Mr. Chairman and Members of the Subcommittee:
We are here today to discuss our recent work on the Department of Housing and Urban Development's (HUD) management controls over four block grant programs,(1) which was conducted at the request of this Subcommittee and the Subcommittee on Housing and Community Opportunity, House Committee on Banking and Financial Services. As you know, about one quarter of HUD's budget--almost $6 billion in fiscal year 1998--is devoted to four formula block grant programs that support community development by financing projects and services for local residents.(2)
In 1995, HUD revamped its approach to managing these formula block grants. It developed the Grants Management System to emphasize a collaborative approach to grants management and deemphasized the compliance monitoring of grantees. This revamped system relies on information grantees enter into HUD's Integrated Disbursement and Information System (IDIS).(3) Concerned about HUD's approach to program monitoring under this revised system, you and Chairman Rick Lazio asked us to examine whether HUD's on-site monitoring of grantees is adequate and whether IDIS provides the data HUD needs to accurately assess grantees' performance.
In summary, we found that while the Grants Management System provides a logical, structured approach to managing the four block grant programs, HUD's implementation of the system--including on-site monitoring of grantees and IDIS--does not ensure that the programs' objectives are being met and that grantees are managing their funds appropriately. Consequently, our review and those by HUD's Inspector General have identified significant problems that call into question the integrity of the four block grant programs. More specifically:
With respect to monitoring, the five field offices we visited (accounting for about 20 percent of all block grant funds in fiscal year 1998, or $1.18 billion) conduct on-site monitoring infrequently. Moreover, on-site monitoring seldom targets the grantees that receive the poorest evaluations from the field offices compared with other grantees, and this monitoring is not uniform or comprehensive because the field offices lack specific guidance.
For its part, IDIS does not provide the information the Department needs to accurately assess grantees' performance and thus does not compensate for the shortcomings in monitoring. Because of major design flaws, the information system makes the process for establishing and maintaining accounts difficult and provides ample opportunity for major problems with entering data, does not allow such problems to be corrected easily, cannot track the program income from the revolving funds that grantees establish, does not provide timely and accurate information, and has difficulty producing reports. Compounding these problems, the system's security controls are weak and therefore do not ensure that the system is safe from fraud and abuse.
We therefore have made a number of recommendations designed to improve the Grants Management System including emphasizing the importance of on-site monitoring of grantees and assessing resources necessary to support such monitoring. We also recommended that IDIS be modified or replaced and that HUD take steps to improve IDIS security including ensuring that access to the system is limited to authorized users. While HUD disagreed with a number of points in our report, it did not comment on our recommendations.
In 1995, HUD introduced a seven-step process of interaction between HUD and its grantees called the Grants Management System. Figure 1 identifies the Grants Management System's seven steps. HUD's Office of Community Planning and Development administers the Grants Management System and IDIS through 42 field offices throughout the United States. The Grants Management System--which HUD developed to promote a more collaborative approach that includes up-front assistance and a reliance on grantees' monitoring systems--uses IDIS as its chief monitoring tool. In doing so, HUD deemphasized compliance monitoring of grantees. Because the field offices are allowed considerable independence in carrying out the Grants Management System, they develop their own work plans, conduct their own evaluations of grantees to determine which need more oversight and assistance, set their own monitoring schedules, and determine the type and amount of technical assistance they provide to their grantees.
Figure 1: The Grants Management Sytem's Seven-Step Process
The purpose of IDIS is to provide information needed for HUD's Office of Community Planning and Development to evaluate grantee performance and to determine the assistance needed. As such, the system is supposed to provide HUD staff with real-time performance data from the grantees, such as the number of people served, jobs created, houses rehabilitated; income characteristics of beneficiaries; benefits provided; information to judge if program objectives are being met; and information on funds drawn down by the grantees.
MONITORING UNDER THE GRANTS MANAGEMENT SYSTEM IS INSUFFICIENT
Although HUD's Grants Management System Policy Notebook states that on-site monitoring is an essential tool for determining whether program requirements are being met, it does not specify under what circumstances and frequency on-site monitoring should be done. Figure 2 show the five field offices we reviewed conducted visits to 33 grantees, or 14 percent of their 228 grantees during fiscal year 1998.
Figure 2: Five Field Offices' On-Site Monitoring of Grantees, Fiscal Year 1998
Moreover, while HUD's annual comparative review of
grantees' performance is intended to target the grantees
most in need of attention, as shown in figure 3, only 38 of
the 85 grantees HUD had originally designated for on-site
monitoring were determined to be among the lowest
performing grantees, that is, those needing the most
oversight or assistance. Of the 33 grantees that actually
received on-site monitoring, only 15 were among the
Figure 3: Field Offices' On-Site Monitoring of Poor Performers, Fiscal Year 1998
According to the directors of four of the five field offices we visited, the level of on-site monitoring fell by about 88 percent between 1990 and 1998 because of the shift to a more collaborative relationship with the grantees and a lack of staff resources to conduct on-site monitoring, combined with increased responsibilities for field office staff. Furthermore, the Grants Management System does not emphasize the importance of on-site monitoring by specifying the level of grantee performance that requires on-site monitoring or the steps that should be taken in conducting such monitoring.
In visits to 11 grantees, we found significant problems that could have been detected with on-site monitoring. Some project files had no evidence that the grantees monitored the recipients of funds, such as nonprofit organizations, and in one instance, the grantee acknowledged that it had not monitored any of its recipients in the 1998 program year. Other files lacked documentation to support payments and to justify cost overruns, including one overrun of about $100,000. At one grantee, the nine project files we reviewed lacked such key information as certifications that the recipients have low or moderate incomes, statements of work, and contracts, which made determinations about the grantee's performance impossible. Similarly, in 11 reports since the implementation of the Grants Management System, HUD's Inspector General has found that grantees are not complying with financial and performance requirements and has questioned the expenditure of about $26 million. The Inspector General has also faulted HUD's monitoring of grantees. In some cases, the Inspector General could not determine the extent of this monitoring because of missing information.
THE INTEGRATED DISBURSEMENT AND INFORMATION SYSTEM IS NOT PROVIDING NEEDED INFORMATION
Although IDIS was designed to provide complete, accurate, and timely information on grantees' expenditures and accomplishments, these goals are not being achieved because of four significant problems. First, because of flaws in the design of the information system, grantees must enter the same information multiple times--into another of HUD's information systems; into IDIS, several times; and into the grantees' own systems for reporting to their city--which could result in errors simply because of the multiple data entries. According to HUD, as of mid-February 1999, grantees had access to a file transfer process, referred to as Electronic Data Interchange, which allows grantees to communicate data from their own information systems to IDIS. Another difficulty is the time involved for grantees to access and use the system; in visits to grantees, we observed that accessing the system took as long as 40 minutes.
Second, when grantees enter incorrect information into IDIS, making corrections is difficult. Five of the 11 grantees we visited reported having multiple, significant errors in the system that they could not readily rectify. To make the corrections, IDIS technical staff sometimes instructed the grantees to create fake activities within IDIS ("dummy accounts") to reverse the incorrect data--although some of the grantees we spoke with were reluctant to do this because the information could appear to be inaccurate or fraudulent to outside observers.
Third, IDIS cannot track program income as it is received from the revolving loan funds that many grantees establish for such things as economic development loans. IDIS operates on the assumption that program income, from whatever source, should be used immediately to fund the next activity. That is, the system cannot segregate income from revolving funds from other program income, although regulations permit grantees to preserve program income for reuse exclusively in their revolving funds. To work around this limitation, HUD instructs grantees to delay entering information on such income until they are ready to spend the money, but this approach requires grantees to keep two sets of books and prevents HUD from using IDIS to determine how much income grantees' are earning from their revolving funds and if grantees are meeting a regulatory requirement to spend grant money in a timely manner.
Fourth, while IDIS was intended to allow HUD to track grantees' performance on a real-time basis, it does not do so. IDIS does not require grantees to enter performance information before it releases grant funds to them. Grantees can obtain all funds for an activity without entering any performance information about it, and most of the grantees we visited waited until the end of the program year to enter information, when they were required to complete annual reports. And after grantees' entered the performance information, they found that printing reports was difficult, requiring staff to work through a number of computer screens--as many as 70 at one field office we visited.
We also determined that the security controls for IDIS are weak and therefore do not provide assurance that the information system is safe from fraud and abuse. Although our Standards for Internal Controls states that users should have limited, or segregated, access to a computer system according to their responsibilities,(4) we found instances in which particular users at grantee locations had access that allowed them to both establish activity accounts and draw down funds, thereby increasing the opportunity for undetected errors or fraud. We also found that HUD had erroneously assigned three individuals who had never been employees of one grantee a variety of access rights to the grantee's data. In combination, the access rights for these individuals would have allowed them to set up activities as well as approve and draw down funds. Moreover, we found instances in which terminated employees retained access to IDIS. According to the HUD official responsible for IDIS security, the staff resources devoted to arranging access for grantees are strained and disabling accounts for terminated employees is not a high priority. Just he and two others handle the thousands of requests for access, he explained, and they cannot review the requests for appropriateness. In addition, we found that the security officer was not knowledgeable about computer security; the officer acknowledged that while he is familiar with computer networks, he has not done any work in security and has had no pertinent training.
HUD is now developing a new Department-wide information system based on IDIS to manage all of its grant programs. But given the extent and nature of the problems with IDIS, we question its use as a model for the Department-wide system. To address the problems we identified, IDIS will need to be modified extensively or replaced, whichever is more cost-effective.
- - - -
Mr. Chairman, this completes our prepared statement. We would be happy to respond to any questions that you or Members of the Subcommittee may have.
1. Community Development: Weak Management Controls Compromise Integrity of Four HUD Grant Programs (RCED-99-98, Apr. 27, 1999).
2. These programs are the Community Development Block Grant Program, the Home Investment in Affordable Housing Program, the Emergency Shelter Grant Program, and the Housing Opportunities for Persons With AIDS Program.
3. IDIS is a computer-based management information system that consolidates planning and reporting processes across the four formula grant programs.
4. GAO Internal Control: Standards for Internal Control in the
Federal Government Exposure Draft (GAO/AIMD-98-21.3.1.).
Home | Menu | Links | Info | Chairman's Page