U.S. Department of Housing and
Urban Development,
Washington, DC
Compliance With the Improper Payments Elimination
and Recovery Act
Office of Audit, Financial Audits Division Audit Report Number: 2018-FO-0006
Washington, DC May 15, 2018
To: Irving Dennis, Chief Financial Officer, F
//signed//
From: Thomas R. McEnanly, Director of Financial Audits Division, GAF
Subject: HUD Did Not Comply With the Improper Payments Elimination and Recovery
Act of 2010
Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our audit of HUD’s fiscal year 2017 compliance with the
Improper Payments Elimination and Recovery Act of 2010.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG website. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
202-402-8216.
Audit Report Number: 2018-FO-0006
Date: May 15, 2018
HUD Did Not Comply With the Improper Payments Elimination and
Recovery Act of 2010
Highlights
What We Audited and Why
We audited the U.S. Department of Housing and Urban Development’s (HUD) fiscal year 2017
compliance with the Improper Payments Elimination and Recovery Act of 2010 (IPERA).
IPERA was enacted to eliminate and recover improper payments by requiring agencies to
identify and report on programs that are susceptible to significant improper payments. IPERA
also requires each agency’s inspector general to perform an annual review of the agency’s
compliance with IPERA. Our audit objective was to determine whether HUD complied with
IPERA reporting and improper payment reduction requirements according to guidance from
Office of Management and Budget (OMB) Circular A-123.
What We Found
In fiscal year 2017, HUD did not comply with IPERA. HUD also did not comply with IPERA in
fiscal years 2013, 2014, 2015, and 2016. In 2017, HUD failed to comply with two compliance
determinations. Specifically, HUD failed to (1) conduct risk assessments according to OMB
requirements and (2) publish improper payment estimates. Our results are reflected in the table
below. We recognize HUD’s ongoing efforts to remediate the improper payment-related issues
noted in this and prior-year reports and look forward to working with HUD on these matters in
fiscal year 2018.
Fiscal year 2017 IPERA compliance reporting table
Published Published Reported an
Published Conducted risk Published
an and is improper
an agency assessments corrective
improper meeting payment rate
financial according to action
payment reduction of less than
report requirements plans
estimate targets 10 percent
Yes No No N/A N/A N/A
What We Recommend
We are not making additional audit recommendations. If implemented, we expect that all prior-
year audit recommendations, which have not been closed, will continue to help HUD remediate
repeat findings identified in this year’s report.
Table of Contents
Background and Objective......................................................................................3
Results of Audit ........................................................................................................5
Finding 1: HUD Did Not Comply With IPERA ............................................................ 5
Finding 2: HUD Had Unresolved Prior-Year IPERA Audit Findings ....................... 9
Scope and Methodology .........................................................................................11
Internal Controls ....................................................................................................13
Followup on Prior Audits ......................................................................................15
Appendixes ..............................................................................................................19
A. Auditee Comments and OIG’s Evaluation ............................................................. 19
2
Background and Objective
The Improper Payments Information Act of 2002 (IPIA) required the head of each agency to
annually review all programs and activities administered by the agency, identify all such programs
and activities that may be susceptible to significant improper payments, estimate the annual amount
of improper payments for each program or activity identified as susceptible, and report those
estimates. For programs with estimated improper payments exceeding $10 million, IPIA required
agencies to report the causes of the improper payments, actions taken to correct those causes, and
results of the actions taken. The Improper Payments Elimination and Recovery Act of 2010
(IPERA) decreased the frequency with which each agency was required to review all of its
programs but increased the responsibilities and reporting requirements. IPERA also required each
agency inspector general to determine whether the agency complied with IPIA as amended by
IPERA. IPIA was further amended by the Improper Payments Elimination and Recovery
Improvement Act of 2012 (IPERIA).
Under IPERIA, the inspector general is required to review the assessed level of risk associated with
high-priority programs, as determined by the Office of Management and Budget (OMB); the quality
of the improper payment estimates and methodology for high-priority programs; and the oversight
of financial controls to identify and prevent improper payments under high-priority programs. The
inspector general must then submit recommendations to Congress for modifying any agency plans
relating to improper payments determination and estimation methodology. OMB issued appendix C
to Circular No. A-123, Requirements for Effective Estimation and Remediation of Improper
Payments, on October 20, 2014, to provide guidance for agencies in implementing IPIA, IPERA,
and IPERIA requirements.
The U.S. Department of Housing and Urban Development’s (HUD) Secretary designated the Chief
Financial Officer as the lead official overseeing HUD’s actions to address improper payment issues
and complying with the requirements of IPERA. OMB Circular A-123, appendix C, requires
agencies to follow a four-step process. Step 1 is to review all programs and activities and identify
those that are susceptible to significant improper payments. Beginning with fiscal year 2014
reporting, “significant improper payments” are identified as gross annual improper payments1 in the
program exceeding (1) both 1.5 percent of program outlays and $10 million of all program or
activity payments made during the fiscal year reported or (2) $100 million (regardless of the
improper payment percentage of total program outlays). Step 2 is to obtain a statistically valid
estimate of the annual amount of improper payments in programs and activities for those programs
identified in step 1 as susceptible to significant improper payments. Step 3 is to implement a plan to
reduce improper payments, and step 4 is to report annually in the agency financial report (AFR) or
the performance and accountability report (PAR).
1
Gross annual improper payments are the total amount of overpayments and underpayments.
3
HUD reported improper payment rates in its AFR for two2 programs: its rental housing assistance
programs (RHAP) and its Disaster Relief Appropriations Act supplemental appropriation. RHAP
consists of three high-risk program areas – HUD’s public housing, Section 8 Housing Choice
Voucher, and Moderate Rehabilitation programs – and owner-administered project-based assistance
programs. HUD has reported an improper payment rate for RHAP since 2000. The Disaster Relief
Appropriations Act of 2013 designated the Community Development Block Grant Disaster
Recovery (CDBG-DR) program as susceptible to significant improper payments. On that basis,
HUD is required to report an improper payment rate. HUD uses an alternative estimation approach
approved by OMB to estimate improper payments for the CDBG-DR program.
Our audit objective was to determine whether HUD complied with IPERA reporting requirements
according to guidance from OMB Circular A-123.
2
The annual improper payment estimates for the third HUD program, the Federal Housing Administration’s
(FHA) single family mortgage insurance program, identified as being susceptible to significant improper
payment, was mistakenly omitted by HUD in its fiscal year 2017 AFR.
4
Results of Audit
Finding 1: HUD Did Not Comply With IPERA
Fiscal year 2017 marked the fifth consecutive year in which we determined that HUD did not
comply with IPERA. We reviewed HUD’s compliance with the six IPERA requirements. Of
the six IPERA requirements, HUD did not comply with two (b and c). Additionally, we found
that HUD complied with one, but could not make compliance determinations on the remaining
three (d, e and f). Areas of noncompliance were related to HUD’s failure to (1) conduct risk
assessments according to OMB requirements and (2) publish improper payment estimates for all
programs and activities identified as susceptible to significant improper payments. This
condition occurred because HUD’s remediation plans3 intended to address many of the IPERA
compliance issues noted in this report were not in place at the end of fiscal year 2017. Until all
of the prior-year IPERA issues have been remediated, HUD will likely continue to miss
opportunities to prevent, identify, reduce, and recover improper payments.
HUD Did Not Comply With IPERA
According to OMB Circular A-123, part II, section (A)(3), an agency must meet all six
requirements to comply with IPERA. Based upon our review of the six requirements, HUD did
not comply with IPERA because it failed to meet two (b and c) of the six requirements.
a. Published an agency financial report – HUD complied with this requirement. The agency
published an AFR for the most recent fiscal year and posted that report and
accompanying materials required by OMB on the agency website.
b. Conducted a compliant program-specific risk assessment process – HUD did not comply
with this requirement. Specifically, we identified 14 programs in 2017 that were either
not risk assessed initially or not risk assessed according to its three-year risk assessment
cycle.
c. Published improper payment estimates – HUD did not comply with this requirement.
HUD failed to publish improper payment estimates for all of its high-risk programs.
Specifically, HUD did not publish annual improper payment estimates for its Federal
Housing Administration’s (FHA) single family insurance claims program, a high-risk
program identified in HUD’s fiscal year 2016 AFR. According to FHA, its annual
improper payment estimates for this program was $837 million. Two other high-risk
programs (CDBG entitlement grants and the HOME Investment Partnerships program),
identified as susceptible to significant improper payments in HUD’s 2016 AFR, also did
not have improper payment estimates reported in 2017. Additionally, HUD did not
publish a valid estimate of improper payments for its RHAP in its fiscal year 2017 AFR
3
In 2017, HUD made plans to change its IPERA compliance program to address many years of noncompliance
with IPERA. At the end of fiscal year 2017, the plans were in the early planning stages.
5
due to its comprehensive effort in 2017 to restructure its improper payment compliance
program. With regard to HUD’s CDBG-DR program, no estimation and methodology
issue came to our attention during the audit.
d. Published corrective action plans – We could not determine HUD’s compliance or
noncompliance with this requirement. Although HUD published its corrective action
plan in its fiscal year 2017 AFR, we could not determine whether the plan as published
would achieve the intended goal of reducing improper payments because the root cause
assessment was ongoing at the end of 2017. HUD was in the process of restructing its
IPERA program in 2017, which would require it to reassess the root causes of the
improper payments.
e. Published and met reduction targets – We could not determine HUD’s compliance or
noncompliance with this requirement. Although HUD published its RHAP improper
payment estimate in fiscal year 2017, the estimation method used did not produce
statistically valid improper payment estimates. As a result, the improper payment
estimates that HUD reported in its fiscal year 2017 AFR could not be used to determine
whether HUD met its reduction targets in that same year.
f. Reported an estimate below 10 percent – Like requirement e above, a determination
could not be made to assess HUD’s compliance or noncompliance with this requirement
because HUD did not publish a valid improper payment estimate in its fiscal year 2017
AFR.
HUD’s Risk Assessments Were Not Performed in Accordance With OMB Guidance
For the past 2 years, we cited HUD for noncompliance with OMB’s risk assessment requirement.
In 2017, we again found HUD noncompliant with the requirement. Specifically, we noted that in
2017, 14 HUD programs were not risk assessed.4 Additionally, HUD mistakenly reported in its
fiscal year 2017 AFR5 that these 14 programs were risk assessed, which was misleading. We
attributed HUD’s noncompliance with the risk assessment requirement and mistaken reporting
due to an oversight. Our analysis showed that of 55 programs that needed a risk assessment,
only 41 assessments had been completed. HUD did not realize that it had failed to perform risk
assessments for the remaining 14 programs. As a result of HUD’s failure to risk assess all of its
programs, opportunities to identify HUD programs vulnerable to significant improper payments
would likely be missed, which could lead to the unnecessary waste of government resources.
4
The following 14 programs were not risk assessed in fiscal year 2017: Disaster – Federal Emergency Management
Agency, Disaster Housing Assistance Program; U.S. Department of Transportation Surface Transportation Project;
HOME Investment Partnerships program; Housing Trust Fund; Hurricane Ike, Other Disasters; Self Help and
Assistance Homeownership; Master Subservicer Default Activity; American Recovery and Reinvestment Act -
Energy and Green Retrofit Loan Financing; Emergency Home Loan Program (EHLP); EHLP - Direct Loan
Financing Account; Homeownership and Rental Housing Solutions Grant Assistance, Section 236; Housing
Counseling; Housing for Special Populations - Capital Advance portion of expenditures, Section 202; and the
Housing for the Elderly and Handicapped.
5
HUD fiscal year 2017 AFR, page 177
6
HUD Did Not Report an Improper Payment Estimate for the Single Family Insurance
Claims Program in its Fiscal Year 2017 Agency Financial Report
In 2017, HUD did not comply with IPERA because it failed to report in its AFR the $837 million
improper payment estimate for its single family insurance claims program. In HUD’s 2016
AFR,6 it identified FHA’s single family insurance claims program as susceptible to significant
improper payment risks.7 Accordingly, in 2017, FHA estimated the annual amount of improper
payments associated with this program. FHA reported this information to HUD in October 2017.
However, HUD mistakenly omitted this information when it finalized its fiscal year 2017 AFR.
This condition occurred because HUD did not have effective control in managing its AFR
processing risks. In our fiscal year 2016 IPERA audit report,8 we also identified an instance of
HUD’s failure in IPERA reporting. Although the example of HUD’s IPERA reporting failure in
2016 was different from that in 2017, the underlying cause of the IPERA failure (that is, weak
IPERA reporting control) was the same.
HUD Did Not Report a Statistically Valid Rental Housing Assistance Program Improper
Payment Estimate
With respect to RHAP, HUD did not comply with IPERA because the amount of the RHAP
improper payment estimate reported in its AFR for fiscal year 2017 was not based on a statistically
valid estimate as required by OMB Circular A-123, appendix C. HUD disclosed this information in
its fiscal year 2017 AFR, which states that “the disclosed amounts for RHAP do not provide a
statistically valid estimate of improper payments.”9 In accordance OMB Circular A-123, appendix
C, part I(A)(9), agencies are required to obtain a statistically valid annual amount of improper
payment estimates for all programs and activities that are identified as susceptible to significant
improper payments.
Before fiscal year 2017, the RHAP annual improper payment estimates were based on the quality
control, income match, and billing studies performed by a HUD contractor. These studies were
designed to provide HUD with a nationally representative statistical estimate of improper payments.
These data were then used to populate the AFR to comply with IPERA requirements. However, in
6
In HUD’s fiscal year 2016 AFR, HUD also identified two other HUD programs (CDBG entitlement grants and
the HOME Investment Partnerships program) as susceptible to significant improper payments (that is, high risk)
in addition to FHA’s single family insurance claims program. In accordance with OMB guidance, HUD should
have developed improper payment estimates for these programs. Our 2017 audit found that no improper
payment estimates had been developed on these two programs. Instead, HUD downgraded its assessment on the
CDBG entitlement grant program in 2017 from high risk to medium risk based on HUD’s revised risk
assessment procedures. HUD’s analysis to support the medium-risk rating was not adequately documented, and
we did not agree with HUD’s overall risk assessment on the program. HUD’s risk assessment on the HOME
program, based on HUD’s revised risk assessment, was not complete at the end of fiscal year 2017. Therefore,
we considered this program to be high risk in 2017.
7
HUD fiscal year 2016 AFR, page 234
8
Office of Inspector General (OIG) audit report 2017-FO-0006, page 9
9
HUD fiscal year 2017 AFR, page 178
7
connection with HUD’s coordinated effort to revamp its IPERA compliance program in response to
our prior-year audit recommendations, HUD did not have these studies conducted in fiscal year
2017. HUD’s decision to discontinue conducting these various RHAP studies contributed to its lack
of statistically valid RHAP improper payment estimates.
HUD planned to be compliant starting in fiscal year 2018. To achieve an IPERA-compliant
improper payment estimation methodology, according to HUD, it needed to gain an indepth
understanding of various processes related to the RHAP subsidy. Therefore, as an alternative to
quality control, income match, and billing studies, HUD’s strategy in fiscal year 2017 was to
conduct a nonstatistical review10 of RHAP with the end goal of providing HUD a roadmap to
IPERA compliance in fiscal year 2018. While HUD made good faith effort to make the alternative
plan to work in 2017, we found that HUD was not able to fully implement the alternative plan as
agreed to with OMB.
Conclusion
Fiscal year 2017 marked the fifth consecutive year in which we determined that HUD did not
comply with IPERA. Therefore, HUD’s programs continued to be vulnerable to the adverse
effects of improper payments. As a result, HUD’s limited program funds could not be
maximized to benefit all of its intended recipients.
Recommendations
Because this is an update of a prior-year finding, we are not making additional audit
recommendations this year. See the Followup on Prior Audits section of this report for the status
of open audit recommendations made in prior years.
10
In 2017, OMB acknowledged HUD’s request to use an alternative plan, which included the use of non-statistical
sampling.
8
Finding 2: HUD Had Unresolved Prior-Year IPERA Audit
Findings
In fiscal year 2017, we noted a few prior-year IPERA audit issues, which remained unresolved.
They included issues related to (1) the accuracy and completeness of HUD’s disclosure related to
payment recovery audit plans and supplemental measures in accordance with OMB requirements
and (2) the nonreporting of HUD’s high-dollar overpayments. According to HUD, this condition
occurred because it had other competing priorities, which prevented it from addressing these
recurring issues in 2017. HUD stated that it was committed to resolving these issues in the
future when a program reset is implemented. Until these prior-year findings are fully
remediated, HUD will likely continue to miss opportunities to reduce improper payments in its
programs.
Current-Year Status of Prior-Year Audit Matters
Our review of prior-year IPERA audit findings found that HUD had resolved 3 prior-year audit
findings and recommendations. Specifically, we noted in 2017 that (1) the Office of the Chief
Financial Officer (OCFO) ensured that payments to Federal employees were risk assessed and
appropriately included in HUD’s 3-year periodic risk assessment cycle, (2) OCFO established
policies and procedures that required program offices to maintain adequate documentation on
their risk assessment process, and (3) FHA revised its risk assessment process so that all FHA
programs are now risk assessed in accordance with OMB requirements.11 While OCFO and
FHA made progress in addressing some prior-year audit recommendations and findings in 2017,
a number of repeat prior-year IPERA audit findings remained unresolved at the end of fiscal year
2017. Specific details of these issues are provided below.
Issues Related to Payment Recovery Audit Plans Continued
For the past 2 fiscal years, we have had an ongoing concern regarding HUD’s payment recovery
audit program. In fiscal year 2015, we reported that HUD lacked support to show that all of its
programs and activities that spent $1 million or more during the fiscal year were considered for
payment recapture audits or excluded based on cost-benefit considerations.12 Further, our fiscal
year 2016 review confirmed recurrence of the same issue identified in 2015 and additionally
found that the cost justifications disclosed were not reasonable or valid.
In 2017, we reviewed HUD’s fiscal year 2017 AFR disclosure regarding recovery audit plans
and found no progress in addressing previously identified issues and possible regression in some
areas. For example, in determining what programs would be subject to recovery audits, an
agency is required to compare program disbursements to a $1 million threshold. However, HUD
officials stated that the agency had not performed this threshold analysis to determine whether a
payment recapture audit was warranted for its programs. Additionally, we found that of 26
programs with recovery plans in HUD’s fiscal year 2016 AFR, 14 were excluded in HUD’s
11
Recommendations 2017-FO-0006-001-A, 2016-FO-0005-001-B, and 2016-FO-0005-001-E, respectively
12
OIG audit reports 2017-FO-0006, page 10, and 2016-FO-0005, page 12
9
fiscal year 2017 AFR. The cost-benefit analysis was not provided to support exclusion of these
14 programs in HUD’s 2017 AFR. This condition occurred because HUD had competing
priorities in 2017, such as establishing risk assessment policies and procedures and performing
other preliminary improper payment test work. These competing priorities shifted HUD’s focus
in taking appropriate corrective action in 2017. Until all prior-year payment recovery audit
remediation plans are fully implement, it is likely that HUD will continue to miss opportunities
to recover funds from programs with improper payments.
Detailed Information Regarding HUD’s Supplemental Measures Were Not Reported on a
Centralized Government Website
In 2017, HUD did not upload detailed information regarding its supplemental measures to the
PaymentAccruacy.gov website as required by OMB. In 2017, OMB made significant changes to
the IPERA disclosure requirement under OMB Circular A-136. In previous years, OMB
required agencies to include relevant detailed information about their improper payments,
including specific disclosures related to the agency’s supplemental measures. In 2017, OMB
instructed the agencies to include all of the information previously reported in the AFR that was
not included on the fiscal year 2017 in the PaymentAccuracy.gov website. However, a review of
https://paymentaccuracy.gov/ found that HUD’s supplemental measure data for RHAP had not
been updated since September 30, 2016.13
HUD Did Not Identify or Report High-Dollar Overpayments
Fiscal year 2017 marked the third consecutive fiscal years in which we reported that HUD lacked
a system to capture high-dollar overpayments for its high-priority program, RHAP. HUD
officials stated that high-dollar overpayment reporting was not performed due to competing
priorities stemming from other program reset activities. As a result, no high-dollar
overpayments were captured or reported by HUD at the end of fiscal year 2017 as required.
Conclusion
As previously stated, HUD is undergoing a program reset to comply with OMB requirements.
While this process is underway, HUD will continue to miss opportunities to reduce and recover
improper payments in its programs. We recognize the difficulty in addressing many of these
prior-year IPERA issues in 2017 in light of other competing priorities. We look forward to
working with HUD in evaluating its effort to bring the agency into full compliance with IPERA
in fiscal year 2018.
Recommendations
Because this is followup of prior-year findings, we are not making additional audit
recommendations this year. See the Followup on Prior Audits section of this report for the status
of open audit recommendations made in prior years.
13
The Payment Accuracy.gov website is a repository of improper payments reported by the agencies about their
respective programs. The link to this website is located at https://paymentaccuracy.gov/program/rental-housing-
assistance-programs/
10
Scope and Methodology
We conducted our audit of HUD’s compliance with IPERA for fiscal year 2017 from December
2017 through April 2018 at HUD headquarters in Washington, DC, and followed OMB Circular
A-123 guidance on the Office of Inspector General’s (OIG) responsibility. OMB Circular A-
123, appendix C, II, section A-3, states the following:
To determine compliance with IPERA, the agency inspector general should review the agency’s
AFR or PAR (and any accompanying information) for the most recent fiscal year. Compliance
with IPERA means that the agency has
a. Published an AFR or PAR for the most recent fiscal year and posted that report
and any accompanying materials required by OMB on the agency website.
b. Conducted a program-specific risk assessment for each program or activity that
conforms with Section 3321 note in 31 U.S.C. (United States Code) (if required).
c. Published improper payment estimates for all programs and activities identified as
susceptible to significant improper payments under its risk assessment (if
required).
d. Published programmatic corrective action plans in the AFR or PAR (if required).
e. Published and is meeting annual reduction targets for each program assessed to be
at risk and estimated for improper payments (if required and applicable).
f. Reported a gross improper payment rate of less than 10 percent for each program
and activity for which an improper payment estimate was obtained and published
in the AFR or PAR.
If an agency does not meet one or more of these requirements, it is not compliant under IPERA.
In addition, as part of its review of these improper payment elements, the agency inspector
general may evaluate the accuracy and completeness of agency reporting and evaluate agency
performance in reducing and recapturing improper payments.
Finally, as part of the annual compliance review, for agencies that have high-priority programs,
the agency inspector general must evaluate the agency’s assessment of the level of risk
associated with the high-priority programs and the quality of the improper payment estimates
and methodology; determine the extent of oversight warranted; and provide the agency head with
recommendations, if any, for modifying the agency’s methodology, promoting continued
program access and participation, or maintaining adequate internal controls.
11
To accomplish our audit, we reviewed (1) relevant supporting documentation; (2) OCFO’s and
FHA’s fiscal year 2017 improper payment risk assessments; (3) improper payment
methodologies; (4) HUD’s internal controls, policies, procedures, and practices; and (5)
requirements contained in the applicable Federal laws, Executive orders, and OMB-issued
implementation guidance. Further, our audit steps were developed to evaluate the following
areas of IPERA compliance:
risk assessments,
estimation methodologies,
the accuracy and completeness of HUD’s AFR reporting,
recapturing of improper payments, and
corrective action plans.
We also met with the appropriate personnel from the respective program offices responsible for
overseeing HUD’s improper payment program.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.
12
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to
effectiveness and efficiency of operations,
reliability of financial reporting, and
compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:
HUD’s design and implementation of controls to prevent, detect, and recover improper
payments.
HUD’s reporting processes between program offices and OCFO.
We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiencies
Based on our review, we believe that the following items are significant deficiencies:
HUD’s improper payment risk assessment process failed to ensure that all programs were
assessed on a 3-year cycle (finding 1).
HUD continued to lack effective controls for managing its agency financial reporting
processing risks and as a result, omitted the reporting of FHA’s improper payments in the
single family claims program (finding 1).
HUD continued to not have an effective process to ensure that all programs that spent $1
million or more during the fiscal year were either considered for payment recapture audits or
excluded because it was determined that these audits would not be cost effective (finding 2).
13
HUD continued to lack a methodology for capturing and reporting the data for high-dollar
overpayments (finding 2).
14
Followup on Prior Audits
We reviewed the recommendations from our prior audits regarding HUD’s compliance with
improper payment regulations, including audit reports 2014-FO-0004, 2015-FO-0005, 2016-FO-
0005, and 2017-FO-0006. As of April 2018, 8 of the 21 recommendations from audit report
2014-FO-0004; 2 of the 6 recommendations from audit report 2015-FO-0005; 9 of the 13
recommendations from audit report 2016-FO-0005; and all 5 recommendations from audit report
2017-FO-0006 remained open with final action target dates between August 31, 2016, and
January 15, 2019. Of these 24 open audit recommendations, management decisions had not been
reached on 2. Additionally, we reopened 2 recommendations (items 3 and 5), which were
previously closed by HUD in the departmental audit resolution tracking system, because we
disagreed that these recommendations had been implemented based on the results of our audit.
The 24 open recommendations are listed below.
Prior-year IPERA recommendations as of April 2018
Number
Past final
Total Recommendation without
action
Audit report recommendations still open management
target date
number decision
2014-FO-0004 21 8 2 4
2015-FO-0005 6 2 - 1
2016-FO-0005 13 9 - 4
2017-FO-0006 5 5 - -
We recommended that the Chief Financial Officer
1. Report on Multifamily, Public Housing, and Section 8 program improper payment rates
separately in the agency financial report (recommendation 2014-FO-0004-001-G: no
agreed-upon management decision or final action target date).
2. Work with PIH [the Office of Public and Indian Housing] and Multifamily Housing to
determine annual improper payments HUD made to deceased tenants and report this
amount as an additional source of improper payments in the agency financial report
(recommendation 2014-FO-0004-002-H: no agreed-upon management decision or final
action target date).
3. Reassess the susceptibility of significant improper payments for the CPD [the Office of
Community Planning and Development] entitlement, nonentitlement, HOME, and other
formula grant programs based on the results of our audit report 2014-FO-0003, as well as
the community service and self-sufficiency requirement in public housing subsidiaries
identified in OIG audit report 2015-KC-0001 (recommendation 2015-FO-0005-003-C:
final action target date: August 31, 2018.
15
4. For HUD’s high-priority programs, reevaluate the types of errors previously identified to
determine whether new causes of errors exist that would lead to significant improper
payments and require reporting in accordance with the improper payment categories
outlined in OMB Circular A-123, appendix C, for fiscal years 2015 and beyond
(recommendation 2015-FO-0005-004-A: final action target date: June 30, 2017).14
5. Revise its risk assessment process to ensure that all HUD programs, including Ginnie
Mae [Government National Mortgage Association] programs, are (1) initially risk-
assessed for improper payments or request a waiver from OMB, and if programs are
determined to be low risk, reassess them on a 3-year cycle and (2) risk assessed against
all of the required risk factors (recommendation 2016-FO-0005-001-A: final action
target date: September 30, 2017).
6. Consider stratifying the population of RHAP tenant cases between income-based and
non-income-based rents going forward in determining the population of cases for the QC
[quality control] study and determine whether it is appropriate to include only the
income-based tenants in the population (recommendation 2016-FO-0005-001-C: final
action target date: April 1, 2018).
7. Develop, document, and implement formal policies and procedures to ensure that (1) all
programs or activities that expend $1 million or more annually for each program office
identified are included in either the program office’s payment recapture audit plan or
provide a justification and analysis showing why a payment recapture audit would not be
cost effective for that program or activity and (2) justifications and analyses showing why
a payment recapture audit would not be costs effective are maintained and adequately
described in the AFR, in accordance with OMB Circular A-123, appendix C
(recommendation 2016-FO-0005-002-A: final action target date: January 15, 2019).
8. Revisit the existing recovery audit plan and update as needed to ensure that all programs
and activities that expended more than $1 million annually were included in the recovery
audit plan or excluded from the recovery audit plan and maintain the corresponding cost-
benefit and analyses supporting their exclusion (recommendation 2016-FO-0005-002-B:
final action target date: January 15, 2019).
9. Resubmit the justification for why a payment recapture audit would not be cost effective
for each program that expended over $1 million or more to OMB and us for programs
that were not already identified under a separate recovery audit plan (recommendation
2016-FO-0005-002-C: final action target date: January 15, 2019).
14
The original final action target date was December 31, 2015. As a result of our audit report 2017-FO-0006, the
recommendation was reopened because we disagreed that this recommendation had been implemented based on
the results of our audit. As a result, the final action target date was revised.
16
10. Develop and document a methodology for adjusting the billing error for factors that may
change the billing error previously reported if a billing study is not performed annually
(recommendation 2016-FO-0005-003-A: final action target date: January 15, 2018).
11. Amend the checklist to ensure that description of corrective actions in the AFR includes
an explanation of how the corrective actions address the root causes reported in table 2
and all required timelines (recommendation 2016-FO-0005-004-A: final action target
date: January 15, 2018).
12. Establish and implement procedures to ensure that the required information specified in
the checklist is adequately and specifically addressed and is included in the published
AFR (recommendation 2016-FO-0005-004-B: final action target date: January 15,
2018).
13. Establish and implement a process to identify high-dollar overpayments and report them
quarterly to OMB and us or submit a written request to OMB for an alternative reporting
structure (recommendation 2016-FO-0005-004-C: final action target date: September
30, 2018).
14. Establish and implement procedures and controls, in coordination with FHA, to ensure
that FHA information reported in the AFR is accurate and consistent with supporting
documents (recommendation 2017-FO-0006-001-B: final action target date: January 15,
2019).
15. Develop and implement steps to ensure that the description of corrective actions
highlights current efforts and key milestones for ongoing efforts and explain in the AFR
how it specifically tailored its corrective actions to better reflect the unique processes,
procedures, and risks involved with RHAP as required by OMB (recommendation 2017-
FO-0006-004-A: final action target date: January 15, 2019).
16. Develop and implement steps to ensure that adequate disclosures are made when future-
year reduction targets for improper payments reported in the AFR are higher than the
current-year improper payment estimates (recommendation 2017-FO-0006-004-B: final
action target date: January 15, 2019).
17. Disclose in the AFR the results of HUD’s review concerning its current performance
against program-specific improper payment reduction targets to promote transparency
(recommendation 2017-FO-0006-004-C: final action target date: January 15, 2019).
We recommended that the Assistant Secretary for Public and Indian Housing
18. Reassess existing supplemental measures and corrective actions and enhance or develop
new supplemental measures and corrective actions to ensure that they target the root
causes of errors identified in the improper payment studies (recommendation 2014-FO-
0004-002-A: final action target date: December 31, 2018).
17
We recommended that the Deputy Assistant Secretary for Multifamily Housing Programs
19. Coordinate with all the appropriate program officials when responding to OCFO’s
information requests to ensure that all statements are accurate for the current fiscal year,
to include but not be limited to updates to corrective action plans, internal controls in
place, and information on any barriers the agency is experiencing (recommendation
2014-FO-0004-001-L: final action target date: August 31, 2016).
20. Develop and execute formal plans to hold accountable program officials and processing
entities (owners or administrators) responsible for improper payments (recommendation
2014-FO-0004-001-M: final action target date: September 30, 2016).
21. Reassess existing supplemental measures and corrective actions and enhance or develop
new supplemental measures and corrective actions to ensure that they target the root
causes of errors identified in the improper payment studies (recommendation 2014-FO-
0004-002-D: final action target date: July 7, 2017).
22. Periodically reevaluate the supplemental measures and corrective actions so that new and
innovative ways to reduce improper payments are identified and implemented
(recommendation 2014-FO-0004-002-E: final action target date: August 31, 2016).
23. Work with the Real Estate Assessment Center to develop management-level reports in
the Enterprise Income Verification system that will allow Multifamily Housing
management to efficiently and effectively identify processing entities that are responsible
for improper payments and develop policies and procedures to hold
owners/administrators identified accountable (recommendation 2014-FO-0004-002-F:
final action target date: April 30, 2017).
We recommended that the Deputy Assistant Secretary for the Real Estate Assessment Center
24. Work with PIH and Multifamily Housing management to develop management-level
reports in the Enterprise Income Verification system that will allow PIH and Multifamily
Housing management to efficiently and effectively identify processing entities that are
responsible for improper payments (recommendation 2014-FO-0004-002-G: final action
target date: December 31, 2018).
18
Appendixes
Appendix A
Auditee Comments and OIG’s Evaluation
Auditee Comments
Ref to OIG
Evaluation
Comment 1
Comment 2
19
Ref to OIG
Evaluation
Comment 3
Comment 4
Comment 5
Comment 6
Comment 7
Comment 8
20
Ref to OIG
Evaluation
Comment 9
Comment 10
Comment 11
Comment 12
Comment 13
Comment 14
Comment 15
21
Ref to OIG
Evaluation
Comment 16
Comment 17
Comment 18
Comment 19
Comment 20
Comment 21
22
OIG Evaluation of Auditee Comments
Comment 1: We do not agree with HUD that 14 of the 19 programs were not in scope or were
assessed through another program in fiscal year 2017. As outlined in our
comment responses 3 through 21 below, we further reviewed the 19 programs
that were not risk assessed and determined that 14 programs required a risk
assessment in fiscal year 2017.
Comment 2: Although OMB granted HUD’s request to use a one-time non-statistical
sampling, as an alternative methodology for its RHAP improper payment in
fiscal year 2017, it is OIG’s understanding that OMB has not waived its
requirement for obtaining a statistically valid estimate of the annual improper
payments on HUD’s high risk programs. Additionally, HUD was not fully able to
implement the OMB approved alternative methodology at the end of fiscal year
2017. For these reasons, we found HUD noncompliant with IPERA.
Comment 3: Federal Emergency Management Agency, Disaster Housing Assistance Program-
We do not agree with HUD that this program did not require risk assessment
because the program was a disaster relief funds. In accordance with OMB
Memorandum M-13-07, Accountability for Funds Provided by the Disaster
Relief Appropriations Act, states that section 904(b) of the Disaster Relief Act
provides that all programs and activities receiving funds under that Act shall be
deemed susceptible to significant improper payments regardless of any previous
improper payment risk assessment results. We believe that HUD may have
misinterpreted the provision of the Disaster Relief Act to mean all programs
receiving disaster relief funds including this program is covered by the Act. In
fact, the Disaster Relief Act was only applicable to Hurricane Sandy. Given that
this program, which began in 2007 in response to Hurricane Katrina through an
interagency agreement with the Federal Emergency Management Agency, OIG
determined that M-13-07 did not apply to this program. Accordingly, HUD is
required to conduct step 1 risk assessment in accordance with OMB Circular A-
123, appendix C.
Comment 4: U.S. Department of Transportation Surface Transportation Project - HUD
provided a funds control plan of the Department of Transportation program to
show that it was not a HUD program. However, a review of the plan shows that
Section 1702 of Public Law 109-59 and 23 USC 132 provides the authority for
the transfer of funds from the Department of Transportation to HUD to
administer these program projects. Further, OMB Circular A-123, appendix C
(M-15-02), states that that law anticipates that agencies will examine the risk of,
and feasibility of recapturing, improper payments in all programs and activities
administered [emphasis added]. The term "program" includes activities or sets
of activities that entail program management. Since HUD administers this
program, it is required to examine the risk of improper payments. This program
required a risk assessment in fiscal year 2017.
23
Comment 5: HOME Investment Partnership Program – HUD did not complete its risk
assessment for this program in fiscal 2017 as required. Therefore, OIG
considered this program noncompliant with IPERA.
Comment 6: Housing Trust Fund - We disagree with HUD that there was no requirement to
conduct risk assessment on this program since it made no disbursements in fiscal
year 2016. This program was last risk-assessed in fiscal year 2011. In
accordance with OMB Circular A-123, appendix C, agencies are required to
assess all of its programs and every three years thereafter for those low risk
programs. The fact that there was no disbursement made in 2017 should not be
the basis for not conducting a risk assessment in 2017. The disbursement is only
one of the nine qualitative risk factors that should be taken into consideration
when assessing the riskiness of the program. Therefore, HUD failed to assess this
program in 2017 with respect to other risk factors.
Comment 7: Hurricane Ike, Other Disasters – Like the Disaster Housing Assistance Program
in comment 3, this program was created through an interagency agreement with
the Federal Emergency Management Agency where HUD acts as the servicing
agent. The funds for this program were not received through the Disaster Relief
Appropriations Act of 2013 for Hurricane Sandy. Accordingly, this program
required a risk assessment in FY 2017.
Comment 8: Nehemiah Housing Opportunity Grants - After further review, we concur with
HUD that this program did not require a risk assessment in fiscal year 2017 and
our audit report was adjusted accordingly.
Comment 9: Neighborhood Initiative - After further review, we concur with HUD that this
program did not require a risk assessment in fiscal year 2017 and our audit report
was adjusted accordingly.
Comment 10: Project-Based Section 8 (Renewal of Expiring Section 8 Moderate Rehabilitation
single Room Occupancy) - After further review, we concur with HUD that this
program did not require a risk assessment in fiscal year 2017 and our audit report
was adjusted accordingly.
Comment 11: Rural Housing and Economic Development - After further review, we concur
with HUD that this program did not require a risk assessment in fiscal year 2017
and our audit report was adjusted accordingly.
Comment 12: Self Help and Assistance Homeownership - In the risk assessment rollup, this
program is identified as the Self Help Homeownership Opportunity Program,
and not the Capacity Building program. HUD’s justification as to why the CPD
Capacity Building risk assessment should be assessed under the Self Help and
24
Assistance Homeownership program is unclear. This program required a risk
assessment in FY 2017.
Comment 13: Master Subservicer Default Activity - HUD did not complete its risk assessment
for this program in fiscal year 2017 as required. Therefore, OIG considered this
program noncompliant with IPERA.
Comment 14: American Recovery and Reinvestment Act – Energy and Green Retrofit Loan
Financing – We disagree with HUD that there was no requirement to conduct
risk assessment on this program since it made no disbursements in fiscal year
2016. This program was last risk-assessed in fiscal year 2011. In accordance
with OMB Circular A-123, appendix C, agencies are required to assess all of its
programs and every three years thereafter for those low risk programs.
Following the 3-year cycle, risk assessments are required again on this program
in 2014 and 2017 based on the nine risk factors. The fact that there was no
disbursement made in 2017 should not be the basis for not conducting a risk
assessment in 2017. The disbursement is only one of the nine qualitative risk
factors that should be taken into consideration when assessing the riskiness of the
program. Therefore, HUD failed to assess this program in 2017 with respect to
other risk factors.
Comment 15: Emergency Home Loan Program (EHLP) - HUD did not complete its risk
assessment for this program in fiscal year 2017 as required. Therefore, OIG
considered this program noncompliant with IPERA.
Comment 16: EHLP Director Loan Financing Account - HUD did not complete its risk
assessment for this program in fiscal year 2017 as required. Therefore, OIG
considered this program noncompliant with IPERA.
Comment 17: Homeownership and Rental Housing Solutions Grant Assistance, Section 236 -
Section 236 consists of rental housing assistance payments (RHAP) and interest
reduction payments (IRP). HUD’s Section 236 rollup spreadsheet shows that
RHAP was considered under the Rental Assistance Demonstration (RAD)
program risk assessment; however, we never received the risk assessment for
RAD. The second component, IRP, is listed as not risk assessed because it is an
FHA program; it is our understanding that IRP is a multifamily program
according to HUD’s website. Accordingly, we exercised due diligence by
reviewing the risk assessment provided by FHA, and could not identify any
references to Section 236 – IRP. This program required a risk assessment in FY
2017.
Comments 18: Housing Counseling - HUD did not complete its risk assessment for this program
in fiscal year 2017 as required. Therefore, OIG considered this program
noncompliant with IPERA.
25
Comments 19: Housing for Special Populations, Section 202 – HUD’s assertion that this Section
202 program should be covered under the Section 811 risk assessment is not
supported. HUD’s risk assessment roll up shows that two risk assessment
templates were developed to separately cover Sections 202 and 811. At the
conclusion of our field work, we had only received the Section 811 risk
assessment from HUD. This program required a risk assessment in FY 2017.
Comment 20: Housing for the Elderly and Handicapped - See comment 19.
Comment 21: Transformation Initiative - After further review, we concur with HUD that this
program did not require a risk assessment in FY 2017 and our audit report was
adjusted accordingly.
26
HUD Did Not Comply With the Improper Payments Elimination and Recovery Act of 2010
Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-05-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)