Develop a secure platform for the collection and storage of PIIA data that contain PII and formally assign a staff with adequate training and skillsets to administer the data and application (including maintaining and managing access controls of a chosen application that will be used to store the PIIA data with PII).

Reevaluate the methodology and reassess the weight assigned to each risk factor to ensure that appropriate weight is given to risks associated with non-Federal administrators or consider doing one risk assessment for HUD’s internal payment cycle and another risk assessment for the non-Federal entities that administer HUD’s program funds.

Until program-specific fraud risk assessments are completed, revise the PIIA fraud risk questionnaire process to compensate for the lack of program-specific fraud risk assessments.

Reassess the Homeless Assistance Grants program as part of the fiscal year 2023 risk assessment.

We recommend that the Director for HUD’s Office of Disaster Recovery require grantees to support or repay to its program $2,551,375, from nonfederal funds, for the 9 vouchers that did not have adequate supporting documentation for expenditures.

We recommend that the Director for HUD’s Office of Disaster Recovery work with its grantee to resolve or correct program income balances for the three grants that had program income balances outstanding.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that program income balance discrepancies are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that untimely FFRs are identified and corrected.

We recommend that the Director for HUD’s Office of Disaster Recovery establish a mechanism to train grantees and HUD staff on existing guidance regarding supporting documentation for expenditures, FFRs, and program income balances on a recurring basis. Additionally, provide guidance and establish recurring training for HUD staff to monitor grantees for program income and submission of the FFRs..

We recommend that the Director for HUD’s Office of Disaster Recovery implement quality control procedures to ensure that HUD staff completes the action plan and QPR checklists.

We recommend that the Director for HUD’s Office of Disaster Recovery develop and implement controls to ensure that grantees’ policies and procedures related to program income are adequate.

We recommend that the Director for HUD’s Office of Disaster Recovery provide training to grantees regarding the reporting, tracking, and expenditure of program income.

Provide technical assistance to the State and the staff to ensure that they understand the requirements for conducting a monitoring review in accordance with regulations.

Instruct the State to update and implement the CDBG-DR standard operating procedures, which clearly outline what activities, including the frequency, will be reviewed by its monitoring and internal audit function.

Instruct the State to conduct monitoring reviews of its CDBG-DR HIM activities and subrecipients that satisfy monitoring requirements.

Work with the State to develop and implement policies and procedures to ensure that monitoring is conducted remotely in the event that it cannot be conducted onsite.

Instruct the State to update and implement policies and procedures to ensure that the results of the CDBG-DR internal audits are shared by the State’s Commissioner with CDBG-DR program staff to allow for the resolution of any findings and required corrective actions.

Monitor the State’s CDBG-DR program to ensure that performance expectations are achieved.

Complete and update the system security plans for GMP and DRGR and issue an SSN justification memorandum.

Identify and provide additional role-based training, guidance, and instructions to CPD employees on how to appropriately handle and safeguard PII encountered during monitoring.