MEMORANDUM August 13, 2018 To: Pamela H. Patenaude Deputy Secretary, S From: Brian T. Pattison Assistant Inspector General for Evaluation, G Subject: HUD OIG Report – IT System Management and Oversight of the Section 184 Program (2018-OE-0004) Please see the attached final report on our evaluaton of the U.S. Department of Housing and Urban Development’s (HUD) information technology (IT) system management and oversight of the Section 184 program. It contains five findings and five recommendations. The report will be posted to our website within 3 days. We conducted this evaluation at the request of the Appropriations Committee. We provided your office, the Office of Native American Programs (ONAP), Office of Single Family Housing, Public and Indian Housing (PIH), and the Office of the Chief Informaiton Officer (OCIO) with an opportunity to respond with comments to our draft report. Based on ONAP and Single Family Housing comments, we updated the recommendations to correctly identify the appropriate stakeholders. We did not receive written comments from your office or OCIO. Official comments that we did receive, along with our responses to them, are included in our report. We consider recommendations 1, 2, 3, 4, and 5 to be “unresolved-open” and will contact your office, OCIO, and ONAP within 90 days to begin discussing your proposed management decisions. I appreciate the assistance your staff and staff throughout HUD provided throughout the evaluation. If you have any questions, please contact Director John Garceau at (202) 603-8410 or firstname.lastname@example.org. Attachment: U.S. Department of Housing and Urban Development, Office of Inspector General, Report – IT System Management and Oversight of the Section 184 Program (2018-OE-0004) cc: Andrew Hughes, Chief of Staff Chad Cowan, Chief Information Officer, Acting Dominique Blom, General Deputy Assistant Secretary, Public and Indian Housing Heidi Frechette, Deputy Assistant Secretary, Office of Native American Programs Brian Montgomery, FHA Commissioner and Assistant Secretary for Housing J. Paul Compton, Jr., General Counsel Michael Marshall, Chief of Staff for Deputy Secretary Patenaude Office of Inspector General Office of Evaluation 451 7th Street SW, Washington, DC 20410 Phone (202) 708-0430, Fax (202) 401-2505 www.hudoig.gov HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 Report Highlights at a Glance The U.S. Department of Housing and Urban Development (HUD) had not successfully deployed an information technology (IT) system that enabled effective management and appropriate oversight of all Indian Home Loan Guarantee Program (Section 184 program) processes. Since the 2013 to 2014 embezzlement of $843,000 in Section 184 program funds, the Appropriations Committee has expressed concern that HUD had not used resources to address shortcomings in internal controls and deploying a reliable IT system. Despite the $4 million spent on developing the Office of Native American Programs - Loan Origination System (ONAP-LOS), the system does not satisfy all management and oversight objectives. ONAP-LOS has significant limitations, requiring lenders and program officials to continue to use a HUD Office of Housing legacy IT system1 and manual processes for maintaining files, servicing loans, and managing claims. Only 1 of 38 lenders supporting the Section 184 program are able to access ONAP-LOS due to HUD’s inability to administratively resolve an access issue. Additionally, unresolved data compatibility concerns prevent a complete transition from the legacy system, resulting in the two systems running together. Synchronizing information between the two systems that have similar capability limitations does not accomplish the original objective of a comprehensive information system that enables effective management and oversight of the Section 184 program. Finally, ONAP-LOS has limited management information-reporting capabilities. Even after resolution of the access issue, the current state of the system will provide program officials with only about 25 percent of the management reports needed to ensure proper oversight of the program. HUD faces a difficult period ahead, as the contract to further develop, operate, and maintain ONAP-LOS will be recompeted in 2018. The potential transition in vendors and needed system development could mean additional expenses and delays. The expense for technology to date has resulted in few measurable improved oversight objectives for the Section 184 program. HUD does not have a project plan or timeline for resolving the system shortcomings. The figure below outlines the events and actions HUD has taken since 2013 to address the Section 184 program oversight shortcomings. Timeline of HUD’s oversight of Section 1842 1 A module of the Computerized Homes Underwriting Management System (CHUMS) is used by Section 184 program staff to manage loan cases. 2 In the figure, REAC is the HUD Real Estate Assessment Center; OLG is the HUD Office of Loan Guarantee; and OIG is the HUD Office of Inspector General 2 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 Information Technology Evaluation Division Information Brief (2018-OE-0004) IT System Management and Oversight of the Section 184 Indian Home Loan Guarantee Program This report highlights findings from our review of the Indian Home Loan Guarantee Program’s (Section 184 program) information technology (IT) system. The U.S. Department of Housing and Urban Development (HUD) program is managed by the Office of Native American Programs – Office of Loan Guarantee (OLG). We conducted this evaluation at the request of the Appropriations Committee. Summary The HUD Office of Inspector General (OIG), Office of Evaluation, Information Technology Evaluation Division, performed a review of the Section 184 program to determine whether its IT systems enabled effective management and oversight of the program. This report focuses only on the management and functionality of the IT systems that support that program. Separately, the Office of Audit is conducting a review to identify and evaluate actions taken by OLG since issuance of audit report 2015-LA-0002, including a review of $2.6 million received for administrative contract expenses. Multiple IT systems support the Section 184 program; however, those systems have limited operational functionality. Most Section 184 program loan applications HUD processes are still processed manually. Case management information is tracked in the Computerized Homes Underwriting Management System (CHUMS), which is a legacy IT system. Since approximately 2013, HUD had used CHUMS to manage and track loan case numbers and data. CHUMS did not meet the Section 184 program requirements, so HUD developed the Office of Native American Programs – Loan Origination System (ONAP-LOS). This system was developed on modernized technology and resides in HUD’s Azure cloud environment. However, the system lacks key integrated functionality, so management of the Section 184 program remains dependent on CHUMS, which operates on outdated software and hardware and still uses various manual processes. At the time of our review, OLG was based in HUD headquarters in Washington, DC, with eight staff members, which included one Section 184 staff member stationed in Denver, CO, and one stationed in Atlanta, GA. The staff members that were located outside Washington, DCwere not intended to create a field presence for OLG. All staff members working on the Section 184 program have similarly responsibilities, including access to both the legacy CHUMS and ONAP- LOS for Section 184 program processing tasks. The findings from our review included that 3 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 1. ONAP-LOS lacked the functionality required to process and fully report on all Section 184 program loans. 2. ONAP-LOS did not have a project plan for needed improvements to functionality and capabilities. 3. Only 1 of 38 lenders involved with the Section 184 program used ONAP-LOS due to an internal HUD system access issue. 4. ONAP-LOS depended on a HUD Office of Housing legacy IT system, CHUMS, to process Section 184 loans. 5. HUD’s Office of the Chief Information Officer (OCIO), in partnership with the Office of Public and Indian Housing, had successfully deployed the initial operating capability of ONAP-LOS in the HUD Azure cloud environment, so it was positioned for future development. Section 184 Program IT Systems Existing Systems HUD OLG performs Section 184 program processing tasks using a combination of manual processes, a legacy system, local databases, and the new ONAP-LOS IT system. OLG staff and participating lenders follow two distinct workflow processes to manage loans. First, OLG uses a legacy version of CHUMS to initiate and track loan case numbers and associated data. More specifically, CHUMS is able to register case numbers; reserve funds; issue loan guarantee certificates; log loan guarantee fees; and produce critical reports that track obligations, commitments, and available loan authority. CHUMS was developed by HUD’s Federal Housing Administration (FHA) to administer and track information for the single-family mortgage insurance program. Multiple modifications and upgrades have been made to this system, but OLG uses an early version of the application supported by legacy software and hardware, which adds a significant cybersecurity risk to the loan data and HUD’s IT environment. This system does not interface with HUD’s general ledger system and requires the lenders to submit loan application documents to HUD in paper form through regular mail. Once OLG receives the case documents, staff members manually enter information into CHUMS. The hardcopy loan applications contain a myriad of personally identifiable information, are often hundreds of pages in length, and are physically stored in multiple HUD offices, depending on the location of the OLG specialists. The second method OLG uses to process loans is by using the new ONAP-LOS IT system. This system maintains the same case number registration, reservation of funds, and loan guarantee certificate issuance capabilities as CHUMS, but does not log loan guarantee fees or produce the same critical reports as CHUMS. HUD began planning ONAP-LOS in fiscal year 2014, and the initial development capability became operational in August 2017. The system is still considered to be in development, with only one lender using the system as of June 2018. This system marks 4 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 progress in HUD OCIO modernization, as it was developed in the HUD Microsoft Azure cloud, allowing for efficient future development and expansion. Using ONAP-LOS allows lenders to electronically submit and initiate loan cases and OLG to process and store all Section 184 program application documents electronically, making the system more efficient for conducting oversight. ONAP-LOS Functionality OLG officials stated that they planned to address the Section 184 IT modernization and oversight issues. ONAP-LOS provides limited improved functionality for oversight of the Section 184 program. The following are significant system limitations identified during our review: The majority of lenders, 37 of 38, did not have access to ONAP-LOS. ONAP-LOS remained dependent on the legacy CHUMS application. Critical data migration technical expertise to transition data from CHUMS may not exist. Limited Section 184 management report extracts were available from ONAP-LOS. ONAP-LOS did not enable Section 184 loan servicing and claims capabilities. ONAP-LOS was accessible by only one Section 184 lender due to HUD’s failure to resolve the system access solution between OLG and FHA. The remaining 37 Section 184 lenders were provisioned and had access to FHA systems managed by FHA system administrators. However, they could not access the HUD Web Access Security Subsystem (WASS), which provides HUD business partners with application-level authentication capability and would allow for their access to ONAP-LOS. The issue has remained unresolved for at least the past 8 months and will require coordination among HUD OCIO, FHA, and ONAP to resolve it. HUD OCIO requires that all new systems use the WASS framework, including ONAP-LOS. OLG requested that FHA system administrators work with ONAP-LOS administrators to transfer lender identification roles and attributes to WASS to use their current identification numbers and create login accounts for the lenders to access ONAP-LOS. The ONAP-LOS system was developed without a comprehensive access requirements and IT environment risk assessment. Therefore, OCIO had developed a solution with some risk mitigation, but it had not been approved by FHA due to test results identifying increased risk to business processes and potential exposure of sensitive data. This critical issue must be resolved by HUD to reach the full operational capability of ONAP-LOS and standardize Section 184 loan processing. In addition, ONAP-LOS requires interconnection dependency with CHUMS because of the two methods of processing Section 184 program cases and CHUMS capabilities that ONAP-LOS lacks. Data synchronization and data conversion must exist between the two systems. Data are transferred from ONAP-LOS to CHUMS daily to maintain data synchronization. This type of data was minimal at the time of our review because ONAP-LOS hosted only one lender. The data synchronization demand will increase with additional lender use. Data conversion from CHUMS to ONAP-LOS also occurs, which is complicated because the model formats are significantly different. We have concerns regarding OLG’s lack of expertise to properly and 5 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 consistently transfer data from CHUMS to ONAP-LOS. Data conversion from CHUMS to ONAP-LOS is difficult but may become a critical challenge when HUD attempts to migrate from CHUMS because of the data conversion mapping challenges between the two systems. OLG was attempting to address this challenge by having the ONAP-LOS vendor use the Informatica web server tool3 for data migration. However, 30,000 paper case files will not be transitioned into electronic form in ONAP-LOS. CHUMS also provides the one-way transfer of loan financial data to the Oracle Federal Financial systems, a capability that ONAP-LOS lacks. ONAP-LOS also lacks key reporting capabilities. While the legacy CHUMS has the ability to produce 22 standard reports for management and oversight for critical Section 184 processes, ONAP-LOS can produce only one accurate management report and one untested report. According to OLG employees, CHUMS could provide approximately 94 percent of requested management reports, while ONAP-LOS is capable of providing approximately 25 percent of needed informational and management reports. Report production is a key area in which ONAP- LOS has been dependent on the legacy CHUMS. Additionally, no capability exists to develop and receive timely ad hoc requested reports, as they need to be planned, budgeted for, and developed by the development project team. Six reports had been identified by the ONAP-LOS project team to be added, but no timeline had been established for development. ONAP-LOS lacks other key capabilities for servicing and processing Section 184 claims. ONAP-LOS ensures that lenders enter a standardized format of loan application data and receive correct case numbers. However, the system lacks the capability to track and evaluate the performance of lenders and loans, such as loan delinquency. This servicing function is a manually maintained process using Excel spreadsheets. Discussions had occurred within HUD OLG to add the servicing function to ONAP-LOS, but this function had not been implemented, and no timeline has been established to do so. In addition, ONAP-LOS is not able to process and distribute claim payments. All claims were paid outside ONAP-LOS and CHUMS, using the U.S. Department of the Treasury’s Administrative Resource Center system, while OLG tracked transactions manually in a locally stored database. The lack of automated controls introduced vulnerabilities into the Section 184 program. HUD recognized these capability gaps and told us that it would address them with future updates to ONAP-LOS. However, HUD OCIO’s March 2018 project health assessment4 of the ONAP- LOS project rated it as an overall medium risk due to a lack of project plan milestones and requirements (lender access) being identified as high risk and moderately high risk, respectively. Within the 10 categories that the assessment reviews, one category was rated as high risk, three were rated as moderately high risk, and the other six were rated as less than medium risk. HUD’s internal risk assessment included 25 recommendations to improve management and oversight of the Section 184 ONAP-LOS. OLG had not formulated a project plan with 3 Informatica is a commercial-off-the-shelf tool and service that offers data integration products. 4 HUD OCIO conducted an ONAP-LOS project health assessment on March 20, 2018, which provided a summary of risks related to stakeholder management (moderately low risk), risk management (moderately high risk), scope management (medium risk), schedule management (moderately high risk), cost management (low risk), acquisition and contracts management (low risk), quality management (medium risk), human resource management (medium risk), requirements management (moderately high risk), and project planning and management compliance (high risk). HUD OCIO refers to these 10 areas as “10 critical success factors.” 6 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 milestones to address the 25 recommendations and correct the ONAP-LOS capability gaps discussed above. ONAP-LOS Contract and Costs A contract was awarded in 2016 to a vendor that developed, operated, and maintained ONAP- LOS. The contract was provisioned at $4 million, with a $3 million base year to fund the initial development and implementation. OLG provided $1 million of the funding, while HUD OCIO funded the remaining amount, including future-year operations and maintenance. The annual operations and maintenance costs were reported to be $903,000 and were added to the OCIO budget. Additional unspecified Microsoft Azure cloud hosting costs were also funded by OCIO. A concern expressed to us by OLG staff was that ONAP-LOS had a high cost with only a few capabilities and had not resolved the original IT system limitations. A new contract is planned to be competed and awarded around September 2018 for ongoing development, operations, and maintenance. This potential vendor change presented an additional obstacle for ONAP-LOS if a contract transition was required between an old and new vendor. Recommendations For HUD and OLG to gain sufficient oversight of the Section 184 program, HUD should continue to develop ONAP-LOS and associated IT procedures. HUD developed ONAP-LOS as a modernized application in a cloud environment, but development and deployment had not been fully successful. HUD should consider the following recommendations to continue the progress of ONAP-LOS to enable proper management and oversight of the Section 184 program. We recommend that the Deputy Secretary: 1. Direct PIH and OCIO to develop a comprehensive project plan, documenting the milestones and dates for addressing the gaps in ONAP-LOS capabilities (functionality and reports) and the 25 recommendations made during HUD OCIO’s project health assessment. 2. Direct all stakeholders to identify all viable options to securely resolve the ONAP-LOS access issues, so authorized Section 184 lenders can access the system. The best solution should not impose unacceptable risk to business processes or sensitive data. Current program offices involved are OCIO, PIH, and FHA, while others may also be identified. 3. Direct PIH and OCIO to ensure that the Section 184 program transitions away from dependency on CHUMS. 7 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 We recommend that OCIO: 4. Continue to develop required ONAP-LOS capabilities using cloud environments as appropriate. We recommend ONAP: 5. Coordinate and participate in resolving all open recommendations from evaluation report IT System Management and Oversight of the Section 184 Program (2018-OE-0004). 8 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 Agency Comments and OIG Response Summary of ONAP’s Comments ONAP requested that the original four recommendations in our draft report be reworded to include and direct all the the stakeholders that have responsibility to develop and maintain IT system oversight of the Section 184 program. ONAP felt they and OLG had little control over the ONAP-LOS project team and requested that OIG issue the recommendation to everyone involved. ONAP did not concur with the recommendations as they were worded. OIG Response to ONAP’s Comments Based on ONAP’s response, we agree that all stakeholders involved in the development and maintaining of ONAP-LOS be involved in the recommendation resolution. Therefore, we changed the language of all four original recommendations to make it clear that the other program offices that are listed in the recommendations be added. In addition, we created a fifth recommendation, directed to ONAP, that recommends ONAP coordinate and participate in the the management decisions and resolution of the previous four recommendations in this report. Following this recommendation language rewording, ONAP concurred with the recommendations. Summary of Other Program Office Comments Single Family Housing, for FHA, provided an informal response to OIG via email requesting language changes to recommendation 2. Based on their response, OIG reworded the recommendation to include language for the ONAP-LOS access issue solution to require coordination with all HUD stakeholders and to not have unacceptable risk to HUD business processes or sensitive HUD data. The Deputy Secretary’s Office or OCIO, did not provide written comments. The comments received from ONAP was the combined response from ONAP and PIH. 9 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 ONAP Comments to the Draft Report 10 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 11 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 12 HUD OIG Report Section 184 IT System Oversight and Management August 13, 2018 Appendix A – Acronyms ACRONYM DEFINITION CHUMS Computerized Homes Underwriting Management System FHA Federal Housing Administration HUD U.S. Department of Housing and Urban Development IT Information Technology OCIO Office of the Chief Information Officer OLG Office of Loan Gaurantee ONAP Office of Native Americal Programs ONAP-LOS Office of Native American Programs - Loan Origination System PIH Office of Public and Indian Housing 13 The Office of Inspector General is an independent and objective oversight agency within the U.S. Department of Housing and Urban Development. We conduct and supervise audits, evaluations, and investigations relating to the Department’s programs and operations. Our mission is to promote economy, efficiency, and effectiveness in these programs, while preventing and detecting fraud, abuse, and mismanagement. Report fraud, waste, and mismanagement in HUD programs and operations by Completing this online form: https://www.hudoig.gov/report-fraud Emailing the OIG hotline: email@example.com Faxing the OIG hotline: (202) 708-4829 Sending written information to U.S. Department of Housing and Urban Development Office of Inspector General Hotline (GFI) 451 7th Street SW, Room 8254 Washington, DC 20410 Whistleblowers are protected by law. https://www.hudoig.gov/fraud-prevention/whistleblower-protection Website https://www.hudoig.gov/ Information Technology Evaluations Division 4
HUD IT System Management and Oversight of the Section 184 Program
Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-08-13.
Below is a raw (and likely hideous) rendition of the original report. (PDF)