HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

HUD (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered into on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible.

Analysis

To fully address this recommendation, HUD must (a) identify all contracts related to its programs that pre-date July 1, 2013, and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Seek voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation.  The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible.

Analysis

To fully address this recommendation, HUD must provide evidence that it has sought voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Use its best efforts to include a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible. In addition, the President's fiscal year 2026 Congressional Budget Justification includes a request for new legal authority to "expeditiously include whistleblower protections of 41 U.S.C. 4712 within all contracts and grants, including outstanding project-based rental assistance contracts, rather than wait until there is a major modification."

Analysis

To fully address this recommendation, HUD must provide evidence that it has taken steps to ensure that it includes a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

HUD seek legislative authority to expeditiously include Section 4712 protections within contracts for which HUD believes it must otherwise wait until there is a major modification.

HUD develop and implement controls to ensure that the provisions of Section 4712 are included in all contracts.

Establish an improper payment council within HUD that consists of senior accountable officials from across the Department with a role in the effort that would work to identify risks and challenges to compliance and identify solutions as a collaborative group.

Develop and complete a detailed plan and timeline for completing compliant PIH-TBRA and PBRA program estimates and ensure that the improper payment council prioritizes completion of the plan in time for fiscal year 2023 reporting.

Develop a secure platform for the collection and storage of PIIA data that contain PII and formally assign a staff with adequate training and skillsets to administer the data and application (including maintaining and managing access controls of a chosen application that will be used to store the PIIA data with PII).

Reevaluate the methodology and reassess the weight assigned to each risk factor to ensure that appropriate weight is given to risks associated with non-Federal administrators or consider doing one risk assessment for HUD’s internal payment cycle and another risk assessment for the non-Federal entities that administer HUD’s program funds.

Until program-specific fraud risk assessments are completed, revise the PIIA fraud risk questionnaire process to compensate for the lack of program-specific fraud risk assessments.

Reassess the Homeless Assistance Grants program as part of the fiscal year 2023 risk assessment.

Develop and issue a departmental grant accrual validation policy or update the existing grant accrual policy to include the validation process. The policy should include 1) specific control activities over the grant accrual validation and outline all of the specific roles and responsibilities; 2) a periodic review of the grant accrual validation to evaluate and reassess its continued relevance and control effectiveness, and ensure any changes are designed and implemented appropriately; and 3) a clear communication plan that requires formal and documented communications between appropriate program offices and OCFO to ensure the validation results are used to update the grant accrual methodology and subsequent period’s estimate, as appropriate.

Develop and document internal procedures to ensure the OCFO’s responsibilities specified within the new or updated grant accrual validation policy are addressed.

Develop and implement procedures to ensure that planning for the CPD grant accrual validation is done early in the accounting cycle to allow for: • Sufficient resources to be available to perform the validation of the prior year grant accrual. • Validation efforts to start earlier to allow for follow-up on non-responsive grantees or grantees that provided incomplete information. • Materiality risk to be considered when planning and evaluating the CPD grant accrual validation.

Revise CPD Validation Review Instructions to specify documentation requirements similar to those provided to the grantee and specify verification of dates for when the costs were incurred.

As part of the validation process for CPD’s accrued grant liabilities, review CPD’s accrued grant liabilities estimation methodology to ensure that it is based on verifiable grantee supporting documentation and all assumptions and variables used for the grant accrual estimate were properly established, supported, and documented.

Establish a formal policy addressing HUD’s federal awarding agency responsibilities under 2 CFR § 200.513(c). The policy should identify those involved in the process and their roles in addressing this single audit oversight function. The policy should also address how it will be carried out and documented.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

As of July 2025, HUD cancelled its fraud risk management contracts and the Chief Risk Officer position was vacated under the Deferred Resignation Program. HUD is currently working to realign its business process and determining how it will address fraud risk management. As of January 2026, HUD has not provided an updated plan on how it will address the recommendation. However, HUD reported to HUD OIG that it is currently working on reducing fraud through a Task Force and other new initiatives. The final action target date for this recommendation was September 30, 2024.

Analysis

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy, and that each HUD program office has established office-specific risk programs.