oversight

REAC Could Improve Its Inspections Processes and Controls

Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-08-31.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

    Office of Public and Indian Housing
      Real Estate Assessment Center,
              Washington, DC

             Physical Inspection Operations Division




Office of Audit, Region 6         Audit Report Number: 2018-FW-0003
Fort Worth, TX                                        August 31, 2018
To:            Donald J. LaVoy, Deputy Assistant Secretary for Office of Public Housing Real
               Estate Assessment Center, PX
               //signed//
From:          Kilah S. White, Regional Inspector General for Audit, 6AGA
Subject:       REAC Could Improve Its Inspections Processes and Controls




Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our review of the Real Estate Assessment Center’s (REAC)
physical inspections program.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG website. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
817-978-9309.
                    Audit Report Number: 2018-FW-0003
                    Date: August 31, 2018

                    REAC Could Improve Its Inspections Processes and Controls




Highlights

What We Audited and Why
We audited the U.S. Department of Housing and Urban Development’s (HUD) Real Estate
Assessment Center’s (REAC) inspections process. We initiated this audit in accordance with our
annual audit plan. Our objective was to determine whether REAC had adequate processes for
and controls over the certification and monitoring of contracted inspectors and its public housing
units’ physical inspections processes.

What We Found
REAC could improve its inspections processes and controls related to the certification and
monitoring of its contracted inspectors and its public housing units’ physical inspections
processes. Specifically, REAC did not always ensure that (1) contract inspectors met
requirements, (2) database system controls functioned properly, and (3) it verified the accuracy
of sampled units for public housing authorities. These conditions occurred because REAC either
did not follow its procedures or did not have procedures in place for parts of its inspections
process. As a result, REAC did not always have assurance that it (1) made the most effective
and efficient use of its resources when training and certifying inspectors, (2) protected its
database system data from unauthorized access and use, and (3) had accurate unit selections.

What We Recommend
We recommend that the Deputy Assistant Secretary for REAC (1) develop written policies and
procedures to ensure that inspectors meet program requirements, (2) support that inspector
candidates met minimum qualifications and were properly monitored, (3) ensure that it performs
annual assessments and continuous monitoring of its database, and (4) develop processes and
procedures to verify the accuracy of sampled units.
Table of Contents
Background and Objective......................................................................................3

Results of Audit ........................................................................................................4
         Finding: REAC’s Inspections Processes and Controls Had Weaknesses ................... 4

Scope and Methodology ...........................................................................................9

Internal Controls ....................................................................................................10

Appendixes ..............................................................................................................11
         A. Auditee Comments and OIG’s Evaluation ............................................................ 11

         B. Summary of Inspector File Review Findings ........................................................ .19
Background and Objective
The U.S. Department of Housing and Urban Development’s (HUD) Real Estate Assessment Center
(REAC) is a national management center located in Washington, DC, and structurally falls under
HUD’s Office of Public and Indian Housing. REAC’s main purpose is to centralize and standardize
the way HUD evaluates the condition of the properties in which it has a financial interest or
statutory obligation to monitor. In part, REAC’s mission is to provide accurate, credible, and
reliable information assessing the condition of HUD’s housing portfolio. HUD housing must meet
certain standards and undergo physical inspections to determine that the housing is decent, safe,
sanitary, and in good repair. Through its Physical Inspection Operations Division, REAC performs
the inspections of public housing units based on uniform physical condition standards (UPCS),
which address six major housing areas: site, building exterior, building systems, dwelling units,
common areas, and health and safety.
To be able to conduct physical inspections, all inspectors must be trained and certified through
REAC’s UPCS inspector certification training program, a comprehensive physical inspection
certification training program to prepare experienced inspectors to conduct the inspections for
public housing properties. The UPCS training has three phases: phase 1a – online training, phase
1b – onsite training, and phase 2 – field training. The phase 1a and 1b trainings are administered
by the Training Facilitation department. The Quality Assurance Division provides phase 2 training
and exams for the inspector candidates and also technical assistance through quality assurance
reviews to ensure that the physical inspections are conducted according to the UPCS protocol.
Additionally, REAC’s Inspector Administration Division reviews the performance and conduct of
inspectors and takes appropriate action to decertify inspectors as required.
A hand-held computer, referred to as the data collection device, is used by the contract inspectors
when inspecting the properties, and the inspection results are electronically transmitted to REAC.
REAC has established a standard set of rules and procedures, referred to as the physical inspection
protocol, to gather the physical data and define the process for properly completing the assessment.
The data system, which automates the physical assessment of HUD properties, is the Physical
Assessment Subsystem (PASS). PASS coordinates the procurement of the UPCS inspections,
ensures appropriate inspection scheduling, and arranges for correction and rescheduling of
inspections deemed incomplete or deficient. PASS also conducts quality control checks of each
uploaded inspection and provides property-specific online reporting of the inspection results.
Our objective was to determine whether REAC had adequate processes for and controls over the
certification and monitoring of contracted inspectors and its public housing units’ physical
inspections processes.




                                                  3
Results of Audit
Finding: REAC’s Inspections Processes and Controls Had
Weaknesses
REAC could improve its inspections processes and controls related to the certification and
monitoring of its contracted inspectors and its public housing units’ physical inspections
processes. Specifically, REAC did not always ensure that (1) contract inspectors met
requirements, (2) database system controls functioned properly, and (3) it verified the accuracy
of sampled units for public housing authorities. These conditions occurred because REAC either
did not follow its procedures or did not have procedures in place for parts of its inspections
process. As a result, it did not always have assurance that it (1) made the most effective and
efficient use of its resources when training and certifying inspectors, (2) protected its database
system data from unauthorized access and use, and (3) had accurate unit selections.
REAC Did Not Always Ensure That Contract Inspectors Met Requirements
REAC did not always ensure that contract inspectors met its qualification and certification
requirements. HUD regulations 1 stated that only those individuals who met specific knowledge
and experience requirements to be UPCS inspectors could participate in the UPCS training and
the inspectors were required to meet minimum qualifications and be trained and certified. To
apply for training, REAC required inspectors to view the qualifications document, which
documented the minimum qualifications, including (1) conducting at least 250 commercial or
residential inspections; (2) having sufficient computer skills; and (3) having technical or general
knowledge in residential or commercial building trades for five areas, including electrical;
heating, ventilation, and air conditioning; masonry; plumbing; and carpentry; and (4) completing
and submitting a questionnaire. 2 These documents also stated that the applicants would be
required to provide verifiable documentation and that the information could be randomly
selected for verification. Inspectors also had to pass exams before being fully certified and
conducting inspections. 3 In addition, inspector notices 4 required REAC to ensure that contracted
inspectors

    •    Had liability insurance 5 to ensure self-coverage in the event of any damage to a property
         as a result of the inspections conducted. The notice also required inspectors to purchase



1
     Public Housing Assessment System (PHAS): Physical Condition Scoring Notice and Revised Dictionary of
    Deficiency Definitions; Notice, August 9, 2012 and the Uniform Physical Condition Standards and Physical
    Inspection Requirements for Certain HUD Housing , Final Rule, September 1, 1998
2
    Inspector Candidate Assessment Questionnaire, form HUD-50002A
3
    Training Facilitation’s phase 1a and phase 1b protocol and Quality Assurance Division’s phase 2 protocol
4
    The Inspector Administration’s business rules issued to all HUD inspectors certified in the use of the UPCS
    inspection protocol via inspector notices.
5
    Inspector Notice No. 2009-01, UPCS Inspection Protocol General Liability Insurance Requirement, effective
    March 24, 2009, and Inspector Notice No. 2015-01, UPCS Inspector Protocol General Liability Insurance
    Requirement, effective November 1, 2015




                                                         4
          and maintain general all-risk liability insurance 6 and submit a copy of the certificate of
          liability insurance to HUD within 5 days 7 after successfully completing training. Without
          meeting these insurance requirements, contract inspectors could not conduct inspections.

     •    Successfully passed an in depth background investigation 8 before completing training.
Further, HUD regulations 9 required REAC to monitor inspectors with its own quality assurance
staff to ensure that the inspectors used the protocol as intended and provided valid inspection
reports.
However, a review of file documentation for 24 contract inspectors 10 determined that REAC had
not requested or obtained documentation supporting that any of them had the experience notated
on their questionnaires. In addition, REAC did not ensure that

     •    Nine inspectors met the minimum requirements to begin the training. Of the 9, (1) 1 did
          not have a completed questionnaire and qualification documents, (2) 1 did not have
          experience in 1 of the 5 required trade areas and had not completed the required
          minimum of 250 inspections, (3) 5 did not have experience in 2 of the 5 required trade
          areas, and (4) 2 did not have experience in 1 of the 5 required trade areas.

     •    Inspectors obtained the required insurance. Specifically, 14 inspectors did not obtain the
          general all-risk liability insurance within 5 days after successfully completing phase 2
          training or receiving full certification; 7 inspectors did not have general all-risk liability
          insurance when conducting inspections; and 4 inspectors did not meet the minimum
          insurance limits. 11

     •    It completed or received approval on background investigations 12 for 15 inspectors before
          they were certified and conducted inspections. Of the 15, (1) two had background
          investigations pending, (2) five did not complete the background investigations but were
          later decertified, 13 and (3) eight did not have background investigations completed for 2
          months to approximately 1½ years 14 after being certified.


6
     To be able to conduct inspections, each inspector must purchase and maintain general all-risk liability insurance
     with limits not less than a combined single limit of $1 million per occurrence and $2 million total.
7
     Quality Assurance Division’s phase 2 protocol, effective dates May 6, 2013, and November 1, 2014; pilot phase
     2a and 2b protocol, effective April 12, 2017
8
     Inspector Notice No. 2014-01, Revised - Personal Identity Verification (PIV) Requirement
9
     Uniform Physical Condition Standards and Physical Inspection Requirements for Certain HUD Housing, Final
     Rule, September 1, 1998
10
     The universe of contractors totaled 126.
11
     Inspector Notice No. 2009-01 and Inspector Notice No. 2015-01
12
     Inspector Notice No. 2016-02, Section I-General Applicability, Part C. Personal Identity Verification (PIV)
     Process
13
     These inspectors were decertified for either inactivity with inspections or the number of accumulated
     performance deficiencies.
14
     According to REAC’s Inspector Administration, PIV Processing Standard Operating Procedures, the estimated
     timeframe to complete background investigations is 15 to 30 business days. The policy allows for an additional
     15 to 20 days if additional information is needed.




                                                           5
     •    It properly monitored contract inspectors. Specifically, it did not maintain documentation
          showing that it (1) performed the quality assurance review or took administrative
          actions 15 related to outside standards determinations 16 for 11 inspectors.
See appendix B for a table showing a summary of the 24 files we reviewed.
Therefore, REAC did not have assurance that it made the most effective and efficient use of its
resources when selecting, training, certifying, and monitoring inspectors.
REAC Did Not Ensure That Database System Controls Functioned Properly
REAC did not ensure that its system controls for its PASS database functioned properly.
REAC’s system security plan 17 required it to implement a security assessment plan and perform
annual security assessments for ensuring that the security controls of the data system were
implemented correctly, operated as intended, and produced the desired outcomes. In addition, as
part of its continuous monitoring process, the plan required REAC to conduct annual self-
assessments of selected security controls and monitor the security controls on an ongoing basis.
However, our review of 13 security controls determined that 2 controls—password length and
password disabling—failed to operate as intended and allowed access to the system without
meeting the minimum logon security requirements. HUD OCIO and the system contractor
corrected this issue; however, neither OCIO nor REAC could provide documentation showing
how long or why the controls did not operate as designed. In addition, REAC did not conduct
annual assessments and perform monitoring of the database system security controls.
REAC Did Not Verify the Accuracy of Sampled Units for Public Housing Agencies
REAC did not verify the accuracy of public housing agency units’ numbers sampled for
inspection. Regulations 18 required inspectors to inspect a randomly selected, statistically valid
sample of units. The inspectors used a data collection device to download the inspection data,
generate the sample of buildings and units for inspections, record observations, and upload the
completed inspections. Once the device generated the sample, it displayed a sequence of random
whole numbers. The inspector then selected the building units to inspect based on the number
sequence, as each random number represented a unit on the rent roll or all-inclusive unit listing
when compared in the same numerical order. For example, the number 4 represented the fourth
unit appearing on the list of units for that particular building. The inspector then manually
entered the actual unit numbers selected into the device and inspected the sample units. While
the inspectors followed these procedures, REAC did not verify that contract inspectors
accurately selected corresponding unit numbers in the same order as the random numbers
generated by the device, thus creating an opportunity for the inclusion or exclusion of certain
unit numbers for inspection.



15
     Inspector Notice No. 2016-02, Sections III-Inspector Administration Actions and IV-Performance Reviews
16
     Based on a quality assurance review, an inspector may be determined to be outside standards for not successfully
     conducting and completing the inspection or not adhering to the UPCS protocol prior to, during, or after an
     inspection.
17
     System security plan, released September 11, 2015
18
     Uniform Physical Condition Standards and Physical Inspection Requirements for Certain HUD Housing, Final
     Rule, September 1, 1998, and the Public Housing Evaluation and Oversight: Changes to the Public Housing
     Assessment System (PHAS) and Determining and Remedying Substantial Default, Interim Rule



                                                          6
REAC Either Did Not Follow Its Procedures or Did Not Have Procedures in Place
REAC either did not follow its procedures or did not have procedures in place for parts of its
inspections process. For the verification of contract inspector qualifications, REAC stated that it
had not requested documentation from inspector candidates since October 2008. Instead, it
relied on different phases of the training program to filter out unqualified candidates rather than
following its own procedures for obtaining verifiable documents from the candidates. However,
obtaining this documentation would better ensure that REAC trains and certifies only suitable,
qualified, and experienced inspectors and makes the most efficient use of its training resources.
In addition, following its procedures related to work experience, insurance, background
investigations; and following up on outside-of-standards issues would help protect REAC from
liability claims.

For its PASS database, REAC stated that most of the security assessment was handled by the
OCIO 19 security office and the PASS data system inherited controls from other systems managed
by OCIO. Therefore, the PASS data system received assessments and monitoring of the security
controls as performed on those other systems. REAC also stated that it did not have the ability to
assess the controls. However, in an effort to ensure compliance with its policies and procedures,
REAC should have at least maintained constant coordination with OCIO and obtained
documentation showing that annual assessments and continuous monitoring of all of the security
controls were performed. In addition, because the security of the PASS data system requires
special attention due to the risk and extent of harm that can result from the loss, misuse, or
unauthorized access to or modification of the information in the system, REAC must follow its
plan procedures for assessments and monitoring to ensure that the PASS database is fully
protected from unauthorized access and inappropriate use.

For the verification of the sampled units, REAC did not require that the rent roll provided to the
inspector at the time of the inspection be kept, saved, or uploaded as part of the inspection
process. In addition, REAC did not establish or implement specific procedures for reviewing or
monitoring the inspection sample to verify that corresponding unit numbers were accurately
selected and in the same order as the random numbers generated by the device. Implementing a
procedure to verify the accuracy of the sample would reduce the risk of collusion in altering the
inspection sample and further validate statistical independence.
Conclusion
Because REAC did not follow its procedures or have procedures in place for parts of its
inspections process, it did not always ensure that (1) it obtained documentation to verify contract
inspector work experience, (2) inspectors met the minimum requirements to begin training, (3)
inspectors obtained the required liability insurance, (4) inspectors had completed or approved
background investigations, (5) it properly monitored contract inspectors, (6) its database system
controls functioned properly, and (7) it verified the accuracy of sampled units for its public
housing agencies. As a result, REAC did not always have assurance that it (1) made the most




19
     The Chief Information Officer is responsible for establishing and overseeing the department wide information
     security program and provides information security consulting assistance to all HUD program offices for their
     individual programs.



                                                          7
effective and efficient use of its resources when training and certifying inspectors, (2) protected
its database system data from unauthorized access and use, and (3) had accurate unit selections.
Recommendations
We recommend that the Deputy Assistant Secretary for REAC require REAC to
       1A.     Develop and implement written policies and procedures requiring REAC to (1)
               select a sample of inspector candidates, (2) require the sampled inspector
               candidates to provide written documentation supporting their minimum
               qualifications, (3) verify the written documentation provided by the inspector
               candidates, and (4) document the completion of the verification and method(s)
               used to verify the documentation.

       1B.     Ensure that the nine contract inspectors, who did not meet the minimum
               requirements to begin the training, receive specialized training in residential or
               commercial building for electrical; heating, ventilation, and air conditioning;
               masonry; plumbing; and carpentry, as applicable.

       1C.     Develop, use, and document an electronic checklist for each contract inspector’s
               file to ensure that inspectors (1) obtain and maintain the required insurance, and
               (2) have approved background checks before conducting inspections. In addition,
               support that the four sampled inspectors meet the minimum insurance limits for
               the current effective periods.

       1D.     Execute administrative action related to outside standards determinations for 11
               inspectors.

       1E.     Develop and implement processes and procedures, in accordance with its system
               security plan and the HUD Handbook, Information Technology Security Policy,
               to ensure that annual assessments and continuous monitoring of the security
               controls are performed and that security control failures are prevented and
               corrected when identified.

       1F.     Establish and implement written processes and procedures to verify the accuracy
               of the unit numbers sampled and entered for inspection by the inspector, which
               could include requiring (1) inspectors to upload a picture of the rent roll to the
               data collection device, (2) housing agencies to maintain a copy of the rent roll
               used, and (3) inspectors and public housing agencies to sign a certification stating
               that the units were inspected in accordance with the sample generated by the data
               collection device.




                                                  8
Scope and Methodology
We performed our audit from October 2017 through June 2018 at the HUD REAC office located
at 550 12th Street SW, Washington, DC, and our offices in Baton Rouge, LA, New Orleans, LA,
and Fort Worth, TX. The audit generally covered the period October 1, 2014, through
September 30, 2017. We expanded our audit scope to review previously issued Inspector
Notices covering 2002 through 2009.
To meet the audit objective, we reviewed
   •   Laws, regulations, and guidance relevant to the physical inspection program.
   •   Other audits and monitoring reports conducted on REAC.
   •   The PASS Operations Division’s organizational structure and internal written policies
       and procedures.
   •   REAC’s sampling methodology and sampling procedures for inspections.
   •   System security plans and HUD handbooks relevant to system security controls.
   •   Files supporting documentation related to inspectors’ selection, training, certification, and
       monitoring.
We also interviewed HUD’s staff.
REAC had 126 active and inactive contract inspectors that performed inspections between
October 1, 2014, and September 30, 2017, and were awarded their initial certifications on or
after October 1, 2014. Of the 126 active and inactive contract inspectors, due to the size of the
universe, we used nonstatistical sampling to randomly select 24 to determine whether the file
documentation supported the appropriate selection, training, and certification of the inspectors
and whether REAC monitored the inspectors’ performance. This approach did not allow us to
project the results of the sample to the population; however, it was sufficient to meet the audit
objective. We conducted an overall data reliability assessment of the inspector file data, which
included reports generated on training exams’ scores; general information on each inspector,
including listings of their inspections; and listings of quality assurance reviews conducted. We
performed the assessment by comparing the information on the reports and listings to the PASS
system data and other file documentation provided, such as the questionnaire and monitoring
correspondence from REAC’s Inspector Administration. Through review of the file supporting
documentation, we determined that the computer-processed data related to the inspectors were
generally reliable.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                 9
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to

    •   effectiveness and efficiency of operations,
    •   reliability of financial reporting, and
    •   compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:

•   Effectiveness and efficiency of policies and procedures used to ensure that program
    requirements are met.

•   Compliance with applicable HUD regulations and Federal requirements.

We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiency
Based on our review, we believe that the following item is a significant deficiency:

•   REAC did not always follow or have controls to ensure the selection, training, certification,
    and monitoring of inspectors; the data system’s security controls; and the adequacy of its
    established processes for inspection sampling (finding).




                                                  10
Appendixes

Appendix A
                 Auditee Comments and OIG’s Evaluation



Ref to OIG           Auditee Comments
Evaluation




                         U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT
                                               WASHINGTON, DC 20410-5000
             OFFICE OF PUBLIC AND INDIAN HOUSING
             REAL ESTATE ASSESSMENT CENTER

             TO: Kilah S. White, Regional Inspector General for Audit, 6AGA

             FROM: Donald J. Lavoy, Deputy Assistant Secretary for PIH, REAC, PX

             SUBJECT: REAC’s Response to OIG’s Draft Report, REAC Could Improve Its Inspections
             Processes and Controls

                     Thank you for allowing REAC to respond and provide clarification for some of your
             OIG recommendations concerning REAC’s Inspection Processes and Controls. We hope the
             information provided below will sufficiently clarify the areas identified in the draft
             recommendations to the REAC.

             Recommendation 1C: Develop, use, and document an electronic checklist for each contract
             inspector’s file to ensure that inspectors (1) properly complete training before conducting
             inspections, (2) obtain and maintain the required insurance, (3) have approved background
             checks before conducting inspections, and (4) perform the required number of inspections to
             maintain certification. In addition, support that the three sampled inspectors meet the minimum
             insurance limits for the current effective periods.

Comment 1             You indicate that minimum requirements were not met for inspectors being certified
             prior to conducting inspections, specifically training not properly completed. The draft OIG
             document indicates that two inspectors did not complete training properly. This conclusion is
             not correct based on the following research and review:

             •                    – According to secure systems passed Phase II February 16, 2017. However,
             he initially failed phase II on December 8, 2016. Therefore, he conducted 6 Phase II inspections
             (1st attempt –                                                         and 2nd attempt –
                                                                  ). His first full inspection was March 21,
             2017, at which time he was fully certified.



                                          11
Ref to OIG              Auditee Comments
Evaluation
             •                  – Per Secure Systems he initially passed Phase II May 25, 2017. The
             evaluation report in the system is dated May 25, 2017. His Phase II inspections were
Comment 1    conducted May 23 -25, 2017. He conducted his first full inspection on July 24, 2017, and
             another on August 8, 2017. On August 21, 2017, his inspection is listed as Phase II. The
             comments in secure system state that he took a certification exam to complete Phase IIb
             training on August 21, 2017, and comments on September 11, 2017, state that the inspector
             passed Phase IIb.

             You indicate that a liability insurance certificate not submitted within five days and that 15
Comment 2    inspectors did not submit their certificate of insurance within five days of certification.
             Inspector Notice 2015-01, UPCS Inspector Protocol – General Liability Insurance
             Requirement, requires that after an individual successfully completes the entire UPCS
             Inspector Certification Training and is certified to conduct UPCS inspections, the
             individual must procure the required liability insurance and provide HUD with the
             Certificate of Liability Insurance prior to being able to conduct a UPCS inspection. The
             requirement to submit proof of general liability insurance within five days is used as an
             internal control. Once an inspector is certified, the inspector has access to upload and
             download inspections. As a safeguard, if an inspector does not have insurance within five
             days, the inspector’s account is deactivated to avoid liability risks.

             The insurance requirements per the cited inspectors were met prior to conducting
Comment 2    inspections.
             •                 – IA agrees with this finding.
             •                 – IA does not agree with this finding. Inspector passed phase II on
             August 31, 2017. Insurance certificate was dated and uploaded by inspector on September
             6, 2017, which was 5 business days following his certification.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.
             •                 – IA agrees with this finding.

                      You indicate the liability insurance minimum insured amounts were not met and
             that four inspectors did not have liability insurance minimum insured amounts. The
             following is provided is provided based on research of the records:
Comment 3




                                            12
Ref to OIG              Auditee Comments
Evaluation
Comment 3    •                - Inspector’s certificate of liability insurance form shows his policy has
             1,000,000 for General Liability Claim and 1,000,000 for Per Aggregate that is required by
             the agency protocol.
Comment 3
             •                  - Inspector certificate of liability insurance form shows insurance
             effective date December 2, 2015, and insurance limit total 3,055,000. Inspector met the
             requirement for submitting his certificate on time, insured amount, and having insurance
             before conducting his first inspection.
Comment 3
             •                   - Inspector certificate of liability insurance form shows a total limit of
             2,000,000 that is required by the agency protocol. Inspector met the requirement for the
             correct total insured amount.
Comment 3
             •                    - Inspector certificate of liability insurance form shows a total limit of
             2,000,000 that is required by the agency protocol. Inspector met the requirement for
             submitting his certificate on time, insured amount, and having insurance before conducting
             his first inspection.
Comment 4             You indicate that inspections conducted without liability insurance and
             specifically that seven inspectors conducted inspections without liability insurance. The
             following is provided based on research of the records:
Comment 4
             •                – Inspector passed Phase II February 16, 2017. His insurance was
             submitted on February 24, 2017. He conducted his first inspection as a certified inspector
             on March 21, 2017.
Comment 4
             •                  - Inspector passed Phase II on November 19, 2015, and insurance was
             updated on December 3, 2015. His first full inspection was conducted on December 3,
             2015. The inspector met the requirement for submitting his insurance on time and prior to
             conducting his first inspection.
Comment 4
             •                 - Inspector met HUD certificate of liability insurance requirement on
             December 2, 2014. Inspector conducted her first full inspection on April 3, 2015. Inspector
             met the requirement for having insurance before conducting his first inspection.
Comment 4
             •                    - Inspector passed Phase II on February 19, 2015. Inspector uploaded
             his insurance certificate on February 18, 2015 and insurance was updated on February 19,
             2015. His first full inspection was conducted on February 27, 2015.
Comment 4
             •                 - Inspector’s insurance was updated on July 27, 2016. Her first full
             inspection was conducted on September 26, 2016. Inspector met the requirement for
             having insurance before conducting inspections.




                                             13
                        Auditee Comments
Ref to OIG
Evaluation
             •                    – Inspector passed Phase II on December 4, 2014. Inspector uploaded
             his certificate on December 11, 2014 and insurance was updated on December 11, 2014.
Comment 4    His first full inspection was conducted on December 15, 2014. Inspector met the
             requirement for submitting his certificate on time and having insurance before conducting
             his first inspection.

Comment 4    •                  – Inspector passed Phase II on November 20, 2014. Inspector insurance
             was updated on November 12, 2014. Her first full inspection was conducted on December
             2, 2014. Inspector met the requirement for submitting her certificate on time and having
             insurance before conducting her first inspection.

             You indicate that background investigations were not completed before certified and
             conducting inspections and that 15 inspectors that did not complete the background
             investigation before being certified and conducting inspections. IA agrees with this finding.

Comment 5    You indicated that a minimum of 25 inspections not conducted and specifically that one
             inspector did not meeting the minimum of 25 inspections. The following is provided based
             on research of the records:

Comment 5    •                  – Inspector was granted an exemption to this requirement due to
             weather related activities in Puerto Rico that impacted inspection activities.

Comment 6    You indicate a lack of support showing review or administrative actions. We are not able
             to respond due to lack of information.

             You indicate the following concerning Phase II training: Phase II Training:• 1st attempt
             Field training: 12/6/2016 (day 1) and 12/7/2016 (day 2). Field exam: 12/8/2016 (day 3)
Comment 1
             • 2nd attempt Field training: 2/14/2017 (day 1) and 2/16/2017 (day 2). Field exam:
             2/15/2017 (day 3)

             • Secure Systems shows 2/15/2017 as the inspection date of the exam inspection (ID:
             595884). The 2/15/2017 exam was prior to the completion of day 2 training on 2/16/2017.
             Additionally, the CQA report for the February 2017 training was not in the file."




                                           14
Ref to OIG              Auditee Comments
Evaluation   We offer the explanation that we set up the inspections and identified them in Secure
             Systems; however, the inspector, our staff, and the properties switched them around at the
             last minute without updating Secure Systems. (See the copy of                    schedule
Comment 1    for that week.)




             Overall it doesn't matter which inspection is used as the “Test,” as long it takes place last,
Comment 1    which we are certain it did.                   was with the inspector candidate Tuesday,
             Wednesday and Thursday and he would not have tested the inspector candidate on the
             second day. What should have happened was that the inspection commentary should have
             been updated in Secure Systems so that it reflects that the inspection initially scheduled for
             Thursday, 02/16/17                      was actually conducted on Wednesday (02/15/17)
             and it became the second day inspection. The inspection initially scheduled for
             Wednesday, 02/15/17                       was actually conducted on Thursday (02/16/17)
             and it counted as the test. This was a data entry issue. We found not additional instance
             where this data entry error ever happened in our history because our quality assurance
             inspector staff are specifically and thoroughly trained to not administer the examination
             prior to giving the person the proper training opportunities. Therefore, we can state with
             complete that this was a data entry error.




                                            15
                                 OIG Evaluation of Auditee Comments


Comment 1                  REAC stated that the OIG’s conclusion that two inspectors did not
                           complete training properly is not correct. REAC stated that according to
                           secure systems, 20 the first inspector initially failed phase 2 on December 8,
                           2016, and then passed phase 2 on February 16, 2017. His first full
                           inspection was March 21, 2017, at which time he was fully certified. For
                           the second inspector, REAC stated that according to secure systems, he
                           initially passed phase 2 on May 25, 2017. He conducted his first full
                           inspection on July 24, 2017, and another on August 8, 2017. REAC also
                           provided additional documentation with its response.

                           We reviewed the additional documentation provided by REAC, and
                           revised the report to remove this issue. The inspector names and the
                           identification numbers of the inspectors and the property inspections
                           included in the auditee comments were hidden for privacy reasons.


Comment 2                  REAC stated that after successfully completing training, inspectors must
                           purchase the liability insurance and submit proof of general liability
                           insurance within five days before conducting inspections. REAC agreed
                           that 14 of the 15 did not submit the liability insurance certificate within
                           five days. For the remaining inspector, REAC stated the inspector passed
                           phase 2 on August 31, 2017, and the insurance certificate was dated and
                           uploaded by the inspector on September 6, 2017, which was five business
                           days following his certification.

                           We reviewed the additional documentation provided and revised the report
                           from 15 to 14 inspectors who did not meet the requirement for submitting
                           the insurance certificate within five days.

Comment 3                  REAC asserted that, based upon the research of its records, the four
                           inspectors cited in the audit report met the minimum general liability
                           insurance amounts and provided explanations for each inspector.

                           We disagree. Inspector Notices 2009-01 and 2015-01 stated that to
                           conduct inspections, each inspector must purchase and maintain general
                           all risk liability insurance with limits not less than a combined single limit
                           of $1 million per occurrence, and $2 million total. For these four
                           inspectors, the insurance certificates listed the different types of coverage


20
     Secure systems is a HUD web portal which has access to many HUD systems and provides a means for trusted
     business partners to submit and retrieve required program information. Secure systems is sponsored by the
     Office of Public and Indian Housing (PIH) Real Estate Assessment Center (REAC) and sometimes referred to as
     REAC or Online Systems.




                                                        16
            included in the general liability insurance policy and the insured amount
            limits for each type. As such, the insurance certificates should reflect
            minimum insured amounts of $1 million per occurrence and $2 million
            total. However, of the four inspectors, the general total limit amount for
            three inspectors was only $1 million and one did not have any insured
            limit amount included for each occurrence during one policy period.
            Therefore, we maintain our original conclusion.

Comment 4   For the seven inspectors cited in the report for conducting inspections
            without liability insurance, REAC stated it researched the records and
            provided explanations for each inspector. REAC did not provide
            additional documentation.

            We disagree based upon REAC’s explanations and provide further
            clarification as follows:

               •   Inspector 1- The history table in secure systems showed that the
                   inspector met the insurance requirement on February 24, 2017.
                   However, secure systems did not have an insurance certificate
                   covering the period prior to January 14, 2018, and the inspector
                   conducted 71 inspections between March 21, 2017, and January
                   12, 2018.

               •   Inspector 2- Secure systems had one insurance certificate covering
                   the period from December 2, 2015, through December 2, 2016.
                   However, the inspector conducted 18 inspections between January
                   30, 2017, and April 4, 2017, with no documentation of insurance in
                   the file.

               •   Inspector 3- The history table in secure systems showed that the
                   inspector met the insurance requirement on December 2, 2014.
                   However, secure systems did not have an insurance certificate
                   covering the period prior to April 11, 2016, and the inspector
                   conducted 32 inspections between April 3, 2015, and March 29,
                   2016.

               •   Inspector 4- The inspector had a one-month gap in liability
                   insurance coverage between January 18, 2018, and February 18,
                   2018. During this gap, the inspector conducted 22 inspections.

               •   Inspector 5- The history table in secure systems showed that the
                   inspector met the insurance requirement on July 27, 2016.
                   However, secure systems did not have an insurance certificate
                   covering the period prior to July 14, 2017, and the inspector
                   conducted 78 inspections between September 26, 2016, and July
                   13, 2017.



                                     17
               •   Inspector 6- Secure systems did not have an insurance certificate
                   for the period covering December 10, 2015, through December 12,
                   2016, and the inspector conducted 60 inspections during this time
                   period.

               •   Inspector 7- The history table in secure systems showed that the
                   inspector met the insurance requirement on November 12, 2014.
                   However, secure systems did not have an insurance certificate
                   covering the period prior to September 30, 2015, and the inspector
                   conducted 163 inspections between December 2, 2014, and
                   September 28, 2015.

            Therefore, we maintain our original conclusions.

Comment 5   For the one inspector cited in the report for not meeting the requirement of
            conducting a minimum of 25 inspections in the most recent 12 month
            period, REAC stated it researched the records and explained that it granted
            the inspector an exemption to this requirement due to weather related
            activities in Puerto Rico that impacted inspection activities.

            We agree with REAC’s decision, as Hurricane Maria severely impacted
            Puerto Rico in September 2017. Therefore, we revised the audit report to
            remove this issue.

Comment 6   REAC stated it was unable to respond to the lack of support showing
            review or administrative actions for inspectors, due to lack of information.

            We discussed this issue with REAC during the audit and provided a
            spreadsheet detailing the issues identified. Since REAC was unable to
            provide any additional information to address this issue, we maintain our
            position.




                                     18
Appendix B
                         Summary of Inspector File Review Findings

            Selection                               Certification                          Monitoring
 Sample   Minimum         Liability     Liability     Inspections   Background          Lack of support
          requirements    insurance     insurance     conducted     investigation not   showing review
          not met         certificate   minimum       without       completed before    or administrative
                          not           insured       liability     certified and       actions
                          submitted     amounts       insurance     conducting
                          within 5      not met                     inspections
                          days
   1                           X            X              X                X
   2                                                                        X
   3           X                                                            X
   4                          X
   5                          X
   6                          X
   7           X              X
   8           X              X
   9           X              X
  10                          X             X              X                X                   X
  11           X                                                            X                   X
  12                                        X                               X
  13           X                                           X                X                   X
  14                                                                        X                   X
  15                          X
  16                          X             X              X                X                   X
  17                                                                        X                   X
  18                          X                            X                                    X
  19
  20           X              X                                             X                   X
  21           X                                           X                X                   X
  22                          X                                             X
  23           X                                                            X                  X
  24                          X                            X                X                  X
 Totals        9              14            4              7                15                 11




                                                    19