Perform an assessment of concentration risk and take appropriate action based on the results.

Deobligate the 835 administrative obligations totaling $38,525,836.88 identified for deobligation during the fiscal year 2024 OOR that had not been deobligated as of February 28, 2025.

Revise HUD’s Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD’s Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Revise the Ginnie Mae Confidential Information Policy to state that in the future, (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

HUD’s Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).

HUD’s Office of Administration, in coordination with OCIO, should update and communicate its PII minimization plan. The plan should include detailed procedures to regularly review and remove unnecessary PII collections in accordance with OMB Circular A-130 (IG FISMA metric 35).

We recommend that the Chief Procurement Officer update HUD’s field service manager contract monitoring plan and FSM qualitative monitoring databases used to monitor contractor performance to align with the QASP and contractual requirements as noted in recommendation 1G below.

Update its policy and procedures to define its authority for marketing troubled issuer portfolios and the conditions that must exist to extinguish issuers using rapid relocation.

Update its policy and procedures to define what type of information Ginnie Mae may disclose and how it will handle protected information before extinguishment.

Update its Policies and procedures to define how Ginnie Mae will determine the portfolio value and price before Sale.

Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

Assesses what information Ginnie Mae needs from the MSS to ensure that they have the capacity for a large- or multiple-issuer extinguishment.

Prescribes how the contracting officer representative will review information provided by the MSS and provide actionable feedback to ensure MSS readiness.

Develop and implement an agencywide crisis readiness plan addressing likely hazards arising from a crisis. This guidance should include all key elements that meet CIGFO crisis guidance.

Update and synchronize the SOP and the matching procedure. The updates should include notifications that provide issuers with unmatched loans adequate time to take corrective action to comply with the requirements of the MBS Guide to put $903 million to better use by ensuring that the appropriate agency insurance or guarantee is in place.

Ensure that all necessary information regarding terminated VA loans is included in the matching process.

Ensure that future policies and guidance developed to return HUD’s offices to normal operations include the specific criteria, metrics, and defined geographic area to be used by all offices as applicable.

Develop and implement sufficient policies and controls to ensure that (1) applicable criteria in any future guidance are met and all safety measures are sufficiently completed before returning HUD’s offices to normal operations and (2) sufficient documentation is maintained to support that the applicable criteria were met.

We recommend that HUD’s Chief Administrative Officer implement the corrective actions and internal process improvements in internal control developed as a result of the Chief Financial Officer’s investigation addressed in recommendation 1A.