Community Development: Weak Management Controls Compromise Integrity of
Four HUD Grant Programs (Testimony, 04/29/99, GAO/T-RCED-99-175).

Pursuant to a congressional request, GAO discussed the Department of
Housing and Urban Development's (HUD) management controls over four
block grant programs, focusing on whether: (1) HUD's monitoring of
grantees under the Grants Management System is adequate; and (2) the
Integrated Disbursement and Information Systems (IDIS) provides the data
HUD needs to accurately assess grantees' performance.

GAO noted that: (1) while the Grants Management System provides a
logical, structured approach to managing the four block grant programs,
HUD's implementation of the system--including on-site monitoring of
grantees and IDIS--does not ensure that the programs' objectives are
being met and that grantees are managing their funds appropriately; (2)
consequently, GAO's review and those by HUD's Inspector General have
identified significant problems that call into question the integrity of
the four block grant programs; (3) with respect to monitoring, the five
field offices GAO visited (accounting for about 20 percent of all block
grant funds in fiscal year 1998, or $1.18 billion) conduct on-site
monitoring infrequently; (4) on-site monitoring seldom targets the
grantees that receive the poorest evaluations from the field offices
compared with other grantees, and this monitoring is not uniform or
comprehensive because the field offices lack specific guidance; (5) for
its part, IDIS does not provide the information the Department needs to
accurately assess grantees' performance and thus does not compensate for
the shortcomings in monitoring; (6) because of major design flaws, the
information system makes the process for establishing and maintaining
accounts difficult and provides ample opportunity for major problems
with entering data, does not allow such problems to be corrected easily,
cannot track the program income from the revolving funds that grantees
establish, does not provide timely and accurate information, and has
difficulty producing reports; and (7) compounding these problems, the
system's security controls are weak and therefore do not ensure that the
system is safe from fraud and abuse.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-RCED-99-175
     TITLE:  Community Development: Weak Management Controls Compromise
	     Integrity of Four HUD Grant Programs
      DATE:  04/29/99
   SUBJECT:  Block grants
	     Housing programs
	     Grant monitoring
	     Community development programs
	     Internal controls
	     Management information systems
	     Computer security
IDENTIFIER:  HUD Grants Management System
	     HUD Integrated Disbursement and Information System
	     Community Development Block Grant Program
	     HUD Home Investment in Affordable Housing Program
	     HUD Emergency Shelter Grant Program
	     HUD Housing Opportunities for Persons with AIDS Program

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

Cover
================================================================ COVER

Before the Subcommittee on Housing and Transportation, Committee on
Banking, Housing, and Urban Affairs, U.S.  Senate

For Release
on Delivery
Expected at
2:00 p.m.  EDT
Thursday
April 29, 1999

COMMUNITY DEVELOPMENT - WEAK
MANAGEMENT CONTROLS COMPROMISE
INTEGRITY OF FOUR HUD GRANT
PROGRAMS

Statement of Stanley J.  Czerwinski, Associate Director,
Housing and Community Development Issues,
Resources, Community, and Economic
Development Division

GAO/T-RCED-99-175

GAO/RCED-99-175T

(385801)

Abbreviations
=============================================================== ABBREV

  HUD -
  IDIS -

============================================================ Chapter 0

Mr.  Chairman and Members of the Subcommittee: 

We are here today to discuss our recent work on the Department of
Housing and Urban Development's (HUD) management controls over four
block grant programs,\1 which was conducted at the request of this
Subcommittee and the Subcommittee on Housing and Community
Opportunity, House Committee on Banking and Financial Services.  As
you know, about one quarter of HUD's budget--almost $6 billion in
fiscal year 1998--is devoted to four formula block grant programs
that support community development by financing projects and services
for local residents.\2 In 1995, HUD revamped its approach to managing
these formula block grants.  It developed the Grants Management
System to emphasize a collaborative approach to grants management and
deemphasized the compliance monitoring of grantees.  This revamped
system relies on information grantees enter into HUD's Integrated
Disbursement and Information System (IDIS).\3 Concerned about HUD's
approach to program monitoring under this revised system, you and
Chairman Rick Lazio asked us to examine whether HUD's on-site
monitoring of grantees is adequate and whether IDIS provides the data
HUD needs to accurately assess grantees' performance. 

In summary, we found that while the Grants Management System provides
a logical, structured approach to managing the four block grant
programs, HUD's implementation of the system--including on-site
monitoring of grantees and IDIS--does not ensure that the programs'
objectives are being met and that grantees are managing their funds
appropriately.  Consequently, our review and those by HUD's Inspector
General have identified significant problems that call into question
the integrity of the four block grant programs.  More specifically: 

  -- With respect to monitoring, the five field offices we visited
     (accounting for about 20 percent of all block grant funds in
     fiscal year 1998, or $1.18 billion) conduct on-site monitoring
     infrequently.  Moreover, on-site monitoring seldom targets the
     grantees that receive the poorest evaluations from the field
     offices compared with other grantees, and this monitoring is not
     uniform or comprehensive because the field offices lack specific
     guidance. 

  -- For its part, IDIS does not provide the information the
     Department needs to accurately assess grantees' performance and
     thus does not compensate for the shortcomings in monitoring. 
     Because of major design flaws, the information system makes the
     process for establishing and maintaining accounts difficult and
     provides ample opportunity for major problems with entering
     data, does not allow such problems to be corrected easily,
     cannot track the program income from the revolving funds that
     grantees establish, does not provide timely and accurate
     information, and has difficulty producing reports.  Compounding
     these problems, the system's security controls are weak and
     therefore do not ensure that the system is safe from fraud and
     abuse. 

We therefore have made a number of recommendations designed to
improve the Grants Management System including emphasizing the
importance of on-site monitoring of grantees and assessing resources
necessary to support such monitoring.  We also recommended that IDIS
be modified or replaced and that HUD take steps to improve IDIS
security including ensuring that access to the system is limited to
authorized users.  While HUD disagreed with a number of points in our
report, it did not comment on our recommendations. 

--------------------
\1 Community Development:  Weak Management Controls Compromise
Integrity of Four HUD Grant Programs (RCED-99-98, Apr.  27, 1999). 

\2 These programs are the Community Development Block Grant Program,
the Home Investment in Affordable Housing Program, the Emergency
Shelter Grant Program, and the Housing Opportunities for Persons With
AIDS Program. 

\3 IDIS is a computer-based management information system that
consolidates planning and reporting processes across the four formula
grant programs. 

   BACKGROUND
---------------------------------------------------------- Chapter 0:1

In 1995, HUD introduced a seven-step process of interaction between
HUD and its grantees called the Grants Management System.  Figure 1
identifies the Grants Management System's seven steps.  HUD's Office
of Community Planning and Development administers the Grants
Management System and IDIS through 42 field offices throughout the
United States.  The Grants Management System--which HUD developed to
promote a more collaborative approach that includes up-front
assistance and a reliance on grantees' monitoring systems--uses IDIS
as its chief monitoring tool.  In doing so, HUD deemphasized
compliance monitoring of grantees.  Because the field offices are
allowed considerable independence in carrying out the Grants
Management System, they develop their own work plans, conduct their
own evaluations of grantees to determine which need more oversight
and assistance, set their own monitoring schedules, and determine the
type and amount of technical assistance they provide to their
grantees. 

   Figure 1:  The Grants
   Management Sytem's Seven-Step
   Process

   (See figure in printed
   edition.)

The purpose of IDIS is to provide information needed for HUD's Office
of Community Planning and Development to evaluate grantee performance
and to determine the assistance needed.  As such, the system is
supposed to provide HUD staff with real-time performance data from
the grantees, such as the number of people served, jobs created,
houses rehabilitated; income characteristics of beneficiaries;
benefits provided; information to judge if program objectives are
being met; and information on funds drawn down by the grantees. 

   MONITORING UNDER THE GRANTS
   MANAGEMENT SYSTEM IS
   INSUFFICIENT
---------------------------------------------------------- Chapter 0:2

Although HUD's Grants Management System Policy Notebook states that
on-site monitoring is an essential tool for determining whether
program requirements are being met, it does not specify under what
circumstances and frequency on-site monitoring should be done. 
Figure 2 show the five field offices we reviewed conducted visits to
33 grantees, or 14 percent of their 228 grantees during fiscal year
1998. 

   Figure 2:  Five Field Offices'
   On-Site Monitoring of Grantees,
   Fiscal Year 1998

   (See figure in printed
   edition.)

Moreover, while HUD's annual comparative review of grantees'
performance is intended to target the grantees most in need of
attention, as shown in figure 3, only 38 of the 85 grantees HUD had
originally designated for on-site monitoring were determined to be
among the lowest performing grantees, that is, those needing the most
oversight or assistance.  Of the 33 grantees that actually received
on-site monitoring, only 15 were among the lowest performing. 

   Figure 3:  Field Offices'
   On-Site Monitoring of Poor
   Performers, Fiscal Year 1998

   (See figure in printed
   edition.)

According to the directors of four of the five field offices we
visited, the level of on-site monitoring fell by about 88 percent
between 1990 and 1998 because of the shift to a more collaborative
relationship with the grantees and a lack of staff resources to
conduct on-site monitoring, combined with increased responsibilities
for field office staff.  Furthermore, the Grants Management System
does not emphasize the importance of on-site monitoring by specifying
the level of grantee performance that requires on-site monitoring or
the steps that should be taken in conducting such monitoring. 

In visits to 11 grantees, we found significant problems that could
have been detected with on-site monitoring.  Some project files had
no evidence that the grantees monitored the recipients of funds, such
as nonprofit organizations, and in one instance, the grantee
acknowledged that it had not monitored any of its recipients in the
1998 program year.  Other files lacked documentation to support
payments and to justify cost overruns, including one overrun of about
$100,000.  At one grantee, the nine project files we reviewed lacked
such key information as certifications that the recipients have low
or moderate incomes, statements of work, and contracts, which made
determinations about the grantee's performance impossible. 
Similarly, in 11 reports since the implementation of the Grants
Management System, HUD's Inspector General has found that grantees
are not complying with financial and performance requirements and has
questioned the expenditure of about $26 million.  The Inspector
General has also faulted HUD's monitoring of grantees.  In some
cases, the Inspector General could not determine the extent of this
monitoring because of missing information. 

   THE INTEGRATED DISBURSEMENT AND
   INFORMATION SYSTEM IS NOT
   PROVIDING NEEDED INFORMATION
---------------------------------------------------------- Chapter 0:3

Although IDIS was designed to provide complete, accurate, and timely
information on grantees' expenditures and accomplishments, these
goals are not being achieved because of four significant problems. 
First, because of flaws in the design of the information system,
grantees must enter the same information multiple times--into another
of HUD's information systems; into IDIS, several times; and into the
grantees' own systems for reporting to their city--which could result
in errors simply because of the multiple data entries.  According to
HUD, as of mid-February 1999, grantees had access to a file transfer
process, referred to as Electronic Data Interchange, which allows
grantees to communicate data from their own information systems to
IDIS.  Another difficulty is the time involved for grantees to access
and use the system; in visits to grantees, we observed that accessing
the system took as long as 40 minutes. 

Second, when grantees enter incorrect information into IDIS, making
corrections is difficult.  Five of the 11 grantees we visited
reported having multiple, significant errors in the system that they
could not readily rectify.  To make the corrections, IDIS technical
staff sometimes instructed the grantees to create fake activities
within IDIS (ï¿½dummy accountsï¿½) to reverse the incorrect
data--although some of the grantees we spoke with were reluctant to
do this because the information could appear to be inaccurate or
fraudulent to outside observers. 

Third, IDIS cannot track program income as it is received from the
revolving loan funds that many grantees establish for such things as
economic development loans.  IDIS operates on the assumption that
program income, from whatever source, should be used immediately to
fund the next activity.  That is, the system cannot segregate income
from revolving funds from other program income, although regulations
permit grantees to preserve program income for reuse exclusively in
their revolving funds.  To work around this limitation, HUD instructs
grantees to delay entering information on such income until they are
ready to spend the money, but this approach requires grantees to keep
two sets of books and prevents HUD from using IDIS to determine how
much income grantees' are earning from their revolving funds and if
grantees are meeting a regulatory requirement to spend grant money in
a timely manner. 

Fourth, while IDIS was intended to allow HUD to track grantees'
performance on a real-time basis, it does not do so.  IDIS does not
require grantees to enter performance information before it releases
grant funds to them.  Grantees can obtain all funds for an activity
without entering any performance information about it, and most of
the grantees we visited waited until the end of the program year to
enter information, when they were required to complete annual
reports.  And after grantees' entered the performance information,
they found that printing reports was difficult, requiring staff to
work through a number of computer screens--as many as 70 at one field
office we visited. 

We also determined that the security controls for IDIS are weak and
therefore do not provide assurance that the information system is
safe from fraud and abuse.  Although our Standards for Internal
Controls states that users should have limited, or segregated, access
to a computer system according to their responsibilities,\4 we found
instances in which particular users at grantee locations had access
that allowed them to both establish activity accounts and draw down
funds, thereby increasing the opportunity for undetected errors or
fraud.  We also found that HUD had erroneously assigned three
individuals who had never been employees of one grantee a variety of
access rights to the grantee's data.  In combination, the access
rights for these individuals would have allowed them to set up
activities as well as approve and draw down funds.  Moreover, we
found instances in which terminated employees retained access to
IDIS.  According to the HUD official responsible for IDIS security,
the staff resources devoted to arranging access for grantees are
strained and disabling accounts for terminated employees is not a
high priority.  Just he and two others handle the thousands of
requests for access, he explained, and they cannot review the
requests for appropriateness.  In addition, we found that the
security officer was not knowledgeable about computer security; the
officer acknowledged that while he is familiar with computer
networks, he has not done any work in security and has had no
pertinent training. 

HUD is now developing a new Department-wide information system based
on IDIS to manage all of its grant programs.  But given the extent
and nature of the problems with IDIS, we question its use as a model
for the Department-wide system.  To address the problems we
identified, IDIS will need to be modified extensively or replaced,
whichever is more cost-effective. 

--------------------
\4 GAO Internal Control:  Standards for Internal Control in the
Federal Government Exposure Draft (GAO/AIMD-98-21.3.1.). 

-------------------------------------------------------- Chapter 0:3.1

Mr.  Chairman, this completes our prepared statement.  We would be
happy to respond to any questions that you or Members of the
Subcommittee may have. 

*** End of document. ***