Determine the appropriate timeframe for when initial MORs should be completed for all properties that convert under RAD and issue updated guidance that includes a system to track the timeliness of initial MORs.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Failure to determine the timing of the initial MORs could delay HUD's performance of the MORs, which may result in property owners' untimely corrective actions, and thus potentially impact the health and safety of families.

The implementation of this recommendation has the potential to directly impact the health and safety of families.

Complete the initial MORs for RAD properties that have not had an initial MOR.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Completing initial MORs would assist HUD in holding property owners accountable for maintaining the conditions of their properties and sufficient reserve for replacement accounts balances, which could impact property owners' ability to make needed capital repairs.

The recommended corrective action has the potential to directly impact the health and safety of families.

Develop and implement a plan to determine how to implement the risk-based approach to review the RAD properties that have not had subsequent MORs in more than 3 years and to require periodic MORs going forward.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Developing a plan to implement the risk-based approach would establish the criteria for identifying properties that are at a higher risk of noncompliance.

The recommended corrective action would help HUD to monitor property owners' compliance with its requirements and thus, potentially protect families from living in unsafe units.

Provide training to field staff members to ensure that they have the skills necessary to complete MORs of converted properties.

Review the reserve for replacement account balances for the 13 properties (11 underfunded and 2 overfunded) to determine whether the balances are maintained in accordance with the applicable HUD requirements and executed HUD business documents and require owners to fully fund any underfunded reserves and determine whether any overfunded accounts should have the deposits suspended for a specified period.

Review the HUD business documents, such as the RAD conversion commitment, HAP contract, and regulatory agreement, for the four properties that did not contain consistent reserve for replacement information and update the documents to be consistent as appropriate.

Issue guidance to RAD property owners clarifying that the owner is responsible to follow both the HUD business documents and the property’s business documents and that the most restrictive document indicates the amount and timing of the annual deposits into the reserve for replacement account.

Develop and implement a process to ensure that the reserve for replacement requirements in HUD’s business documents are consistent for all converted properties.

Develop and implement a plan to review the reserve for replacement accounts for all converted properties from the date on which the account was established to the date of the review. Based on the reviews completed, HUD should take appropriate actions to ensure that reserve for replacement accounts are appropriately funded or determine whether overfunded accounts should have the deposits suspended for a specified period.

Implement adequate procedures and controls to ensure that servicing lenders comply with HUD time requirements in scheduling initial inspections of FHA-insured RAD PBV properties.

Determine an appropriate timeframe in which non-FHA-insured PBRA properties converted under RAD should be initially inspected, work with REAC to ensure that inspections are ordered and completed within that timeframe, and update HUD’s publicly available and internal guidance to ensure consistent messaging in accordance with HUD’s determination.

Status

HUD has not provided a draft plan for corrective action yet.

Analysis

Determining the appropriate timeframe for initial inspections would result in the timely identification and correction of life-threatening and non-life-threatening deficiencies.

The recommended corrective action has the potential to directly impact the health and safety of families.

Revise HUD’s Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD’s Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

Review whether potential violations of the Antideficiency Act took place because of implementing or enforcing any nondisclosure policies, forms, or agreements that do not include the anti-gag provision as required by law. If it is determined that a violation occurred, the Chief Financial Officer should take disciplinary actions as appropriate and report the identified violations to the oversight authorities, including the HUD Secretary, the President, the Office of Management and Budget, Congress, and the Comptroller General.

HUD’s Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.