required agencies to include relevant detailed information about their improper payments, including specific disclosures related to the agency’s supplemental measures. In 2017, OMB instructed the agencies to include all of the information previously reported in the AFR that was not included on the fiscal year 2017 in the PaymentAccuracy.gov website. However, a review of https://paymentaccuracy.gov/ found that HUD’s supplemental measure data for RHAP had not been updated since September 30, 2016.13 HUD Did Not Identify or Report High-Dollar Overpayments Fiscal year 2017 marked the third consecutive fiscal years in which we reported that HUD lacked a system to capture high-dollar overpayments for its high-priority program, RHAP. HUD officials stated that high-dollar overpayment reporting was not performed due to competing priorities stemming from other program reset activities. As a result, no high-dollar overpayments were captured or reported by HUD at the end of fiscal year 2017 as required. Conclusion As previously stated, HUD is undergoing a program reset to comply with OMB requirements. While this process is underway, HUD will continue to miss opportunities to reduce and recover improper payments in its programs. We recognize the difficulty in addressing many of these prior-year IPERA issues in 2017 in light of other competing priorities. We look forward to working with HUD in evaluating its effort to bring the agency into full compliance with IPERA in fiscal year 2018. Recommendations Because this is followup of prior-year findings, we are not making additional audit recommendations this year. See the Followup on Prior Audits section of this report for the status of open audit recommendations made in prior years. 13 The Payment Accuracy.gov website is a repository of improper payments reported by the agencies about their respective programs. The link to this website is located at https://paymentaccuracy.gov/program/rental-housing- assistance-programs/ 10 Scope and Methodology We conducted our audit of HUD’s compliance with IPERA for fiscal year 2017 from December 2017 through April 2018 at HUD headquarters in Washington, DC, and followed OMB Circular A-123 guidance on the Office of Inspector General’s (OIG) responsibility. OMB Circular A- 123, appendix C, II, section A-3, states the following: To determine compliance with IPERA, the agency inspector general should review the agency’s AFR or PAR (and any accompanying information) for the most recent fiscal year. Compliance with IPERA means that the agency has a. Published an AFR or PAR for the most recent fiscal year and posted that report and any accompanying materials required by OMB on the agency website. b. Conducted a program-specific risk assessment for each program or activity that conforms with Section 3321 note in 31 U.S.C. (United States Code) (if required). c. Published improper payment estimates for all programs and activities identified as susceptible to significant improper payments under its risk assessment (if required). d. Published programmatic corrective action plans in the AFR or PAR (if required). e. Published and is meeting annual reduction targets for each program assessed to be at risk and estimated for improper payments (if required and applicable). f. Reported a gross improper payment rate of less than 10 percent for each program and activity for which an improper payment estimate was obtained and published in the AFR or PAR. If an agency does not meet one or more of these requirements, it is not compliant under IPERA. In addition, as part of its review of these improper payment elements, the agency inspector general may evaluate the accuracy and completeness of agency reporting and evaluate agency performance in reducing and recapturing improper payments. Finally, as part of the annual compliance review, for agencies that have high-priority programs, the agency inspector general must evaluate the agency’s assessment of the level of risk associated with the high-priority programs and the quality of the improper payment estimates and methodology; determine the extent of oversight warranted; and provide the agency head with recommendations, if any, for modifying the agency’s methodology, promoting continued program access and participation, or maintaining adequate internal controls. 11 To accomplish our audit, we reviewed (1) relevant supporting documentation; (2) OCFO’s and FHA’s fiscal year 2017 improper payment risk assessments; (3) improper payment methodologies; (4) HUD’s internal controls, policies, procedures, and practices; and (5) requirements contained in the applicable Federal laws, Executive orders, and OMB-issued implementation guidance. Further, our audit steps were developed to evaluate the following areas of IPERA compliance: risk assessments, estimation methodologies, the accuracy and completeness of HUD’s AFR reporting, recapturing of improper payments, and corrective action plans. We also met with the appropriate personnel from the respective program offices responsible for overseeing HUD’s improper payment program. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 12 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: HUD’s design and implementation of controls to prevent, detect, and recover improper payments. HUD’s reporting processes between program offices and OCFO. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following items are significant deficiencies: HUD’s improper payment risk assessment process failed to ensure that all programs were assessed on a 3-year cycle (finding 1). HUD continued to lack effective controls for managing its agency financial reporting processing risks and as a result, omitted the reporting of FHA’s improper payments in the single family claims program (finding 1). HUD continued to not have an effective process to ensure that all programs that spent $1 million or more during the fiscal year were either considered for payment recapture audits or excluded because it was determined that these audits would not be cost effective (finding 2). 13 HUD continued to lack a methodology for capturing and reporting the data for high-dollar overpayments (finding 2). 14 Followup on Prior Audits We reviewed the recommendations from our prior audits regarding HUD’s compliance with improper payment regulations, including audit reports 2014-FO-0004, 2015-FO-0005, 2016-FO- 0005, and 2017-FO-0006. As of April 2018, 8 of the 21 recommendations from audit report 2014-FO-0004; 2 of the 6 recommendations from audit report 2015-FO-0005; 9 of the 13 recommendations from audit report 2016-FO-0005; and all 5 recommendations from audit report 2017-FO-0006 remained open with final action target dates between August 31, 2016, and January 15, 2019. Of these 24 open audit recommendations, management decisions had not been reached on 2. Additionally, we reopened 2 recommendations (items 3 and 5), which were previously closed by HUD in the departmental audit resolution tracking system, because we disagreed that these recommendations had been implemented based on the results of our audit. The 24 open recommendations are listed below. Prior-year IPERA recommendations as of April 2018 Number Past final Total Recommendation without action Audit report recommendations still open management target date number decision 2014-FO-0004 21 8 2 4 2015-FO-0005 6 2 - 1 2016-FO-0005 13 9 - 4 2017-FO-0006 5 5 - - We recommended that the Chief Financial Officer 1. Report on Multifamily, Public Housing, and Section 8 program improper payment rates separately in the agency financial report (recommendation 2014-FO-0004-001-G: no agreed-upon management decision or final action target date). 2. Work with PIH [the Office of Public and Indian Housing] and Multifamily Housing to determine annual improper payments HUD made to deceased tenants and report this amount as an additional source of improper payments in the agency financial report (recommendation 2014-FO-0004-002-H: no agreed-upon management decision or final action target date). 3. Reassess the susceptibility of significant improper payments for the CPD [the Office of Community Planning and Development] entitlement, nonentitlement, HOME, and other formula grant programs based on the results of our audit report 2014-FO-0003, as well as the community service and self-sufficiency requirement in public housing subsidiaries identified in OIG audit report 2015-KC-0001 (recommendation 2015-FO-0005-003-C: final action target date: August 31, 2018. 15 4. For HUD’s high-priority programs, reevaluate the types of errors previously identified to determine whether new causes of errors exist that would lead to significant improper payments and require reporting in accordance with the improper payment categories outlined in OMB Circular A-123, appendix C, for fiscal years 2015 and beyond (recommendation 2015-FO-0005-004-A: final action target date: June 30, 2017).14 5. Revise its risk assessment process to ensure that all HUD programs, including Ginnie Mae [Government National Mortgage Association] programs, are (1) initially risk- assessed for improper payments or request a waiver from OMB, and if programs are determined to be low risk, reassess them on a 3-year cycle and (2) risk assessed against all of the required risk factors (recommendation 2016-FO-0005-001-A: final action target date: September 30, 2017). 6. Consider stratifying the population of RHAP tenant cases between income-based and non-income-based rents going forward in determining the population of cases for the QC [quality control] study and determine whether it is appropriate to include only the income-based tenants in the population (recommendation 2016-FO-0005-001-C: final action target date: April 1, 2018). 7. Develop, document, and implement formal policies and procedures to ensure that (1) all programs or activities that expend $1 million or more annually for each program office identified are included in either the program office’s payment recapture audit plan or provide a justification and analysis showing why a payment recapture audit would not be cost effective for that program or activity and (2) justifications and analyses showing why a payment recapture audit would not be costs effective are maintained and adequately described in the AFR, in accordance with OMB Circular A-123, appendix C (recommendation 2016-FO-0005-002-A: final action target date: January 15, 2019). 8. Revisit the existing recovery audit plan and update as needed to ensure that all programs and activities that expended more than $1 million annually were included in the recovery audit plan or excluded from the recovery audit plan and maintain the corresponding cost- benefit and analyses supporting their exclusion (recommendation 2016-FO-0005-002-B: final action target date: January 15, 2019). 9. Resubmit the justification for why a payment recapture audit would not be cost effective for each program that expended over $1 million or more to OMB and us for programs that were not already identified under a separate recovery audit plan (recommendation 2016-FO-0005-002-C: final action target date: January 15, 2019). 14 The original final action target date was December 31, 2015. As a result of our audit report 2017-FO-0006, the recommendation was reopened because we disagreed that this recommendation had been implemented based on the results of our audit. As a result, the final action target date was revised. 16 10. Develop and document a methodology for adjusting the billing error for factors that may change the billing error previously reported if a billing study is not performed annually (recommendation 2016-FO-0005-003-A: final action target date: January 15, 2018). 11. Amend the checklist to ensure that description of corrective actions in the AFR includes an explanation of how the corrective actions address the root causes reported in table 2 and all required timelines (recommendation 2016-FO-0005-004-A: final action target date: January 15, 2018). 12. Establish and implement procedures to ensure that the required information specified in the checklist is adequately and specifically addressed and is included in the published AFR (recommendation 2016-FO-0005-004-B: final action target date: January 15, 2018). 13. Establish and implement a process to identify high-dollar overpayments and report them quarterly to OMB and us or submit a written request to OMB for an alternative reporting structure (recommendation 2016-FO-0005-004-C: final action target date: September 30, 2018). 14. Establish and implement procedures and controls, in coordination with FHA, to ensure that FHA information reported in the AFR is accurate and consistent with supporting documents (recommendation 2017-FO-0006-001-B: final action target date: January 15, 2019). 15. Develop and implement steps to ensure that the description of corrective actions highlights current efforts and key milestones for ongoing efforts and explain in the AFR how it specifically tailored its corrective actions to better reflect the unique processes, procedures, and risks involved with RHAP as required by OMB (recommendation 2017- FO-0006-004-A: final action target date: January 15, 2019). 16. Develop and implement steps to ensure that adequate disclosures are made when future- year reduction targets for improper payments reported in the AFR are higher than the current-year improper payment estimates (recommendation 2017-FO-0006-004-B: final action target date: January 15, 2019). 17. Disclose in the AFR the results of HUD’s review concerning its current performance against program-specific improper payment reduction targets to promote transparency (recommendation 2017-FO-0006-004-C: final action target date: January 15, 2019). We recommended that the Assistant Secretary for Public and Indian Housing 18. Reassess existing supplemental measures and corrective actions and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (recommendation 2014-FO- 0004-002-A: final action target date: December 31, 2018). 17 We recommended that the Deputy Assistant Secretary for Multifamily Housing Programs 19. Coordinate with all the appropriate program officials when responding to OCFO’s information requests to ensure that all statements are accurate for the current fiscal year, to include but not be limited to updates to corrective action plans, internal controls in place, and information on any barriers the agency is experiencing (recommendation 2014-FO-0004-001-L: final action target date: August 31, 2016). 20. Develop and execute formal plans to hold accountable program officials and processing entities (owners or administrators) responsible for improper payments (recommendation 2014-FO-0004-001-M: final action target date: September 30, 2016). 21. Reassess existing supplemental measures and corrective actions and enhance or develop new supplemental measures and corrective actions to ensure that they target the root causes of errors identified in the improper payment studies (recommendation 2014-FO- 0004-002-D: final action target date: July 7, 2017). 22. Periodically reevaluate the supplemental measures and corrective actions so that new and innovative ways to reduce improper payments are identified and implemented (recommendation 2014-FO-0004-002-E: final action target date: August 31, 2016). 23. Work with the Real Estate Assessment Center to develop management-level reports in the Enterprise Income Verification system that will allow Multifamily Housing management to efficiently and effectively identify processing entities that are responsible for improper payments and develop policies and procedures to hold owners/administrators identified accountable (recommendation 2014-FO-0004-002-F: final action target date: April 30, 2017). We recommended that the Deputy Assistant Secretary for the Real Estate Assessment Center 24. Work with PIH and Multifamily Housing management to develop management-level reports in the Enterprise Income Verification system that will allow PIH and Multifamily Housing management to efficiently and effectively identify processing entities that are responsible for improper payments (recommendation 2014-FO-0004-002-G: final action target date: December 31, 2018). 18 Appendixes Appendix A Auditee Comments and OIG’s Evaluation Auditee Comments Ref to OIG Evaluation Comment 1 Comment 2 19 Ref to OIG Evaluation Comment 3 Comment 4 Comment 5 Comment 6 Comment 7 Comment 8 20 Ref to OIG Evaluation Comment 9 Comment 10 Comment 11 Comment 12 Comment 13 Comment 14 Comment 15 21 Ref to OIG Evaluation Comment 16 Comment 17 Comment 18 Comment 19 Comment 20 Comment 21 22 OIG Evaluation of Auditee Comments Comment 1: We do not agree with HUD that 14 of the 19 programs were not in scope or were assessed through another program in fiscal year 2017. As outlined in our comment responses 3 through 21 below, we further reviewed the 19 programs that were not risk assessed and determined that 14 programs required a risk assessment in fiscal year 2017. Comment 2: Although OMB granted HUD’s request to use a one-time non-statistical sampling, as an alternative methodology for its RHAP improper payment in fiscal year 2017, it is OIG’s understanding that OMB has not waived its requirement for obtaining a statistically valid estimate of the annual improper payments on HUD’s high risk programs. Additionally, HUD was not fully able to implement the OMB approved alternative methodology at the end of fiscal year 2017. For these reasons, we found HUD noncompliant with IPERA. Comment 3: Federal Emergency Management Agency, Disaster Housing Assistance Program- We do not agree with HUD that this program did not require risk assessment because the program was a disaster relief funds. In accordance with OMB Memorandum M-13-07, Accountability for Funds Provided by the Disaster Relief Appropriations Act, states that section 904(b) of the Disaster Relief Act provides that all programs and activities receiving funds under that Act shall be deemed susceptible to significant improper payments regardless of any previous improper payment risk assessment results. We believe that HUD may have misinterpreted the provision of the Disaster Relief Act to mean all programs receiving disaster relief funds including this program is covered by the Act. In fact, the Disaster Relief Act was only applicable to Hurricane Sandy. Given that this program, which began in 2007 in response to Hurricane Katrina through an interagency agreement with the Federal Emergency Management Agency, OIG determined that M-13-07 did not apply to this program. Accordingly, HUD is required to conduct step 1 risk assessment in accordance with OMB Circular A- 123, appendix C. Comment 4: U.S. Department of Transportation Surface Transportation Project - HUD provided a funds control plan of the Department of Transportation program to show that it was not a HUD program. However, a review of the plan shows that Section 1702 of Public Law 109-59 and 23 USC 132 provides the authority for the transfer of funds from the Department of Transportation to HUD to administer these program projects. Further, OMB Circular A-123, appendix C (M-15-02), states that that law anticipates that agencies will examine the risk of, and feasibility of recapturing, improper payments in all programs and activities administered [emphasis added]. The term "program" includes activities or sets of activities that entail program management. Since HUD administers this program, it is required to examine the risk of improper payments. This program required a risk assessment in fiscal year 2017. 23 Comment 5: HOME Investment Partnership Program – HUD did not complete its risk assessment for this program in fiscal 2017 as required. Therefore, OIG considered this program noncompliant with IPERA. Comment 6: Housing Trust Fund - We disagree with HUD that there was no requirement to conduct risk assessment on this program since it made no disbursements in fiscal year 2016. This program was last risk-assessed in fiscal year 2011. In accordance with OMB Circular A-123, appendix C, agencies are required to assess all of its programs and every three years thereafter for those low risk programs. The fact that there was no disbursement made in 2017 should not be the basis for not conducting a risk assessment in 2017. The disbursement is only one of the nine qualitative risk factors that should be taken into consideration when assessing the riskiness of the program. Therefore, HUD failed to assess this program in 2017 with respect to other risk factors. Comment 7: Hurricane Ike, Other Disasters – Like the Disaster Housing Assistance Program in comment 3, this program was created through an interagency agreement with the Federal Emergency Management Agency where HUD acts as the servicing agent. The funds for this program were not received through the Disaster Relief Appropriations Act of 2013 for Hurricane Sandy. Accordingly, this program required a risk assessment in FY 2017. Comment 8: Nehemiah Housing Opportunity Grants - After further review, we concur with HUD that this program did not require a risk assessment in fiscal year 2017 and our audit report was adjusted accordingly. Comment 9: Neighborhood Initiative - After further review, we concur with HUD that this program did not require a risk assessment in fiscal year 2017 and our audit report was adjusted accordingly. Comment 10: Project-Based Section 8 (Renewal of Expiring Section 8 Moderate Rehabilitation single Room Occupancy) - After further review, we concur with HUD that this program did not require a risk assessment in fiscal year 2017 and our audit report was adjusted accordingly. Comment 11: Rural Housing and Economic Development - After further review, we concur with HUD that this program did not require a risk assessment in fiscal year 2017 and our audit report was adjusted accordingly. Comment 12: Self Help and Assistance Homeownership - In the risk assessment rollup, this program is identified as the Self Help Homeownership Opportunity Program, and not the Capacity Building program. HUD’s justification as to why the CPD Capacity Building risk assessment should be assessed under the Self Help and 24 Assistance Homeownership program is unclear. This program required a risk assessment in FY 2017. Comment 13: Master Subservicer Default Activity - HUD did not complete its risk assessment for this program in fiscal year 2017 as required. Therefore, OIG considered this program noncompliant with IPERA. Comment 14: American Recovery and Reinvestment Act – Energy and Green Retrofit Loan Financing – We disagree with HUD that there was no requirement to conduct risk assessment on this program since it made no disbursements in fiscal year 2016. This program was last risk-assessed in fiscal year 2011. In accordance with OMB Circular A-123, appendix C, agencies are required to assess all of its programs and every three years thereafter for those low risk programs. Following the 3-year cycle, risk assessments are required again on this program in 2014 and 2017 based on the nine risk factors. The fact that there was no disbursement made in 2017 should not be the basis for not conducting a risk assessment in 2017. The disbursement is only one of the nine qualitative risk factors that should be taken into consideration when assessing the riskiness of the program. Therefore, HUD failed to assess this program in 2017 with respect to other risk factors. Comment 15: Emergency Home Loan Program (EHLP) - HUD did not complete its risk assessment for this program in fiscal year 2017 as required. Therefore, OIG considered this program noncompliant with IPERA. Comment 16: EHLP Director Loan Financing Account - HUD did not complete its risk assessment for this program in fiscal year 2017 as required. Therefore, OIG considered this program noncompliant with IPERA. Comment 17: Homeownership and Rental Housing Solutions Grant Assistance, Section 236 - Section 236 consists of rental housing assistance payments (RHAP) and interest reduction payments (IRP). HUD’s Section 236 rollup spreadsheet shows that RHAP was considered under the Rental Assistance Demonstration (RAD) program risk assessment; however, we never received the risk assessment for RAD. The second component, IRP, is listed as not risk assessed because it is an FHA program; it is our understanding that IRP is a multifamily program according to HUD’s website. Accordingly, we exercised due diligence by reviewing the risk assessment provided by FHA, and could not identify any references to Section 236 – IRP. This program required a risk assessment in FY 2017. Comments 18: Housing Counseling - HUD did not complete its risk assessment for this program in fiscal year 2017 as required. Therefore, OIG considered this program noncompliant with IPERA. 25 Comments 19: Housing for Special Populations, Section 202 – HUD’s assertion that this Section 202 program should be covered under the Section 811 risk assessment is not supported. HUD’s risk assessment roll up shows that two risk assessment templates were developed to separately cover Sections 202 and 811. At the conclusion of our field work, we had only received the Section 811 risk assessment from HUD. This program required a risk assessment in FY 2017. Comment 20: Housing for the Elderly and Handicapped - See comment 19. Comment 21: Transformation Initiative - After further review, we concur with HUD that this program did not require a risk assessment in FY 2017 and our audit report was adjusted accordingly. 26
HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010
Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-05-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)