oversight

HUD IT System Management and Oversight of the Section 184 Program

Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-08-13.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                     MEMORANDUM
                                          August 13, 2018


To:        Pamela H. Patenaude
           Deputy Secretary, S


From:      Brian T. Pattison
           Assistant Inspector General for Evaluation, G

Subject: HUD OIG Report – IT System Management and Oversight of the Section 184
Program (2018-OE-0004)


Please see the attached final report on our evaluaton of the U.S. Department of Housing and
Urban Development’s (HUD) information technology (IT) system management and
oversight of the Section 184 program. It contains five findings and five recommendations.
The report will be posted to our website within 3 days. We conducted this evaluation at the
request of the Appropriations Committee.

We provided your office, the Office of Native American Programs (ONAP), Office of Single
Family Housing, Public and Indian Housing (PIH), and the Office of the Chief Informaiton
Officer (OCIO) with an opportunity to respond with comments to our draft report. Based on
ONAP and Single Family Housing comments, we updated the recommendations to correctly
identify the appropriate stakeholders. We did not receive written comments from your office or
OCIO. Official comments that we did receive, along with our responses to them, are included in
our report. We consider recommendations 1, 2, 3, 4, and 5 to be “unresolved-open” and will
contact your office, OCIO, and ONAP within 90 days to begin discussing your proposed
management decisions.

I appreciate the assistance your staff and staff throughout HUD provided throughout the
evaluation. If you have any questions, please contact Director John Garceau at (202) 603-8410 or
jgarceau@hudoig.gov.

Attachment: U.S. Department of Housing and Urban Development, Office of Inspector General,
Report – IT System Management and Oversight of the Section 184 Program (2018-OE-0004)

cc:        Andrew Hughes, Chief of Staff
           Chad Cowan, Chief Information Officer, Acting
           Dominique Blom, General Deputy Assistant Secretary, Public and Indian Housing
           Heidi Frechette, Deputy Assistant Secretary, Office of Native American Programs
           Brian Montgomery, FHA Commissioner and Assistant Secretary for Housing
           J. Paul Compton, Jr., General Counsel
           Michael Marshall, Chief of Staff for Deputy Secretary Patenaude


                                        Office of Inspector General
                                            Office of Evaluation
                                 451 7th Street SW, Washington, DC 20410
                                 Phone (202) 708-0430, Fax (202) 401-2505
                                              www.hudoig.gov
                                                                                            HUD OIG Report
                                                             Section 184 IT System Oversight and Management
                                                                                              August 13, 2018



Report Highlights at a Glance
The U.S. Department of Housing and Urban Development (HUD) had not successfully deployed
an information technology (IT) system that enabled effective management and appropriate
oversight of all Indian Home Loan Guarantee Program (Section 184 program) processes. Since
the 2013 to 2014 embezzlement of $843,000 in Section 184 program funds, the Appropriations
Committee has expressed concern that HUD had not used resources to address shortcomings in
internal controls and deploying a reliable IT system. Despite the $4 million spent on developing
the Office of Native American Programs - Loan Origination System (ONAP-LOS), the system
does not satisfy all management and oversight objectives.

ONAP-LOS has significant limitations, requiring lenders and program officials to continue to
use a HUD Office of Housing legacy IT system1 and manual processes for maintaining files,
servicing loans, and managing claims. Only 1 of 38 lenders supporting the Section 184 program
are able to access ONAP-LOS due to HUD’s inability to administratively resolve an access
issue. Additionally, unresolved data compatibility concerns prevent a complete transition from
the legacy system, resulting in the two systems running together. Synchronizing information
between the two systems that have similar capability limitations does not accomplish the original
objective of a comprehensive information system that enables effective management and
oversight of the Section 184 program. Finally, ONAP-LOS has limited management
information-reporting capabilities. Even after resolution of the access issue, the current state of
the system will provide program officials with only about 25 percent of the management reports
needed to ensure proper oversight of the program.

HUD faces a difficult period ahead, as the contract to further develop, operate, and maintain
ONAP-LOS will be recompeted in 2018. The potential transition in vendors and needed system
development could mean additional expenses and delays. The expense for technology to date
has resulted in few measurable improved oversight objectives for the Section 184 program.
HUD does not have a project plan or timeline for resolving the system shortcomings. The figure
below outlines the events and actions HUD has taken since 2013 to address the Section 184
program oversight shortcomings.
                                Timeline of HUD’s oversight of Section 1842




1
  A module of the Computerized Homes Underwriting Management System (CHUMS) is used by Section 184
program staff to manage loan cases.
2
  In the figure, REAC is the HUD Real Estate Assessment Center; OLG is the HUD Office of Loan Guarantee; and
OIG is the HUD Office of Inspector General

                                                      2
                                                                                    HUD OIG Report
                                                     Section 184 IT System Oversight and Management
                                                                                      August 13, 2018



        Information Technology Evaluation Division
             Information Brief (2018-OE-0004)
 IT System Management and Oversight of the Section 184
          Indian Home Loan Guarantee Program
This report highlights findings from our review of the Indian Home Loan Guarantee Program’s
(Section 184 program) information technology (IT) system. The U.S. Department of Housing
and Urban Development (HUD) program is managed by the Office of Native American
Programs – Office of Loan Guarantee (OLG). We conducted this evaluation at the request of the
Appropriations Committee.

Summary
The HUD Office of Inspector General (OIG), Office of Evaluation, Information Technology
Evaluation Division, performed a review of the Section 184 program to determine whether its IT
systems enabled effective management and oversight of the program. This report focuses only
on the management and functionality of the IT systems that support that program. Separately,
the Office of Audit is conducting a review to identify and evaluate actions taken by OLG since
issuance of audit report 2015-LA-0002, including a review of $2.6 million received for
administrative contract expenses.
Multiple IT systems support the Section 184 program; however, those systems have limited
operational functionality. Most Section 184 program loan applications HUD processes are still
processed manually. Case management information is tracked in the Computerized Homes
Underwriting Management System (CHUMS), which is a legacy IT system. Since
approximately 2013, HUD had used CHUMS to manage and track loan case numbers and data.
CHUMS did not meet the Section 184 program requirements, so HUD developed the Office of
Native American Programs – Loan Origination System (ONAP-LOS). This system was
developed on modernized technology and resides in HUD’s Azure cloud environment. However,
the system lacks key integrated functionality, so management of the Section 184 program
remains dependent on CHUMS, which operates on outdated software and hardware and still uses
various manual processes.
At the time of our review, OLG was based in HUD headquarters in Washington, DC, with eight
staff members, which included one Section 184 staff member stationed in Denver, CO, and one
stationed in Atlanta, GA. The staff members that were located outside Washington, DCwere not
intended to create a field presence for OLG. All staff members working on the Section 184
program have similarly responsibilities, including access to both the legacy CHUMS and ONAP-
LOS for Section 184 program processing tasks.
The findings from our review included that


                                              3
                                                                                     HUD OIG Report
                                                      Section 184 IT System Oversight and Management
                                                                                       August 13, 2018


   1. ONAP-LOS lacked the functionality required to process and fully report on all Section
      184 program loans.
   2. ONAP-LOS did not have a project plan for needed improvements to functionality and
      capabilities.
   3. Only 1 of 38 lenders involved with the Section 184 program used ONAP-LOS due to an
      internal HUD system access issue.
   4. ONAP-LOS depended on a HUD Office of Housing legacy IT system, CHUMS, to
      process Section 184 loans.
   5. HUD’s Office of the Chief Information Officer (OCIO), in partnership with the Office of
      Public and Indian Housing, had successfully deployed the initial operating capability of
      ONAP-LOS in the HUD Azure cloud environment, so it was positioned for future
      development.


Section 184 Program IT Systems

Existing Systems
HUD OLG performs Section 184 program processing tasks using a combination of manual
processes, a legacy system, local databases, and the new ONAP-LOS IT system. OLG staff and
participating lenders follow two distinct workflow processes to manage loans.
First, OLG uses a legacy version of CHUMS to initiate and track loan case numbers and
associated data. More specifically, CHUMS is able to register case numbers; reserve funds; issue
loan guarantee certificates; log loan guarantee fees; and produce critical reports that track
obligations, commitments, and available loan authority. CHUMS was developed by HUD’s
Federal Housing Administration (FHA) to administer and track information for the single-family
mortgage insurance program. Multiple modifications and upgrades have been made to this
system, but OLG uses an early version of the application supported by legacy software and
hardware, which adds a significant cybersecurity risk to the loan data and HUD’s IT
environment. This system does not interface with HUD’s general ledger system and requires the
lenders to submit loan application documents to HUD in paper form through regular mail. Once
OLG receives the case documents, staff members manually enter information into CHUMS. The
hardcopy loan applications contain a myriad of personally identifiable information, are often
hundreds of pages in length, and are physically stored in multiple HUD offices, depending on the
location of the OLG specialists.
The second method OLG uses to process loans is by using the new ONAP-LOS IT system. This
system maintains the same case number registration, reservation of funds, and loan guarantee
certificate issuance capabilities as CHUMS, but does not log loan guarantee fees or produce the
same critical reports as CHUMS. HUD began planning ONAP-LOS in fiscal year 2014, and the
initial development capability became operational in August 2017. The system is still considered
to be in development, with only one lender using the system as of June 2018. This system marks

                                               4
                                                                                      HUD OIG Report
                                                       Section 184 IT System Oversight and Management
                                                                                        August 13, 2018


progress in HUD OCIO modernization, as it was developed in the HUD Microsoft Azure cloud,
allowing for efficient future development and expansion. Using ONAP-LOS allows lenders to
electronically submit and initiate loan cases and OLG to process and store all Section 184
program application documents electronically, making the system more efficient for conducting
oversight.

ONAP-LOS Functionality
OLG officials stated that they planned to address the Section 184 IT modernization and oversight
issues. ONAP-LOS provides limited improved functionality for oversight of the Section 184
program. The following are significant system limitations identified during our review:
    The majority of lenders, 37 of 38, did not have access to ONAP-LOS.
    ONAP-LOS remained dependent on the legacy CHUMS application.
    Critical data migration technical expertise to transition data from CHUMS may not exist.
    Limited Section 184 management report extracts were available from ONAP-LOS.
    ONAP-LOS did not enable Section 184 loan servicing and claims capabilities.
ONAP-LOS was accessible by only one Section 184 lender due to HUD’s failure to resolve the
system access solution between OLG and FHA. The remaining 37 Section 184 lenders were
provisioned and had access to FHA systems managed by FHA system administrators. However,
they could not access the HUD Web Access Security Subsystem (WASS), which provides HUD
business partners with application-level authentication capability and would allow for their
access to ONAP-LOS. The issue has remained unresolved for at least the past 8 months and will
require coordination among HUD OCIO, FHA, and ONAP to resolve it. HUD OCIO requires
that all new systems use the WASS framework, including ONAP-LOS. OLG requested that
FHA system administrators work with ONAP-LOS administrators to transfer lender
identification roles and attributes to WASS to use their current identification numbers and create
login accounts for the lenders to access ONAP-LOS. The ONAP-LOS system was developed
without a comprehensive access requirements and IT environment risk assessment. Therefore,
OCIO had developed a solution with some risk mitigation, but it had not been approved by FHA
due to test results identifying increased risk to business processes and potential exposure of
sensitive data. This critical issue must be resolved by HUD to reach the full operational
capability of ONAP-LOS and standardize Section 184 loan processing.
In addition, ONAP-LOS requires interconnection dependency with CHUMS because of the two
methods of processing Section 184 program cases and CHUMS capabilities that ONAP-LOS
lacks. Data synchronization and data conversion must exist between the two systems. Data are
transferred from ONAP-LOS to CHUMS daily to maintain data synchronization. This type of
data was minimal at the time of our review because ONAP-LOS hosted only one lender. The
data synchronization demand will increase with additional lender use. Data conversion from
CHUMS to ONAP-LOS also occurs, which is complicated because the model formats are
significantly different. We have concerns regarding OLG’s lack of expertise to properly and

                                                5
                                                                                              HUD OIG Report
                                                               Section 184 IT System Oversight and Management
                                                                                                August 13, 2018


consistently transfer data from CHUMS to ONAP-LOS. Data conversion from CHUMS to
ONAP-LOS is difficult but may become a critical challenge when HUD attempts to migrate from
CHUMS because of the data conversion mapping challenges between the two systems. OLG
was attempting to address this challenge by having the ONAP-LOS vendor use the Informatica
web server tool3 for data migration. However, 30,000 paper case files will not be transitioned
into electronic form in ONAP-LOS. CHUMS also provides the one-way transfer of loan
financial data to the Oracle Federal Financial systems, a capability that ONAP-LOS lacks.
ONAP-LOS also lacks key reporting capabilities. While the legacy CHUMS has the ability to
produce 22 standard reports for management and oversight for critical Section 184 processes,
ONAP-LOS can produce only one accurate management report and one untested report.
According to OLG employees, CHUMS could provide approximately 94 percent of requested
management reports, while ONAP-LOS is capable of providing approximately 25 percent of
needed informational and management reports. Report production is a key area in which ONAP-
LOS has been dependent on the legacy CHUMS. Additionally, no capability exists to develop
and receive timely ad hoc requested reports, as they need to be planned, budgeted for, and
developed by the development project team. Six reports had been identified by the ONAP-LOS
project team to be added, but no timeline had been established for development.
ONAP-LOS lacks other key capabilities for servicing and processing Section 184 claims.
ONAP-LOS ensures that lenders enter a standardized format of loan application data and receive
correct case numbers. However, the system lacks the capability to track and evaluate the
performance of lenders and loans, such as loan delinquency. This servicing function is a
manually maintained process using Excel spreadsheets. Discussions had occurred within HUD
OLG to add the servicing function to ONAP-LOS, but this function had not been implemented,
and no timeline has been established to do so. In addition, ONAP-LOS is not able to process and
distribute claim payments. All claims were paid outside ONAP-LOS and CHUMS, using the
U.S. Department of the Treasury’s Administrative Resource Center system, while OLG tracked
transactions manually in a locally stored database. The lack of automated controls introduced
vulnerabilities into the Section 184 program.
HUD recognized these capability gaps and told us that it would address them with future updates
to ONAP-LOS. However, HUD OCIO’s March 2018 project health assessment4 of the ONAP-
LOS project rated it as an overall medium risk due to a lack of project plan milestones and
requirements (lender access) being identified as high risk and moderately high risk, respectively.
Within the 10 categories that the assessment reviews, one category was rated as high risk, three
were rated as moderately high risk, and the other six were rated as less than medium risk.
HUD’s internal risk assessment included 25 recommendations to improve management and
oversight of the Section 184 ONAP-LOS. OLG had not formulated a project plan with

3
  Informatica is a commercial-off-the-shelf tool and service that offers data integration products.
4
  HUD OCIO conducted an ONAP-LOS project health assessment on March 20, 2018, which provided a summary
of risks related to stakeholder management (moderately low risk), risk management (moderately high risk), scope
management (medium risk), schedule management (moderately high risk), cost management (low risk), acquisition
and contracts management (low risk), quality management (medium risk), human resource management (medium
risk), requirements management (moderately high risk), and project planning and management compliance (high
risk). HUD OCIO refers to these 10 areas as “10 critical success factors.”

                                                       6
                                                                                     HUD OIG Report
                                                      Section 184 IT System Oversight and Management
                                                                                       August 13, 2018


milestones to address the 25 recommendations and correct the ONAP-LOS capability gaps
discussed above.


ONAP-LOS Contract and Costs
A contract was awarded in 2016 to a vendor that developed, operated, and maintained ONAP-
LOS. The contract was provisioned at $4 million, with a $3 million base year to fund the initial
development and implementation. OLG provided $1 million of the funding, while HUD OCIO
funded the remaining amount, including future-year operations and maintenance. The annual
operations and maintenance costs were reported to be $903,000 and were added to the OCIO
budget. Additional unspecified Microsoft Azure cloud hosting costs were also funded by OCIO.
A concern expressed to us by OLG staff was that ONAP-LOS had a high cost with only a few
capabilities and had not resolved the original IT system limitations.
A new contract is planned to be competed and awarded around September 2018 for ongoing
development, operations, and maintenance. This potential vendor change presented an additional
obstacle for ONAP-LOS if a contract transition was required between an old and new vendor.

Recommendations

For HUD and OLG to gain sufficient oversight of the Section 184 program, HUD should continue
to develop ONAP-LOS and associated IT procedures. HUD developed ONAP-LOS as a
modernized application in a cloud environment, but development and deployment had not been
fully successful. HUD should consider the following recommendations to continue the progress
of ONAP-LOS to enable proper management and oversight of the Section 184 program.

We recommend that the Deputy Secretary:

   1. Direct PIH and OCIO to develop a comprehensive project plan, documenting the
      milestones and dates for addressing the gaps in ONAP-LOS capabilities (functionality
      and reports) and the 25 recommendations made during HUD OCIO’s project health
      assessment.

   2. Direct all stakeholders to identify all viable options to securely resolve the ONAP-LOS
      access issues, so authorized Section 184 lenders can access the system. The best solution
      should not impose unacceptable risk to business processes or sensitive data. Current
      program offices involved are OCIO, PIH, and FHA, while others may also be identified.

   3. Direct PIH and OCIO to ensure that the Section 184 program transitions away from
      dependency on CHUMS.




                                               7
                                                                                   HUD OIG Report
                                                    Section 184 IT System Oversight and Management
                                                                                     August 13, 2018


We recommend that OCIO:

   4. Continue to develop required ONAP-LOS capabilities using cloud environments as
      appropriate.

We recommend ONAP:

   5. Coordinate and participate in resolving all open recommendations from evaluation report
      IT System Management and Oversight of the Section 184 Program (2018-OE-0004).




                                              8
                                                                                      HUD OIG Report
                                                       Section 184 IT System Oversight and Management
                                                                                        August 13, 2018




Agency Comments and OIG Response
Summary of ONAP’s Comments
ONAP requested that the original four recommendations in our draft report be reworded to
include and direct all the the stakeholders that have responsibility to develop and maintain IT
system oversight of the Section 184 program. ONAP felt they and OLG had little control over
the ONAP-LOS project team and requested that OIG issue the recommendation to everyone
involved. ONAP did not concur with the recommendations as they were worded.

OIG Response to ONAP’s Comments
Based on ONAP’s response, we agree that all stakeholders involved in the development and
maintaining of ONAP-LOS be involved in the recommendation resolution. Therefore, we
changed the language of all four original recommendations to make it clear that the other
program offices that are listed in the recommendations be added. In addition, we created a fifth
recommendation, directed to ONAP, that recommends ONAP coordinate and participate in the
the management decisions and resolution of the previous four recommendations in this report.
Following this recommendation language rewording, ONAP concurred with the
recommendations.

Summary of Other Program Office Comments
Single Family Housing, for FHA, provided an informal response to OIG via email requesting
language changes to recommendation 2. Based on their response, OIG reworded the
recommendation to include language for the ONAP-LOS access issue solution to require
coordination with all HUD stakeholders and to not have unacceptable risk to HUD business
processes or sensitive HUD data.

The Deputy Secretary’s Office or OCIO, did not provide written comments. The comments
received from ONAP was the combined response from ONAP and PIH.




                                                9
                                                                   HUD OIG Report
                                    Section 184 IT System Oversight and Management
                                                                     August 13, 2018


ONAP Comments to the Draft Report




                              10
                                    HUD OIG Report
     Section 184 IT System Oversight and Management
                                      August 13, 2018




11
                                    HUD OIG Report
     Section 184 IT System Oversight and Management
                                      August 13, 2018




12
                                                                          HUD OIG Report
                                           Section 184 IT System Oversight and Management
                                                                            August 13, 2018
Appendix A – Acronyms
       ACRONYM                                     DEFINITION
        CHUMS           Computerized Homes Underwriting Management System
         FHA            Federal Housing Administration
         HUD            U.S. Department of Housing and Urban Development
          IT            Information Technology
         OCIO           Office of the Chief Information Officer
         OLG            Office of Loan Gaurantee
         ONAP           Office of Native Americal Programs
       ONAP-LOS         Office of Native American Programs - Loan Origination System
         PIH            Office of Public and Indian Housing




                                   13
The Office of Inspector General is an independent and objective oversight
  agency within the U.S. Department of Housing and Urban Development.
 We conduct and supervise audits, evaluations, and investigations relating
 to the Department’s programs and operations. Our mission is to promote
economy, efficiency, and effectiveness in these programs, while preventing
            and detecting fraud, abuse, and mismanagement.

     Report fraud, waste, and mismanagement in HUD programs and operations by
         Completing this online form: https://www.hudoig.gov/report-fraud
         Emailing the OIG hotline:       hotline@hudoig.gov
         Faxing the OIG hotline:         (202) 708-4829


                           Sending written information to
                 U.S. Department of Housing and Urban Development
                       Office of Inspector General Hotline (GFI)
                            451 7th Street SW, Room 8254
                                Washington, DC 20410

                    Whistleblowers are protected by law.
           https://www.hudoig.gov/fraud-prevention/whistleblower-protection

                                       Website
                               https://www.hudoig.gov/




           Information Technology Evaluations
           Division




                                            4