Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

Develop and document internal procedures to ensure that they will address the Program Office’s responsibilities within the departmental grant accrual validation policy.

Re-evaluate and adequately document justification for the establishment of the percentages and other key assumptions used to determine the accrual amount for each program in CPD’s accrued grant liabilities estimate.

Implement written procedures to ensure consistency among field offices in reviewing spending issues, potentially preventing up to an estimated $47 million in annual CoC recaptures.

Design and implement a training program and other development tools to help grantees. The goal of such training would be to provide ideas and other development tools to help the CoCs better provide assistance with implementation of their grants and monitoring of their grantees, including assistance with developing outreach strategies, partnering with community providers, financial budgeting, and best practices. The training should focus on the needs of first-year grantees and CPD should take steps to encourage participation.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to a. quantify and aggregate security risks, b. normalize cybersecurity risk information across organizational units, and c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

HUD OCIO should ensure that system owners and information system security officers consistently test their ISCPs and upload the test results to CSAM in accordance with HUD’s defined ISCP testing policy (derived from metric 63).

Use the fraud risk inventory to enhance program-specific fraud risk assessments for the HOME program.

Consider allowing grantees additional time to spend the program funding on eligible activities to meet the 80 percent spending deadline.

Consider streamlining program requirements to help grantees promptly use program funds to assist those impacted by the pandemic or for activities that prepare for, prevent, or respond to the coronavirus.

Provide adequate documentation to support that the $2,588,362 in CDBG-DR funds for three unsupported project and program management services expenditures cited in this report was spent for supported, necessary, and reasonable costs. Any amount for which adequate support cannot be provided should be repaid from non-Federal funds.

Update its procurement policy to clearly define the process, which includes timing and the procurement types, for conducting an independent cost estimate and a price analysis.

Provide training to State staff to ensure that it understands and follows (1) requirements to maintain adequate documentation to support that program disbursements are eligible and reasonable and (2) procurement requirements, including independent cost estimates, cost analyses, proposal scoring, and the timely checking of the SAM data for contractors’ eligibility.

Consider grant recipients’ feedback on challenges with (1) capacity, (2) multiple other sources of funding, and (3) subrecipient monitoring as part of CPD’s risk assessments.

Collaborate with the Deputy Chief Financial Officer to work with grantees in identifying where improper and unknown payments could occur in the CPD-HIM program throughout the payment cycle, to include the risks associated with subgrantee billing, and document this analysis.

Collaborate with the Deputy Chief Financial Officer and use the analysis developed in 3A to ensure that HUD’s improper and unknown payment testing procedures are (1) designed to test the full payment cycle and (2) include the review of documentation that supports that final beneficiaries were eligible, goods and services were received, and payments went to the correct final beneficiaries and were for the correct amount.

Work with the Office of Community Planning and Development’s Chief Risk Officer and grantees to better identify the risks of improper and unknown payments throughout the payment cycle, to include the risks associated with grantees and subgrantees, and consider these risks when performing the CDBG and Homeless Assistance Grant risk assessments.