Issue guidance to RAD property owners clarifying that the owner is responsible to follow both the HUD business documents and the property’s business documents and that the most restrictive document indicates the amount and timing of the annual deposits into the reserve for replacement account.

Develop and implement a process to ensure that the reserve for replacement requirements in HUD’s business documents are consistent for all converted properties.

Develop and implement a plan to review the reserve for replacement accounts for all converted properties from the date on which the account was established to the date of the review. Based on the reviews completed, HUD should take appropriate actions to ensure that reserve for replacement accounts are appropriately funded or determine whether overfunded accounts should have the deposits suspended for a specified period.

Implement adequate procedures and controls to ensure that servicing lenders comply with HUD time requirements in scheduling initial inspections of FHA-insured RAD PBV properties.

Determine an appropriate timeframe in which non-FHA-insured PBRA properties converted under RAD should be initially inspected, work with REAC to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Determining the appropriate timeframe for initial inspections would result in the timely identification and correction of life-threatening and non-life-threatening deficiencies.

The recommended corrective action has the potential to directly impact the health and safety of families.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.