Update HUD Handbook 1900.40, Do Not Pay policy, to clearly define the responsibilities for all parties and align it with current laws, processes, and procedures. This should include defining responsibilities for preaward and prepayment verification, and developing a process and governance structure to ensure that preaward and prepayment verification are consistently performed across HUD’s programs.

Status

HUD has until August 25, 2025, to provide its corrective action plan to OIG for review.

Analysis

Updating the HUD Handbook 1900.40 will define responsible parties for ensuring compliance with the Do Not Pay Initiative (DNP).    

The implementation of this recommendation will result in consistent use of DNP, allowing for instant verification of eligibility across the billions in payments that HUD processes, resulting in the reduction of future improper payments.

Determine the appropriate timeframe for when initial MORs should be completed for all properties that convert under RAD and issue updated guidance that includes a system to track the timeliness of initial MORs.

Status

Given current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform the initial MOR for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews). Furthermore, the guidance will require that the existing MOR tracking tools (e.g., PowerApps) be used to monitor planning for the MORs and progress throughout, until final closing of the review. As of July 2025, HUD has completed 233 MORs for the 834 RAD-converted properties. The tool allows HUD staff to filter by the type of conversion (e.g. RAD PIH, RAD PRAC, etc.) as well as other risk indicators (e.g., troubled status), location and servicer (e.g. Account Executive, Senior Account Executive, Resolution Specialist). OIG has concurred with HUD's corrective action plan that it will create guidance to allow for a risk-based approach for completing MORs, which HUD anticipates completing by September 30, 2025.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has updated guidance with appropriate timeframe for conducting MORs and a system to track the timeliness of initial MORs.  Failure to determine the timing of the initial MORs could delay HUD's performance of them, which may result in property owners' untimely corrective actions, and thus potentially impact the health and safety of families.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Complete the initial MORs for RAD properties that have not had an initial MOR.

Status

Given current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform the initial MOR for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews). The guidance will outline the timing requirements for when the initial MOR should be completed.  To date, HUD staff have completed 233 MORs for the 834 RAD-converted properties.  HUD anticipates completing the initial MORs for the remaining 501 properties by the end of 2027. HUD HQ and field staff will use the Power BI MOR tool to track the MOR through the stages: scheduling, review, issuance of report and finally the closing of the report.   As of July 2025, OIG has concurred with HUD's corrective action plan that HUD will begin completing the initial MORs using a risk-based approach.  The target completion date for HUD to demonstrate it is taking corrective action is set for December 31, 2025.

Analysis

Completing initial MORs would assist HUD in holding property owners accountable for maintaining the conditions of their properties and sufficient reserve for replacement accounts balances, which could impact property owners' ability to make needed capital repairs.

The recommended corrective action has the potential to directly impact the health and safety of families.

Develop and implement a plan to determine how to implement the risk-based approach to review the RAD properties that have not had subsequent MORs in more than 3 years and to require periodic MORs going forward.

Status

Given the current resource constraints, HUD will create guidance based on risk-based Management and Occupancy Review (MOR) parameters to ensure that field staff and leadership perform MORs using a risk-based model for PBRA RAD-converted properties. This guidance will specify which assessments can be done on-site or remotely (such as desk reviews) and the timing requirements for when ongoing MORs should be scheduled once the initial MOR is completed. As of July 2025, 641 MORs need to be scheduled for the Office of Asset Management's portfolio of 834 RAD-converted properties. Of those, 85 properties are managed by Performance-Based Contract Administrators (PBCA). Depending on risk indicators for each property, MORs will be scheduled accordingly. HUD reported that its staff resources are limited in comparison to the PBCAs and will therefore take a risk-based approach for prioritizing the MORs that HUD staff must complete.  The Office of Asset Management will develop a plan to address the backlog of RAD-converted MORs using the current risk factors which include the physical condition, last MOR score, financial health of the property and other indicators. The target completion date is December 31, 2025.

Analysis

Developing a plan to implement the risk-based approach would establish the criteria for identifying properties that are at a higher risk of noncompliance.  

The recommended corrective action would help HUD to monitor property owners' compliance with its requirements and thus, potentially protect families from living in unsafe units.

Determine an appropriate timeframe in which non-FHA-insured PBRA properties converted under RAD should be initially inspected, work with REAC to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Status

As of July 2025, Multifamily Housing planned to develop and implement adequate policies, procedures, and controls to ensure non-FHA insured PBRA properties under RAD are inspected within 90 days after the original date of the HAP contract, unless the property has been approved for inspection delay during major rehabilitation, then within 90 days after the end of the approved inspection delay. Further, Multifamily Housing will provide appropriate updated guidance to both internal and external partners relative to non-FHA-insured PBRA properties converted under RAD. The target completion date is September 30, 2025.

Analysis

Determining the appropriate timeframe for initial inspections would result in the timely identification and correction of life-threatening and non-life-threatening deficiencies.

The recommended corrective action has the potential to directly impact the health and safety of families.

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD provided a corrective action plan for this recommendation in May 2025. The planned corrective action requires the agency to acquire a data management system, develop cataloging standards, and coordinate with the program offices stated in the recommendation to ensure data is handled in a secure manner. The procurement process has not yet begun, yet in their initial plans, HUD will require vendor support to develop this tool. The estimated completion date of this recommendation is September 2027.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-03 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner.

Status

HUD has implemented a process of sending notifications to the field offices' centralized inboxes when a failed inspection has been released with instructions to issue a Notice of Default or Notice of Violation within 15 days. The field office logs and tracks this task in the Asset Management Processing System (AMPS), including assigning it to an Account Executive. HUD is building a reporting tool to see if the task has been properly entered into iREMS and addresses instances where it has not. However, the construction of this tool has been delayed due to limited staff resources.  As of July 2025, the Office of Multifamily Asset Management and Portfolio Oversight still needed to provide evidence supporting its implementation of the tracking processes.  HUD has not provided an updated target date to complete the agreed upon actions, which had been May 30, 2025.  As of August 14, 2025, HUD closed the recommendation.  OIG is in the process of reviewing the corrective action taken.

Analysis

Implementing procedures and controls for the timely issuing of notices would ensure that property owners are held accountable for correcting life-threatening deficiencies in a timely manner thus reducing the risk of families living in units that are unsafe for longer periods.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.

Status

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives had been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to PBRA, HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024.

However, our ongoing Payment Integrity Information Act audit has determined that neither program produced a compliant estimate in fiscal year 2024. For multifamily-PBRA, HUD made some progress and reported an estimate that captured part of the payment cycle; however, the estimate did not include testing to ensure that housing assistance payments from contract administrators to owners were calculated correctly and supported by tenant-level documentation. The PIH-TBRA program did not produce an estimate at all, noting that IT system modernization must occur first. However, PIH has not yet provided a plan that indicates how the system upgrades will address this issue or a timeline for implementation. As of January 31, 2025, a detailed plan or timeline has not been provided.

Analysis

As of January 31, 2025, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce a complete estimate of the PBRA programs in future years, and when it will be able to produce an estimate for PIH-TBRA.

For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.

PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $50 billion in FY 24, or 62.4 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the Annual Financial Report.

Implementation of this recommendation will result in HUD better-safeguarding taxpayer dollars and decrease improper payments.

HUD (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered into on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation. The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible.

Analysis

To fully address this recommendation, HUD must (a) identify all contracts related to its programs that pre-date July 1, 2013, and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Seek voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation.  The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible.

Analysis

To fully address this recommendation, HUD must provide evidence that it has sought voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Use its best efforts to include a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Status

HUD provided a Management Plan that identifies actions HUD is taking to address the recommendation.  The OIG and HUD have not reached an agreement that the actions proposed will fully address the recommendation. Additionally, HUD has not completed several of the proposed actions and is evaluating what next steps are appropriate and feasible.  In addition, the President's fiscal year 2026 Congressional Budget Justification includes a request for new legal authority to "expeditiously include whistleblower protections of 41 U.S.C. 4712 within all contracts and grants, including outstanding project-based rental assistance contracts, rather than wait until there is a major modification."

Analysis

To fully address this recommendation, HUD must provide evidence that it has taken steps to ensure that it includes a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation. Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Develop and implement a nationwide protocol for field offices, describing how PHA self-inspections should be reviewed, based on REAC's determination of the number and frequency of PHA self-inspections.

Status

HUD closed this recommendation in August 2024, an action which HUD OIG disagrees with. HUD provided guidance for field office staff to send to PHAs with NSPIRE inspections that scored below 60 points. However, HUD did not provide a protocol detailing how it would receive and review PHAs' self-inspections for compliance with HUD requirements. Therefore, HUD has not fully addressed the gap in controls identified in the audit that hinders HUD's oversight over PHA self-inspections. OIG will continue to seek clarification from HUD on the implementation and closure of this recommendation.  However, as of July 2025, HUD has not provided any additional documentation.

Analysis

To fully resolve this recommendation, HUD needs to provide a policy or procedure that provides guidance to the field offices on how public housing self-inspections should be reviewed for compliance with its requirements.

Implementation of this recommendation will result in public housing units that are decent, safe, and sanitary because it mandates oversight to ensure PHAs are addressing identified deficiencies.

Implement adequate policies, procedures, and controls to ensure that public housing properties will be inspected within required timeframes.

Status

As of July 2025, according to HUD, all development and enhancement of the NSPIRE software system are presently on hold pending Administrative guidance on HUD funded software system improvements.  Additionally, the required software changes recommended under this finding depend on the final Public Housing Assessment System (PHAS) rule, but most regulatory work has been paused for review per Executive Order from the Administration.  Pending the required resources and funding approval, HUD cannot move forward at this time.  According to HUD, it has planned for and proposed the needed improvements to meet this recommendation and will provide updates when available.  The current final action target date is September 30, 2025.

Analysis

To fully address this recommendation, HUD must provide evidence demonstrating that it has implemented control activities that ensure public housing properties are inspected within the required timeframes.

Implementation of this recommendation will result in HUD accurately tracking the dates on which public housing properties should be inspected and that they are timely completed.

Due to the uncertainty of when software changes to NSPIRE can take place to enforce the timing of inspections, REAC cannot enforce the requirements of inspection timing.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

As of July 30, 2025, PIH’s Office of Field Operations (OFO) has coordinated with the Office of Lead Hazard Control and Healthy Homes (OLHCHH) on the EBLL data requested and obtained from PHAs.  OFO’s timeline to finish implementing the recommendation:

• Conduct and complete research and comparison by September 30, 2025.  OFO will need to ensure that any EBLL documentation received from PHAs is accurate and accounted for in its EBLL tracked.
• Complete final review and revisions by October 31, 2025.  OFO will need to contact PHAs for any necessary revisions or missing documentation.
• Stakeholder feedback and incorporation of edits by December 31, 2025.  Stakeholders include OFO leadership and PIH’s Real Estate Assessment Center (REAC).
• Final approvals and sign offs by OFO leadership by March 27, 2026.
• Final reporting and closure documentation by March 31, 2026.  OFO will develop guidance and training materials to ensure that OFO field offices are able to properly communicate EBLL guidance to PHAs.

The estimated completion date is March 31, 2026.  The original estimated completion date was June 30, 2024, and was revised to account for (1) delays in responses from various PHAs in providing current and accurate information on EBLLs to OFO and (2) stakeholder input and review from various offices across HUD.

Analysis

To fully address this recommendation, OFO must provide evidence of completion of each step in its timeline, such as research and comparisons conducted and communications with stakeholders in HUD and with PHAs.

Implementation of this recommendation will help ensure that EBLL cases are reported and recorded appropriately in the EBLL tracker.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

On January 17, 2025, the Office of Lead Hazard Control and Healthy Homes (OLHCHH) informed HUD OIG that the Office of the Federal Register published a notice, Modifying HUD’s Elevated Blood Lead Level Threshold for Children Under Age 6 Who Are Living in Certain HUD-Assisted Target Housing Covered by the Lead Safe Housing Rule. The notice announced that HUD is lowering its EBLL threshold from 5 to 3.5 µg/dL for a child under the age of 6, consistent with the CDC’s current blood lead reference value of 3.5 µg/dL, effective January 17, 2025. Next, OLHCHH will assist the Office of Community Planning and Development, the Office of Multifamily Housing Programs, and the Office of Public and Indian Housing to draft, circulate, and publish EBLL notices. The estimated completion date is June 30, 2025.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered blood lead reference value of 3.5 ug/dL.

Implementation of this recommendation will help ensure children living in public housing with elevated blood lead levels receive effective environmental interventions.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

As of July 2025, HUD has cancelled its fraud risk management contracts and the Chief Risk Officer position was vacated under the Deferred Resignation Program.  HUD is currently working to realign its business process and determining how it will address fraud risk management.  While HUD had made progress in improving its fraud risk management program, as of July 2025, HUD has not provided an updated plan on how it will complete an agency-wide fraud risk assessment and undertake office-specific risk programs.  The final action target date was September 30, 2024.

Analysis

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy, and that each HUD program office has established office-specific risk programs.

Require the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

In May 2023, HUD published a final rule establishing a new approach to defining and assessing housing quality: The National Standards for the Physical Inspection of Real Estate (NSPIRE).  Public Housing regulations were amended, and Public Housing program participants were required to comply with this final rule and use the NSPIRE standards starting July 1, 2023.  The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. As of November 2024, PIH reported that inspections have had a slow start due to procurement delays. Additionally, the NSPIRE system did not get the requested functionality to collect lead inspections.   As of July 2025, HUD is conducting an inventory of the properties that are missing lead-based paint inspections.  Once all the inspections have been received and uploaded into the NSPIRE system, it will use the information to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.  Among other factors, based on current legislative requirements of unit inspection cycle, HUD estimates that it will collect the lead-based paint inspection reports for final properties by December 31, 2028.  Therefore, with OIG concurrence, HUD has revised the final action target date to February 2, 2029, to fully implement the recommendation.

Analysis

To address this recommendation, HUD will need to provide evidence that it collected and evaluated data under NSPIRE and estimated the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.

Implementation of this recommendation will assist HUD in working with PHAs to address the public housing units that contain lead-based paint and lead-based paint hazards and help HUD’s oversight of units in need of hazard reduction.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

To address this recommendation, The Office of Lead Hazard Control and Healthy Homes (OLHCHH) agreed to:                                                                                                                    

1. Issue a notice to assisted target housing owners and public housing agencies on the de minimis exception citing the correct application of the de minimis threshold; describing appropriate documentation methods for the application of the de minimis threshold; and recommendations of best practices for documenting applications.
2. Collect additional data regarding the use of the de minimis threshold, including information on how private and public housing owners: (a) determine how much paint in target housing will be disturbed during a maintenance or rehabilitation project; (b) use the paint disturbance area information; (c) monitor the amount of paint disturbed in projects that are designed to disturb de minimis amounts of paint in target housing.
3. Design and conduct webinars, including at least one for each program office’s major categories of stakeholders on requirements and best practices pertaining to the de minimis exception under the Lead Safe Housing Rule and its implementation; record the webinars on the HUD website (e.g., on HUD Exchange) for future viewing by stakeholders; and conduct outreach promoting the webinars. 
The OLHCHH had drafted guidance on the de minimis exception to the Lead Safe Housing Rule for PIH, Multifamily Housing, and CPD and submitted it through the clearance process in September 2024.  As of July 2025, OLHCHH continues to revise the draft guidance in consideration of the comments it received during the clearance review process. HUD did not provide an updated target date to complete the agreed upon actions, which had been January 31, 2024.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has implemented the three actions OLHCHH agreed to complete.
 

Implementation of this recommendation and associated corrective actions will ensure assisted property owners are sufficiently informed regarding the requirements to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule and that assisted property owners are conducting this work safely, thereby ensuring households are residing in safe and healthy HUD-assisted housing.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

In April 2025, during the FY 2025 FISMA evaluation, Office of the Chief Information Officer (OCIO) provided its finalized SCRM Policy, SCRM Procedures, SCRMES Charter, SCRM Technical Roadmap, and agency-specific clauses. While this addressed the requirements for this recommendation by defining its policies and procedures, HUD needs to communicate and post the policies on its internal website.  The OCIO estimated it would complete corrective action for this recommendation by August 2025.

Analysis

Implementation of this recommendation will result in HUD continuing to mature in supply chain risk management, establishing and defining the policies and procedures of SCRM requirements as they relate to systems and system components.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

In November 2024, OCPO submitted an IT Acquisition Workflow Report and a document outlining responsibilities as evidence for closure. Although these documents clarified existing roles and documented one sample workflow, they did not propose or implement revised IT-acquisition policies or procedures producing measurable improvements. As of July 2025, OIG received no further information that identifies improvements in the IT acquisition process.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in defined IT acquisition process workflow procedures to increase efficiency and ensure coordination across program offices.