Determine the appropriate timeframe for when initial management and occupancy reviews (MORs) should be completed for all properties that convert under the Rental Assistance Demonstration and issue updated guidance that includes a system to track the timeliness of initial MORs.

Status

Given current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform the initial MOR for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews). Furthermore, the guidance will require that the existing MOR tracking tools (e.g., PowerApps) be used to monitor planning for the MORs and progress throughout, until final closing of the review. As of July 2025, HUD has completed 233 MORs for the 834 RAD-converted properties. The tool allows HUD staff to filter by the type of conversion (e.g. RAD PIH, RAD PRAC, etc.) as well as other risk indicators (e.g., troubled status), location and servicer (e.g. Account Executive, Senior Account Executive, Resolution Specialist). OIG has concurred with HUD's corrective action plan that it will create guidance to allow for a risk-based approach for completing MORs, which HUD anticipates completing by September 30, 2025.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has updated guidance with appropriate timeframe for conducting MORs and a system to track the timeliness of initial MORs. Failure to determine the timing of the initial MORs could delay HUD's performance of them, which may result in property owners' untimely corrective actions, and thus potentially impact the health and safety of families.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Complete the initial management and occupancy reviews (MORs) for the Rental Assistance Demonstration properties that have not had an initial MOR.

Status

Given current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform the initial MOR for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews). The guidance will outline the timing requirements for when the initial MOR should be completed. To date, HUD staff have completed 233 MORs for the 834 RAD-converted properties. HUD anticipates completing the initial MORs for the remaining 501 properties by the end of 2027. HUD HQ and field staff will use the Power BI MOR tool to track the MOR through the stages: scheduling, review, issuance of report and finally the closing of the report. As of July 2025, OIG has concurred with HUD's corrective action plan that HUD will begin completing the initial MORs using a risk-based approach. The target completion date for HUD to demonstrate it is taking corrective action is set for December 31, 2025.

Analysis

Completing initial MORs would assist HUD in holding property owners accountable for maintaining the conditions of their properties and sufficient reserve for replacement accounts balances, which could impact property owners' ability to make needed capital repairs.

The recommended corrective action has the potential to directly impact the health and safety of families.

Develop and implement a plan to determine how to implement the risk-based approach to review the Rental Assistance Demonstration properties that have not had subsequent management and occupancy reviews (MORs) in more than 3 years and to require periodic MORs going forward.

Status

Given the current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform MORs using a risk-based model for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews) and the timing requirements for when ongoing MORs should be scheduled once the initial MOR is completed. As of July 2025, 641 MORs need to be scheduled for the Office of Asset Management's portfolio of 834 RAD-converted properties. Of those, 85 properties are managed by Performance-Based Contract Administrators (PBCA). Depending on risk indicators for each property, MORs will be scheduled accordingly. HUD reported that its staff resources are limited in comparison to the PBCAs and will therefore take a risk-based approach for prioritizing the MORs that HUD staff must complete. The Office of Asset Management will develop a plan to address the backlog of RAD-converted MORs using the current risk factors which include the physical condition, last MOR score, financial health of the property and other indicators. The target completion date is December 31, 2025.

Analysis

Developing a plan to implement the risk-based approach would establish the criteria for identifying properties that are at a higher risk of noncompliance.

The recommended corrective action would help HUD to monitor property owners' compliance with its requirements and thus, potentially protect families from living in unsafe units.

Determine an appropriate timeframe in which non-FHA-insured Project-Based Rental Assistance (PBRA) properties converted under the Rental Assistance Demonstration should be initially inspected, work with HUD’s Real Estate Assessment Center (REAC) to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Status

As of July 2025, Multifamily Housing planned to develop and implement adequate policies, procedures, and controls to ensure non-FHA insured PBRA properties under RAD are inspected within 90 days after the original date of the HAP contract, unless the property has been approved for inspection delay during major rehabilitation, then within 90 days after the end of the approved inspection delay. Further, Multifamily Housing will provide appropriate updated guidance to both internal and external partners relative to non-FHA-insured PBRA properties converted under RAD. The target completion date is September 30, 2025.

Analysis

Determining the appropriate timeframe for initial inspections would result in the timely identification and correction of life-threatening and non-life-threatening deficiencies.

The recommended corrective action has the potential to directly impact the health and safety of families.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner. 

Corrective Action

HUD’s Office of Multifamily Housing created procedures to identify failed inspections and notify the appropriate field office that a property in their portfolio had recently failed inspection. The procedures included a timeline for issuing a Notice of Violation/Notice of Default to the owner of the property. Implementation of the recommendation ensures that multifamily property owners are notified of deficiencies in a timely manner to take corrective actions.

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Corrective Action

HUD’s Office of Multifamily Housing updated the language in the template document to be used in future notices of violation and default, clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project. Specifically, HUD notified all Asset Management Division Directors informing them of the updates to the templates and instructed them to use the templates. The implementation of this recommendation has the potential to positively and directly impact the health and safety of families.

Develop a control to detect loans that did not maintain the required flood insurance to put $1.5 billion to better use by avoiding potential future costs to the FHA insurance fund from inadequately insured properties.

Corrective Action Taken

In November 2022, FHA published the Acceptance of Private Flood Insurance for FHA-Insured Mortgages final rule (Docket No. FR-6084-F-02) in the Federal Register and issued Mortgagee Letter 2022-18, Acceptance of Private Flood Insurance for FHA-Insured Mortgages (ML 2022-18). These policy changes not only strengthened Single Family’s Mortgagee requirements regarding flood insurance, but they also introduced the ability for borrowers and Mortgagees to purchase private flood insurance. In January 2023, the sections in ML 2022-18 that pertain to HUD’s forward mortgage programs were superseded by the FHA Single Family Housing Policy Handbook (Handbook 4000.1), adding a requirement that the Mortgagee review all FHA-insured properties annually to determine if the property is located within a Special Flood Hazard Area (SFHA). For properties located within a SFHA, the Mortgagee must ensure flood insurance is in force for the life of the mortgage and that the property has sufficient flood insurance coverage. To ensure compliance with the policy requirements, the Mortgagee must include updated flood insurance information for properties where flood insurance is required in the Servicing and Claims File. In addition, Handbook 4000.1 includes flood insurance servicing policy updates. HUD submitted a revised management decision reflecting this action on June 22, 2023.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations. 

Corrective Action

HUD finalized its Supply Chain Risk Management (SCRM) policy in April 2025, which utilizes a SCRM questionnaire to assess each vendor’s supply chain risk, and identifies and prioritizes risks accordingly.  HUD’s SCRM program team manages a supply chain risk register which records prior and current vendors, and those that have undergone risk assessments to maintain visibility into its upstream suppliers and track changes over time.  HUD also used multiple tools such as supply chain risk criteria and sourcing research and market analysis to evaluate vendors and strengthen protection of the supply chain during acquisition.  By implementing these procedures, as well as, having HUD’s program management team conducting annual and quarterly performance reviews for all vendors, HUD ensures contractors are meeting their contractual obligations.

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Status

In October 2023, the Office of Multifamily Housing reported that it had sought funding for system enhancements to coordinate tenant complaints. HUD is transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The FHA Resource Center has a system that will allow tracking and monitoring of customer calls. As of July 11, 2025, the Office of Multifamily Housing requested the closure of this recommendation because it did not receive the requested funding from Congress for system enhancements, and it believes there is no prospect of future funding. Further, its alternative action of using the FHA Resource Center to track and monitor customer calls did not work. Developing a comprehensive process for intaking, monitoring, and tracking health and safety complaints would require a system enhancement or creation of a new system, and HUD has repeatedly attempted to obtain funding from Congress to no avail. OIG is in the process of collaborating with HUD on finding a potential corrective action to resolve the recommendation.

Analysis

To fully address this recommendation, HUD needs to develop a comprehensive process to ensure that complaints received by HUD are resolved in a timely manner.

Implementation of this recommendation will result in a timelier resolution of complaints submitted by those living in multifamily member housing units.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

In October 2023, HUD stated that it will develop policies and procedures for Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives. The Office of Multifamily Housing has not yet updated its policies and procedures. With no comprehensive, automated, real-time system in place, there was no direction to give the field staff, Multifamily Clearinghouse, or the Performance Based Contract Administrators other than what they were already doing. HUD was in the process of developing an automated monitoring system in the FHA resource center to allow tracking of individual calls and the call’s subject, such as health and safety. HUD missed the final action target date of December 31, 2022, and a new completion goal was set for February 2025. As of July 14, 2025, HUD is seeking closure for this recommendation due to unavailability of funds. HUD stated that its issuance of policies and procedures for a comprehensive process was contingent on the development of a tracking system for the complaint process, for which it has repeatedly requested funding from Congress to no avail. OIG is in the process of collaborating with HUD on finding a potential corrective action to resolve outstanding concerns.

Analysis

To fully address this recommendation, HUD must provide evidence that it has developed and implemented policies and procedures for the Multifamily properties for the intake, monitoring, and tracking of health and safety complaints it receives when using the FHA’s automated monitoring system.

Implementation of this recommendation will result in HUD having a more efficient process for taking in, monitoring, and tracking health and safety complaints and aid HUD in more efficiently addressing those complaints.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

HUD previously reported that it was implementing a software management tool with an expected implementation date of quarter 2 of FY 2025; however, between quarter 2 and 3 of FY 2025, HUD personnel has stated that the tool would not meet the agency’s needs. Accordingly, HUD is looking at a new tool to implement this program and collaborating with the DHS continuous diagnostics and monitoring team to analyze options. HUD has not provided an estimated completion date.

Analysis

To fully address this recommendation, HUD must provide evidence that it has an automated whitelist and that the whitelist is implemented per the NIST Special Publication 800-167 or otherwise accept the risk of not controlling access to its network and document mitigating measures via a Risk-Based Decision memorandum.

HUD has defined a requirement in HUD Handbook 3257.1, Rev. 3, “Software License Management Policy” for the Configuration Control Management Board and Technical Review Committee to be responsible for maintaining the list of allowed and prohibited software. However, a tool to enforce this list is required to implement the recommendation.

The implementation of this recommendation will result in HUD having the capability to ensure only authorized software is used on HUD’s network based on its approved software asset listing.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide. HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool. This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.

Analysis

To fully address the recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Nonprivileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprise-wide. HUD is in the process of conducting baseline surveys for all 200+ systems to determine how to handle systems that need architectural adjustments to utilize the tool. This is assisting HUD in developing an agency-wide implementation plan, which is expected to take several years to implement.

Analysis

To fully address this recommendation, HUD must implement multifactor authentication enterprise-wide.

Implementation of this recommendation will result in an enterprise-wide identity and access management solution. Privileged users will be required to use multifactor authentication methods to access HUD data, networks, and devices.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes including, but not limited to one of the options OIG provided, which were (1) lenders obtaining the borrowers' consent to obtain their tax records directly from the IRS or (2) borrowers accessing their own tax information and submitting it to the lenders.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

Analysis

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes including, but not limited to one of the options OIG provided, which were (1) lenders obtaining the borrowers' consent to obtain their tax records directly from the IRS or (2) borrowers accessing their own tax information and submitting it to the lenders.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

In April 2024, HUD OIG met with HUD OCIO to discuss progress and requirements for closure of this recommendation. In addition, OIG reviewed this recommendation as part of the annual FY 2024 FISMA evaluation in April 2024 and learned from HUD OCIO that that there would be a procedure update that would implement the ingestion and monitoring of all inbound and outbound traffic. The OIG requested to be provided with these procedures when finalized and evidence of implementation on May 1, 2024.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Status

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes including, but not limited to one of the options OIG provided, which were (1) lenders obtaining the borrowers' consent to obtain their tax records directly from the IRS or (2) borrowers accessing their own tax information and submitting it to the lenders.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

Analysis

To fully address this recommendation, HUD will need to provide evidence that it established a method of borrower consent to verify the existence of delinquent federal taxes including, but not limited to one of the options OIG provided, which were (1) lenders obtaining the borrowers' consent to obtain their tax records directly from the IRS or (2) borrowers accessing their own tax information and submitting it to the lenders.

Implementation of this rule should result in HUD putting $6.1 billion to better use.

Implement a change to regulations at 24 CFR Part 203 to require curtailment of preforeclosure interest and other costs that are caused by lender servicing delays, resulting in $413,513,975 in funds to be put to better use. This should include updating or seeking statutory authority to update HUD’s regulations as necessary and coordinating with HUD’s Office of Finance and Budget, well before any changes go through departmental clearance, to ensure that planned curtailment requirements can be consistently enforced through the claims process.

Status

FHA reported that the audit recommendation cannot be closed without the publication of the FHA Maximum Claim Rule. The proposed changes have been on HUD’s regulatory agenda since Spring 2020 but, as of July 2025, the Office of Single Family Housing does not have an estimated publication date.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published and adopted the rule.

Implementation of this rule should result in HUD putting $413 million to better use.

Develop a method for using the Do Not Pay portal during the underwriting process to identify delinquent child support and delinquent Federal debt to prevent future FHA loans to ineligible borrowers to put $1.9 billion to better use.

Status

The Office of Housing has approved prioritization of funding for Integration between the Treasury’s Do Not Pay portal and HUD’s Computerized Homes Underwriting Reporting System (CHUMS). Funding was allocated to the CHUMS IT contractor on January 26, 2024, to integrate Treasury’s Do Not Pay system with CHUMS, and the IT development project was kicked off the week of February 5, 2024. As of July 2025, the CHUMS Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) with DNP is fully signed. However, the System of Records Notice (SORN) is under review with OMB. HUD's Office of Privacy is in the process of reaching out to OMB to request comments or permission to publish. The anticipated completion date of the CHUMS interface with DNP is December 31, 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has implemented applicant screening against the Do Not Pay portal to identify delinquent child support and delinquent federal debt to prevent future FHA loans from going to ineligible borrowers.

Implementation of this rule should result in HUD putting $1.9 billion to better use.

Enforce the requirement for all HUD web applications and services to be approved by the CIO and ensure OCIO reviews and approves all IT contracts and services agreements dealing with creation or support of web applications or services.

Corrective Action Taken

In January 2023, HUD's Office of the Chief Information Officer developed and released a Web Applications Directive to all HUD program offices. This directive described how web applications are defined, approved, inventoried, and maintained, including processes for tracking, and monitoring such applications.