Community Development: Weak Management Controls Compromise Integrity of Four HUD Grant Programs

HUD indicated that it has placed increased emphasis on on-site monitoring through its FY 1999 implementation of its Business Operating Plans (BOP), which establishes a goal of monitoring 300 grantees. This level of on-site monitoring doubles prior year monitoring activities. HUD has actually conducted over 400 on-site visits in FY 1999. In addition, HUD has drafted guidelines which standardize the risk analysis process and specifies the level of risk that warrants intensive monitoring and how on-site monitoring should be conducted.

HUD contracted with the National Academy of Public Administration to demonstrate a resource estimation methodology for estimating human resource needs at the Department. In addition, HUD determined if field offices had adequate resources by analyzing each field office's progress in achieving its fiscal year 1999 monitoring goals. According to HUD, those offices that did not meet their goals have been targeted for additional staff and travel funds.

Desk officers have made 10 visits to field offices during fiscal year 1999 explicitly to examine the capacity of field offices to conduct on-site monitoring. All of the visits focused on the capacity of field offices to carry out their monitoring responsibilities effectively and local concerns about their monitoring capacity. An overall risk rating process was followed by each desk officer in determining which offices to visit. Additionally, a standardized format was developed for the desk officer reviews so that generally consistent information was used for preliminary assessments of each office and final on- site review.

In July 1999 HUD issued the Community Planning and Development Grants Management Process User Guide and training manual that contains guidance on how to enter program information into the system. In addition, HUD will be providing on-site training to its field offices on the new monitoring and risk analysis features in the system.

HUD said that it would not do a cost benefit analysis to determine whether it is more cost beneficial to modify its IDIS or replace it. In September 1998, it made the decision to develop a Departmental Grants Management System, using IDIS as its basis. According to HUD, this system retains the good features of the IDIS, and replaces those IDIS components that were less successful. GAO has not verified that HUD's approach is efficient and effective. In addition, HUD indicated that, in November 1998, it starting implementing a stabilization plan to fix some of the problems with IDIS. According to HUD, this will ensure that IDIS is able to meet user expectations while the new Departmental Grants Management System is being developed and implemented.

HUD indicated that an Automated Data Processing Security Plan for IDIS has been approved and is being implemented to address these concerns. The plan is dated May 12, 1999. As an additional effort to strengthen access control, the Endeavor version control software was implemented in IDIS in mid-May 1999. These corrective actions do not respond to all of the problems GAO identified with IDIS security. For example, HUD has not provided assurance that the security officer has appropriate staff to carry out his responsibilities.