U.S. flag

An official website of the United States government Here’s how you know

The .gov means it’s official.

Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site.

The site is secure.

The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Document
Document

We audited the U.S. Department of Housing and Urban Development’s (HUD) fraud risk management program at the enterprise and program-office levels and assessed its overall maturity.  Our objective was to determine HUD’s progress in implementing a fraud risk management framework at the enterprise and program-office levels that encompasses control activities to prevent, detect, and respond to fraud.

The Antifraud Playbook established by the Chief Financial Officers Council and the U.S. Department of the Treasury assess maturity of an agency’s fraud risk management program in four phases: (1) culture, (2) identifying and assessing fraud, (3) preventing and detecting fraud, and (4) turning insight into action.  We found that in all four phases HUD’s fraud risk management program was in the early stages of development, or at an “ad hoc” maturity level.  HUD’s program is still in its infancy because HUD had not previously dedicated sufficient resources to lead and implement fraud risk management activities. 

Although HUD has recently taken steps to mature its program, HUD needs to commit resources to enhancing antifraud controls and promoting a culture of fraud risk management. Without improvements to its program, HUD may miss opportunities to identify and eliminate fraud vulnerabilities, leaving its funds and reputation at risk.

We recommend that the Chief Risk Officer (1) perform a complete agency-wide fraud risk assessment and develop a plan to improve the maturity of HUD’s fraud risk management program; (2)  communicate to program staff the differences between HUD’s processes for enterprise risk management, Payment Integrity Information Act of 2019, and financial risk management risk assessment and how those processes relate to HUD’s fraud risk management program; (3) develop policies, procedures, and strategies for collecting and analyzing data to identify fraud within HUD’s programs, promote fraud awareness, and develop antifraud risk mitigation tools.  We also recommend that the Chief Financial Officer determine and seek to fulfill an appropriate level of dedicated staff resources to administer HUD’s enterprise and fraud risk management programs effectively and increase fraud risk awareness and strengthen antifraud controls in HUD’s program offices.

Recommendation Status Date Issued Summary
2023-FO-0001-001-A Open October 26, 2022

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.


Status

HUD continues to make progress. CRO update- We have made tremendous progress in advancing HUD’s Fraud Risk Management program. Below is a summary list of activities and impact. Note that in some areas we speak generally of risk management, and it impacts fraud risks as well.

  1. HUD leadership effected its Fraud Risk Policy on March 31, 2022.
    1. Since then, we have integrated fraud risk considerations into risk assessment work completed across HUD, to include processes for FERAs and the annual risk profile refresh.
  2. Leveraging the history of reports issued by HUD oversight partners, we:
    1. Compiled program level oversight reports to identify fraud risk concerns;
    2. Initiated a repository to stratify elements of the reports to isolate fraud risk concerns; and
    3. Isolated trends and themes from the source reports.
    4. This baseline work will support the Department’s Fraud Risk Exposure report, due September 2024.
  3. Established a Fraud Risk Work Group to engage cross-agency representation from program offices and oversight partners to support strengthening HUD’s fraud risk culture. The FRWG will use the trends and themes (from above) to collaborate on training and building awareness of common risk concerns throughout their organizations and across HUD.
  4. HUD’s Risk Management Council hosted its premiere HUD Risk Symposium on Enterprise and Fraud Risk Management, on September 21, 2023 to strengthen cultural awareness and the tone at the top.
    1. Program offices and external oversight partners have committed to participating in the delivery of this immersive effort; sharing how they are using risk information to achieve their mission, updates on risk profile mitigation, and input from oversight partners on how HUD can use their work products to advance the risk culture across the Department.
  5. HUD’s Front End Risk Assessment policy was updated September 2022 to add a Fraud Risk factor, including sub-elements from GAO Fraud Risk Framework.
    1. FERAs from the 2022 and 2023 appropriations were completed with using fraud risk considerations from this updated policy.
  6. Congressional budget appropriators approved HUD to establish the Office of the Chief Risk Officer. Organizational realignment is underway, with HUD dedicating FTEs to focus on Enterprise and Fraud Risk Management.
  7. HUD continues to elevate fraud risks, along with other federal agencies, during Fraud Risk Month of November.
  8. CRO was added to HUD’s Insider Threat Team, to support mitigation of HUD’s risk exposures.
  9. CRO is engaging Risk integration partners, from budget, strategic planning, information technology, and workforce management, to support use of risk information in critical decision-making processes across the Department.
  10. CRO is supporting the Program Office Risk Officers with establishing risk programs within the Program Offices to draw more direct attention to their risk management activities.

Analysis

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy and that each HUD program office has established office-specific risk programs.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

2023-FO-0001-001-B Open October 26, 2022 Develop and implement a procedure to collect and analyze reported suspected instances of fraud, along with other relevant data points, that can be leveraged to develop more robust antifraud risk mitigation tools.
2023-FO-0001-001-C Open October 26, 2022 Communicate to HUD program staff the differences between HUD’s enterprise risk management, PIIA, and financial risk management risk assessment processes to ensure an understanding of their roles and responsibilities within HUD’s fraud risk management program.
2023-FO-0001-001-D Open October 26, 2022 Develop and implement activities to raise awareness of fraud, such as participating in organized antifraud conferences or a newsletter that includes instances of recent fraud in Federal programs.
2023-FO-0001-001-E Open October 26, 2022 Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.
2023-FO-0001-001-F Open October 26, 2022 Collaborate with the Chief Risk Officer to conduct a workforce assessment to determine the level of dedicated full-time staff resources needed by the Chief Risk Officer to effectively (1) administer HUD’s enterprise and fraud risk management programs and (2) support program risk officers by increasing employee and stakeholder awareness of potential fraud schemes that could impact each program respectively.
2023-FO-0001-001-G Open October 26, 2022 If the workforce assessment determines that additional staff are needed, work with the Chief Risk Officer to staff the necessary positions.