About one-quarter of the Department of Housing and Urban Development’s (HUD) budget—almost $6 billion in fiscal year 1998—is devoted to four formula block grant programs that support community development. While those programs have different purposes, they all provide federal funds to grantees to help finance projects and services for local residents. The grantees include (1) 964 communities known as entitlement communities—generally cities designated as central cities of metropolitan statistical areas, other cities with populations of at least 50,000, and qualified urban counties with populations of at least 200,000—and (2) 48 states and some communities besides entitlement communities whose programs are administered directly by HUD. In 1995, HUD revamped its management of these formula block grant programs. Instead of having a grantee develop separate plans for each program, a grantee is now required to develop a consolidated plan that lays out how it will use funds from the four programs for community development. To implement the use of consolidated plans and focus on performance monitoring, HUD instituted the Grants Management System—a seven-step process for managing program funds and activities—which placed greater reliance on the communities’ actions to police themselves; it also phased in the Integrated Disbursement and Information System (IDIS), which is a computerized reporting system for recording the information grantees provide on their withdrawal of grant funds and their accomplishments. HUD’s Assistant Secretary for Community Planning and Development administers four formula block grant programs that help communities plan and finance their growth and development and provide shelter and services for homeless people. The four programs are the Community Development Block Grant Program, the Home Investment in Affordable Housing Program (HOME), the Emergency Shelter Grant Program, and the Housing Opportunities for Persons With AIDS Program. The grantees in these programs distribute their grant funds to some 10,000 “subrecipients,” such as nonprofit providers, while the states distribute their grants to local governments. These subrecipients and local governments provide services directly to the beneficiaries of the programs. In order to participate in the four programs, grantees must meet general and specific requirements. For instance, in order to apply for one of the four formula grants, a grantee must develop a long-term plan, generally for 3 to 5 years, that lays out activities under all four programs. This plan must include an assessment of needs for housing and the homeless; a housing market analysis; a 1-year action plan; certifications of compliance with various regulatory requirements, standards, and procedures that the jurisdiction will use to monitor activities carried out in furtherance of the plan; and a citizen participation and government consultation plan. Projects and activities undertaken with program funds must meet the specific objectives and requirements of each program. The Community Development Block Grant Program has long been the principal federal community development program, providing funding for metropolitan cities and urban counties and for small cities. The program provides annual grants on a formula basis that takes into account population, poverty, housing overcrowding, the age of the housing, and any change in an area’s growth in comparison with that of other areas. The activities undertaken must address at least one of three national objectives: They must (1) benefit low- and moderate-income families, (2) aid in the prevention or elimination of slums or blight, or (3) meet urgent community development needs. In fiscal year 1998, the Congress appropriated about $4.9 billion for the Community Development Block Grant Program. This funding was subject to over $700 million in set-asides, including ones for Indian tribes and historically black colleges. The HOME Program provides federal assistance to participating jurisdictions or Indian tribes for housing rehabilitation, rental assistance, assistance to first-time homebuyers, and new housing construction. The HOME formula for allocating funds measures a jurisdiction’s share of the total need for an increased supply of affordable housing. In fiscal year 1998, the Congress appropriated about $1.5 billion for the HOME Program—$863 million was allocated by formula to cities, urban counties, and consortiums (contiguous units of local government), and $575 million went to the states. The program’s funding is also subject to several set-asides. The Emergency Shelter Grants Program is designed to supplement state, local, and private efforts to provide emergency shelter assistance for the homeless. Program funds can be used to rehabilitate or convert buildings for use as emergency shelters for the homeless, to pay for certain operating expenses and essential services in connection with emergency shelters for the homeless, and to conduct activities to prevent homelessness. Under this program, HUD makes grants to the states, units of general local government, and territories on the basis of the Community Development Block Grant formula. In fiscal year 1998, the Congress appropriated $823 million for Homeless Assistance Grants, of which $165 million was allocated for the Emergency Shelter Grants program. The Housing Opportunities for Persons With AIDS Program gives states and localities the resources and incentives to devise long-term strategies for meeting the housing needs of low-income persons with human immunodeficiency virus/acquired immunodeficiency syndrome (HIV/AIDS) or related diseases. HUD awards 90 percent of the annual appropriation by formula to eligible metropolitan statistical areas and states. Metropolitan areas with populations greater than 500,000 and more than 1,500 cumulative cases of AIDS are eligible for grants; the most populous city in an eligible metropolitan area serves as that area’s grantee. In addition, states with more than 1,500 cumulative cases of AIDS in areas outside of eligible metropolitan areas qualify for funds. The remaining 10 percent of the program’s annual appropriation is set aside for grants awarded on a competitive basis. In fiscal year 1998, the Congress appropriated $204 million for the Housing Opportunities for Persons With AIDS Program. HUD’s Office of Community Planning and Development (CPD) administers the four formula grant programs through 42 field offices located throughout the United States. These offices report directly to CPD’s Office of Executive Services, Field Management Division. Both headquarters and field offices are now relying on the Grants Management System to oversee grantees. Each field office is managed by a director, who is responsible for ensuring that the field office’s annual work plan is carried out. An annual work plan is based on the field office’s annual assessment of each grantee and a comparison of the grantees’ performances (known as an annual comparative review). The work plan describes the actions the field office plans to take for each grantee during the year. For example, grantees designated as needing improvement may be scheduled for technical assistance or on-site monitoring. Reporting to the director are teams of CPD representatives who are responsible for monitoring a caseload of grantees. Each team is managed by a program manager. Several types of support staff supplement the efforts of the CPD representatives. For example, financial analysts review, monitor, evaluate, and provide technical advice and assistance on financial matters concerning grant awards and grantees’ financial systems. Other support staff include environmental, relocation and real estate, and clerical staff. The 42 field offices report directly to the Office of Executive Services, Field Management Division. The division is responsible for setting priorities, promulgating departmental goals, providing resources, solving problems, representing the field offices in headquarters, training, and evaluating field offices’ performance. It operates through eight desk officers, each of whom is responsible for a number of field offices—including monitoring the offices’ operations, providing assistance, and providing input to the field offices’ end-of-the-year evaluation signed by the Director of the Office of Executive Services. The desk officers oversee the field offices through telephone conversations and E-mail correspondence, occasional on-site visits, and periodic queries to the Grants Management Process information system. This information system is a computerized management information system that the field offices use to record their interactions with their grantees. For example, once a CPD representative completes a review and assessment of the grantee’s annual plan for using its formula grant funds, the results are entered into the Grants Management Process information system. In 1995, HUD introduced the Grants Management System to ensure that formula block grantees are achieving high performance and are in compliance with program requirements. This system deemphasized compliance monitoring and placed greater emphasis on (1) promoting a more collaborative approach that includes up-front assistance to help grantees achieve their goals and identify and solve their problems and (2) ensuring that grantees develop systems to monitor their own performance. Before the Grants Management System, HUD’s primary activities in administering the block grant programs were to assist communities in understanding program requirements and to monitor local programs to ensure compliance with statutory and regulatory requirements. The Grants Management System and the information systems supporting it—the Integrated Disbursement and Information System (IDIS) and the Grants Management Process information system—are intended to help HUD comply with the requirements of the Government Performance and Results Act of 1993 (P.L. 103-62). The act requires agencies to establish long-term general goals as well as associated annual goals. In addition, agencies must measure their performance against the goals they have set and report publicly on how well they are doing. The Grants Management System is intended to target limited resources so that they can best be used to achieve locally defined goals while also providing best practices to serve as models to enhance and improve performance among all grantees. As figure 1 shows, the Grants Management System is a seven-step process of interaction between CPD and the grantees that involves (1) consulting, (2) conducting a plan review and assessment, (3) monitoring a grantee’s performance (performance-based program management), (4) reviewing the grantee’s consolidated annual performance and evaluation report, (5) conducting an annual community assessment, (6) conducting an annual comparative review, and (7) systematically identifying and encouraging the use of best practices. Broadly, the Grants Management System establishes internal controls—plans, methods, and procedures used to meet objectives—that involve monitoring and, according to GAO’s Standards for Internal Controls in the Federal Government, must themselves be monitored. Field offices enter the results of each of these steps into the Grants Management Process information system. CPD uses consultation as a tool to enhance the quality and effectiveness of a grantee’s plans and programs. These consultations are held as early as possible in the grantee’s process for developing its next year’s planned activities. The participants in these meetings should include the chief elected official of the community and other stakeholders, as appropriate. The discussions should be centered on relevant planning, performance, and compliance issues. When possible, these discussions should be conducted at the grantee’s offices. CPD uses the grantee’s consolidated plan and annual action plan as the basis for its program management and evaluation responsibilities. CPD’s review and assessment focuses on the plans’ completeness; their effectiveness as communication tools for citizens; the soundness of their strategies and the likelihood that they will address identified needs; and their ability to serve as the basis of future assessment and performance evaluation. CPD has 45 days from receipt of the plans to review and approve or disapprove them or the plans are automatically approved. CPD is to oversee the grantee’s activities throughout the program year through performance-based management. This process includes an assessment of the performance and overall effectiveness of the programs implemented by the grantees as well as traditional compliance monitoring. CPD must use a wide range of tools in evaluating a grantee’s performance. These tools include the consolidated and action plan review and assessment, performance data that the grantee enters into IDIS, the annual community assessment, on-site monitoring, and consultations with community officials and other stakeholders to define or improve a local program. At the end of the program year, a grantee submits a consolidated annual performance and evaluation report whose goal is to show what the grantee has accomplished with the grant funds. The report allows CPD, local officials, and the public to draw conclusions on grantees’ performance. A grantee should submit this report to its CPD field office 90 days after the end of the grantee’s program year, which varies by grantee. The report is to cover all activities undertaken by the grantee during the program year regardless of the fiscal year of the grant. If a grantee fails to submit the report in a timely manner, CPD can suspend or terminate the grantee’s funding. According to the Grants Management System Policy Notebook, CPD’s review of the report should be completed within 60 days of receipt; however, this time frame is not required by regulation. Using the consolidated annual performance evaluation report and other available information, such as the results of monitoring activities, CPD annually assesses each grantee’s performance to determine whether the grantee has carried out its planning, activities, and reporting in accordance with statutory requirements and provides the grantee with a written report on its performance. This assessment is to begin no later than 3 months after the end of the program year. CPD is to complete the assessment within 60 days and provide the grantee with a letter that cites the grantee’s accomplishments and any areas that need improvement. The grantee is given 30 days to comment on the assessment’s findings. In conducting an annual comparative review, each field office evaluates its portfolio of grantees by quality and risk and identifies grantees that it considers to be performing exceptionally well, those that are performing adequately, and those that need more oversight or assistance. At the completion of this review, CPD develops a work plan for each grantee that describes the management strategy for the grantee for the coming program year. If the grantee has areas needing improvement, the field office will identify actions and strategies for addressing that problem. Actions may include on-site monitoring, technical assistance provided by staff and contractors, peer-to-peer assistance, and training. During the annual comparative review or at any time, field offices identify best practices—systems and programs that work particularly well and that can be used to improve the performance of other grantees. Best practices are programs or projects, management tools, and/or techniques that fulfill at least two of the following characteristics: • They generate a significant positive impact on those they are intended to serve or manage and are replicable in other areas of the country, region, or local jurisdiction. • They demonstrate the effective use of partnerships among government agencies, nonprofit organizations, and/or private businesses. • They display creativity in addressing a problem. IDIS is a computer-based management information system that consolidates planning and reporting processes across the four formula grant programs. The grantees use this system to enter information on consolidated planning, establish projects and activities to draw down funds, and report accomplishments. The system is supposed to reduce the grantees’ reporting burden by providing a single computer system for obtaining funding and reporting on the use of grant funds, regardless of the formula grant program. Moreover, the system is supposed to provide CPD staff with real-time performance data from the grantees, such as the number of people served, jobs created, houses rehabilitated; income characteristics of beneficiaries; benefits provided; information to judge if national objectives are being met; and information on funds drawn down by the grantees. This information is needed for CPD to evaluate grantee performance and to determine the assistance is needed. Figure 1.2 shows CPD’s structure and information systems in managing the four formula grant programs. The former Chairman of the Subcommittee on Housing Opportunity and Community Development—now the Subcommittee on Housing and Transportation—, Senate Committee on Banking, Housing, and Urban Affairs, and the Chairman of the Subcommittee on Housing and Community Opportunity, House Committee on Banking and Financial Services, asked GAO to assess whether controls are in place to ensure that the block grant programs’ objectives are being achieved and that funds are managed appropriately. In particular, we examined whether (1) HUD’s on-site monitoring of grantees under the Grants Management System is adequate and (2) the Integrated Disbursement and Information System provides the data HUD needs to accurately assess grantees’ performance. Our work focused on CPD’s four formula grant programs—the Community Development Block Grant Program, HOME Investment in Affordable Housing Program, Housing Opportunities for Persons With AIDS Program, and Emergency Shelter Grants Program. We evaluated IDIS operations and the Grants Management System, CPD headquarters’ oversight of its 42 field offices, and 5 field offices’ oversight of 11 grantees. In selecting field offices, we considered geographic dispersion, size, grant fund allocations, and past performance. In addressing both questions, we examined information from a number of sources, including relevant GAO reports, the HUD Office of the Inspector General’s audits of CPD’s formula grant programs, and independent contractor’s audits and studies of IDIS and CPD’s internal controls. In addition, we interviewed key agency officials, the independent contractors supporting IDIS and reviewing the Grants Management System, and representatives of various grantee organizations. In evaluating the Grants Management System, we interviewed CPD officials at field offices located in Fort Worth, Texas; Boston, Massachusetts; Los Angeles, California; Coral Gables, Florida; and Omaha, Nebraska. In our analysis, we applied the relevant criteria GAO has issued on internal controls and guidelines for evaluations and the laws, regulations, and procedures pertaining to the four formula block grant programs. We evaluated the Grants Management System’s design and reviewed its implementation in each of the five field offices. Specifically, we assessed the caseloads of each field office representative; analyzed the offices’ process for reviewing and monitoring grantees’ action plans, transactions, and performance information; and documented the field offices’ responses to this information. We also visited a total of 11 grantees managed by the five field offices we visited. These grantees were selected on the basis of their size, performance evaluations, and proximity to the field offices. While at these grantees, we interviewed relevant city officials and conducted limited file reviews to determine if HUD was effectively managing these grants, obtained the grantees’ opinions on the level of monitoring and technical assistance provided by the CPD field office; and validated selected information provided through IDIS. The grantees we visited include Fort Worth, Arlington, and Dallas, Texas; Lincoln, Nebraska; Council Bluffs, Iowa; Medford, and Lowell, Massachusetts; Inglewood, and Ontario, California; and Miami, and Pompano Beach, Florida. We evaluated IDIS internal controls and conducted selective testing of IDIS transactions. We interviewed key HUD officials both in headquarters and the field as well as staff at the grantees we visited regarding IDIS’ functionality, training, and security. We also tested IDIS’ accuracy by tracing financial and accomplishment data to source documents for randomly selected activities. Our review was conducted from May 1998 through April 1999 in accordance with generally accepted government auditing standards. While the Grants Management System provides a logical, structured approach to managing the four block grant programs, CPD’s monitoring under the system, of which IDIS is a critical part, does not ensure that program objectives are being met and that funds are being managed appropriately. While the on-site monitoring of grantees is an essential tool for making such determinations, it is all the more important because of the shortcomings of IDIS (discussed in ch. 3) and other monitoring tools, such as consultations, technical assistance visits and audits performed by independent public accounting firms. For the five CPD field offices we visited, accounting for approximately 20 percent of all formula grant funds in fiscal year 1998 ($1.18 billion), most of the poorest performing grantees, identified by CPD through the annual comparative review, were not identified for on-site visits. And even when on-site visits were scheduled for the poorest performing grantees, the visits often did not occur because of a shift in emphasis away from intensive on-site monitoring and resource constraints in the field offices. Furthermore, CPD headquarters has reduced its oversight of the field offices because of a desire for a more collaborative relationship and because of resource constraints. Such breakdowns in monitoring make the Department vulnerable to fraud, waste, and abuse in its formula grants programs. In our review of 11 grantees, we identified various problems related to the financial operations of and results achieved by grantees, including vouchers assigned to the wrong project and year and incomplete or missing information on key data such as recipients, statements of work, and contracts. In addition, since the Grants Management System was introduced in 1995, HUD’s Inspector General has questioned grantees’ expenditure of about $26 million. Finally, the Inspector General and an independent study performed in 1998 of six field offices and 11 grantees reported that CPD’s monitoring is inadequate. While HUD’s Grants Management Policy Notebook emphasizes the importance of on-site monitoring in implementing the Grants Management System, stating that on-site monitoring is an essential tool for determining whether important program requirements are being met, the five field offices we visited have generally conducted limited on-site monitoring of grantees and of those grantees CPD identifies as most in need of oversight or assistance. Furthermore, when on-site reviews occur, field offices may not obtain the comprehensive, in-depth information they need to oversee grantees’ performance. A problem exists with the definition of poor performance because CPD has not established standard criteria for determining the level of performance grantees achieve, which means that CPD has no assurance that the grantees most at risk of failing to meet program requirements are consistently being identified for more intensive review. The field offices we visited targeted about 37 percent of their grantees for on-site monitoring but visited far fewer. As figure 2.1 shows, during fiscal year 1998, the five field offices identified 85 of their 228 grantees for on-site monitoring but only conducted 33 visits—14 percent of all grantees. Furthermore, while the grantee evaluation performed during the annual comparative review is intended to maximize the use of limited resources by targeting the grantees most in need of attention, the 33 grantees visited by the five field offices were not necessarily those CPD had determined were the poorest performers. As figure 2.2 shows, only 38 of the 85 grantees designated for on-site monitoring were rated among the lowest performing grantees in the annual comparative review, that is, those needing the greatest oversight or assistance. Moreover, only 15 were actually monitored, and the remaining 23 visits were cancelled because of resource limitations, according to the field office directors. According to the CPD directors of four of the five field offices, they have significantly reduced their on-site monitoring of grantees in recent years.According to monitoring information provided by the four directors, on-site monitoring in these offices fell by about 88 percent between 1990 and 1998. Nevertheless, officials of two associations that represent grantees—the National Community Development Association and the National Association for County Community and Economic Development—and several grantees we visited supported more on-site monitoring because monitoring ensures that they are generally on the right track. They said they want to know whether they are operating their programs properly and to have problems corrected before they are penalized for inadequate management. One association official said that some grantees are becoming concerned because they have not been monitored in years. Infrequent on-site monitoring by CPD has occurred for two principal reasons discussed below: (1) a shift in emphasis under the Grants Management System and (2) significant resource reductions. The Grants Management System shifted the focus of the government/grantee relationship from one of monitoring grantee compliance with program requirements to a more collaborative relationship that includes up-front assistance to help grantees achieve their objectives and identify and solve problems. In line with this philosophy, CPD encouraged the field offices to increase the level of remote monitoring through IDIS and other tools such as IDIS reports, consultations, technical assistance visits, and audits performed by independent accounting firms and reduce the level of intensive on-site monitoring. In February 1997, we reported that of the 32 CPD directors surveyed, 41 percent said that headquarters’ emphasis on completing essential monitoring was low, and 66 percent believed that the amount of on-site inspections should increase. As the directors of the five field offices said, and as we reported in February 1997, the level of on-site monitoring is lower than it should be principally because of a lack of staff and travel funds. Resources have been reduced while responsibilities have increased. CPD lost almost one-fourth of its staff—264 people—between 1992 and 1997. At the same time, staff have had to take on new responsibilities for programs worth billions of dollars: homelessness programs, technical assistance grants, and Empowerment Zone and Enterprise Community grants. This caused the annual grants per employee to double from about two to about four over approximately the same period. In addition, the staff in some field offices have to carry out administrative tasks because of administrative staff shortages. CPD directors told us that staff reductions, combined with workload increases, have forced them to have to make sacrifices, and they consistently mentioned the elimination of on-site monitoring as one of those sacrifices. Furthermore, CPD directors told us that the Grants Management System was not generating resource efficiencies as they had hoped. While IDIS, along with the Grants Management Process information system, were to foster the efficiencies of remote monitoring, IDIS requires substantial time to learn and maintain, and the annual consultations also use time and travel dollars, the directors reported. According to the directors, these extra requirements make on-site monitoring more difficult. “Among . . . [CPD’s] key problems are: a. Staff and travel funds are too limited to do adequate on-site monitoring and validation of high risk activities of grantees. b. CPD approves over 1,300 competitive grants a year and has to monitor cumulatively many thousands of competitive grants, a workload increasingly difficult to handle with the loss of 23% of staff since 1992 and continued drop in staff under the downsizing. c. With the approval of hundreds of economic development projects in the past several years, CPD has insufficient staff resources in both number and expertise to monitor these programs adequately.” Despite recognition of this problem, CPD has not conducted a workforce analysis to determine its staffing needs and accurately target its staff resources since 1996. Furthermore, while HUD’s travel budget increased from $15.6 million in fiscal year 1998 to $19 million for fiscal year 1999, HUD decreased CPD’s field office travel allocation from $416,051 in 1998 to $412,000 in 1999. Moreover, the field office travel allocation for fiscal year 1999 is over $100,000 less than it was in fiscal year 1994. Before the Grants Management System was established, field offices used the CPD Monitoring Handbook more universally. This handbook specified the level of monitoring warranted for high-risk grantees and the scope and intensity of the on-site review. It indicated that on-site monitoring should include validating reported information by reviewing case files; reviewing financial information; spot-checking capital improvement projects; and visiting sites that provide direct services to beneficiaries, such as a homeless shelter. It also included checklists that focused on compliance with program requirements, such as the grantee’s progress in achieving project objectives, compliance with national objectives for the Community Development Block Grant Program, grant administration, citizens’ participation, and property rehabilitation activities, among others. Some of these activities were reviewed by CPD representatives, while others were reviewed by specialists such as financial analysts. Staff had to report on the results of the review in the form of a letter to the grantee and other relevant officials. According to one field office director we spoke with, a comprehensive on-site review would usually take about a week or two to complete. Under the Grants Management System, however, CPD has no assurance that such comprehensive on-site monitoring will occur. The Grants Management System Policy Notebook does not ensure that field offices will conduct comprehensive monitoring of the grantees that they do visit because it does not provide specific procedures that have to be carried out during such a visit. Two field office directors and the Director of CPD’s Field Management Division said that the principles in the monitoring handbook still applied but that field offices are not required to follow them. Field offices have significantly curtailed the actions they take during on-site monitoring. Instead, monitoring under the Grants Management System targets the specific aspects of grants administration in which the grantee needs improvement. For example, one field office focused its monitoring visits only on the grantees’ monitoring of subrecipients. Of the five offices that we visited, only one office had conducted a comprehensive on-site monitoring of a grantee in 1998. According to the field office director, the field office no longer routinely conducts comprehensive on-site monitoring, but did so in this instance in response to a citizen’s allegation of fraud in the use of federal funds. The lack of specific monitoring guidance thus allows for significant variation in the way HUD field offices oversee almost $6 billion in formula grant funds. While one field office we visited focused its half-day monitoring visits only on the grantees’ monitoring files for subrecipients, another office conducts complete multiday reviews of one of a grantee’s programs. In a third field office, the complete fiscal year 1998 on-site monitoring for one grantee that receives $28 million annually in CPD formula allocations consisted of a one-day visit to one HOME project by a single HUD employee, who had never before conducted a monitoring visit. According to HUD, the Grants Management Policy Notebook will be revised to provide detailed guidance to field offices on ensuring compliance with program laws and regulations. This guidance is scheduled to be made final and distributed at the end of July 1999. The directors of the five CPD field offices we visited generally agreed that comprehensive on-site reviews provide a higher level of assurance of program compliance and proper use of funds than other available tools—IDIS reports, consultations, technical assistance visits, and audits performed by independent public accounting firms. These other tools do not provide the detailed information that field offices need to effectively monitor program performance, according to the directors. As we discuss in chapter 3, we found during our visits to field offices that grantees were not always entering complete and accurate information into IDIS and that the system cannot provide timely and accurate information on grantees’ performance. In addition, some CPD representatives were not using IDIS to retrieve information on grantees’ performance. Furthermore, field offices’ consultations with grantees are primarily geared to providing local officials with an evaluation of the grantees’ performance and to identifying technical assistance needs and resources, rather than reviewing projects and activities and documentation supporting those activities. Similarly, technical assistance visits are made to provide the grantees with information to help them operate their programs more effectively. One director acknowledged that field office staff can make observations on grantees’ financial and performance matters during these visits, but the visits’ primary purpose is not monitoring. Moreover, technical assistance is often performed by contractors who do not have a monitoring role. Finally, according to the Director of the Field Management Division and all five field office directors, independent public accounting audits do not provide enough detailed program performance information. The latitude allowed in evaluating the level of grantees’ performance is another problem for monitoring under the Grants Management System. The field offices have considerable discretion in setting their annual work plans—including deciding on which grantees are poor performers and what type of oversight they may need. The Grants Management Policy Notebook, which describes how to manage a grantee’s performance, provides only general criteria for evaluating this performance. These criteria include the adequacy of the grantee’s consolidated plan and the grantee’s efforts to (1) address the continuing needs of the homeless population, (2) provide affordable housing to all populations and income groups, (3) increase economic opportunity, (4) provide a suitable living environment for its recipients, and (5) meet program requirements. The policy notebook leaves it to the individual field office to determine which of these factors to weigh more heavily in targeting grantees for review. On the basis of these criteria, the field office is to determine which grantees are performing exceptionally well, performing adequately, or needing more oversight or assistance. While these criteria include an important focus on results in the community, they do not provide assurance that field offices will consistently emphasize the factors that will target grantees on the basis of compliance with internal controls designed to protect against fraud or abuse. According to two field office directors, in determining which grantees need to be monitored more closely in the coming year, the Grants Management System shifted the focus from the factors that could result in the inappropriate use of federal funds to the more performance-based factors presented in the Grants Management Policy Handbook. Furthermore, in reviewing the Community Development Block Grant Program, an independent accounting firm noted the need to identify at-risk grantees by using more traditional risk factors, such as unresolved audit or monitoring findings, the number of subgrantees and subrecipients receiving funds, the amount of program income, the size of the grant, the last date of monitoring, and staff turnover. In response to this report, on September 29, 1998, HUD promulgated risk analysis guidance that included most of these risk factors. Our visits to 11 grantees and 11 reports by HUD’s Inspector General, while not generalizable to all block grant programs, identified significant problems that could have been identified if field offices were conducting comprehensive on-site monitoring. Specifically, at several grantees, we found problems in the monitoring of subrecipients that ranged from a lack of records showing that such monitoring had been done, although the grantees said monitoring had occurred, to an acknowledgement by one grantee that no monitoring had occurred during the 1998 program year. Without subrecipient monitoring, HUD has no assurance that subrecipients are complying with program requirements and are achieving their intended objectives. For other grantees, in examining the project files, we found inadequate documentation to support payments to contractors, payment vouchers that were unrelated to the project, and a lack of documentation to justify project overruns. For example, at one grantee, the project files were missing so much information that we could not determine if we had identified all of the problems. This grantee had incomplete or missing information—on such key data as the qualifications of recipients served, such as certifications that recipients are of low or moderate-income, statements of work, and contracts—in the nine project files we reviewed. Although this grantee received a monitoring visit in the 1998 program year, the monitoring was targeted to specific program areas, and the monitoring report did not disclose the problems we identified. For example, for one project budgeted for $30,000, the file included two contracts indicating that it had received $40,000 and then another $60,000. We were told that the latter $60,000 contract was cancelled, but the file included no documentation of this. For another project budgeted for $135,000, the file included weekly progress reports, but payment vouchers (justifying the payments made to contractors) and other important documents, such as a statement of work, were missing. And for still another project, the file indicated that the project was budgeted at $145,000 and internal accounting records indicated that over $300,000 was spent, but neither of these figures could be reconciled with the withdrawal of approximately $240,000 that was recorded in IDIS. The file did not include any justification or support for the discrepancies and the overrun. This grantee was not alone in poorly accounting for its use of funds. For example, at another grantee, we could not reconcile payment vouchers with project totals for a street-paving project that cost $259,200. Our reviews also showed problems with reporting accomplishments and determining whether grantees were following regulations. For example, at another grantee, we observed the double-counting of accomplishments from one project. In particular, the project file supported only half as many demolitions as were reported in IDIS. In 11 reports based on reviews of some grantees, HUD’s Inspector General found that grantees are not complying with financial and performance requirements and consequently has questioned the expenditure of about $26 million in grant funds since HUD began using the Grants Management System. For example, the Inspector General reported that a grantee had improperly charged over $2 million in administrative costs to prior program years. Since the costs were transferred before the end of the program year, the grantee did not disclose these costs in its annual performance report. Without on-site validation of the information in the report, the CPD field office could not determine that improper transfers had been made. According to the CPD representative who was responsible for this grantee, the limited monitoring that was done during this period could not have identified the conditions the Inspector General had uncovered. In another audit, the Inspector General found significant weaknesses in a grantee’s internal controls for its housing rehabilitation program under its Community Development Block Grant Program. For example, the Inspector General identified 11 houses that had recently been rehabilitated, inspected, and approved by the grantees’ inspectors. However, the Inspector General’s inspectors said these houses should not have passed inspection. According to the Inspector General’s report, the deficiencies identified by the Inspector General’s inspectors had been allowed to go uncorrected because the grantee’s inspectors were not specifically trained to perform inspections and were pressured to perform cursory inspections in order to meet production goals. In addition, the Inspector General reported that because the grantee did not have any procedures for collecting payments on rehabilitation loans, the grantee had a delinquent loan balance of over $100,000. Some of these loans had been delinquent for over 8 years. The Inspector General reported that this audit was initiated by the grantee, not CPD, following up on an audit conducted by an independent accounting firm. HUD’s Inspector General has also specifically faulted CPD’s monitoring of grantees. For example, in its audit of HUD’s fiscal year 1997 financial statement, the Inspector General focused on whether the Grants Management System had been implemented and whether the system was providing adequate oversight of grantees. For some of the grantees, the Inspector General could not determine the extent of CPD’s monitoring of grantees’ performance because it could not find documentation of monitoring in CPD’s files. It also found that CPD had not done annual community assessments for some grantees. Though these required assessments are needed in order to reach an opinion on the grantees’ performance for the year, CPD officials explained that staff shortages resulting from HUD’s downsizing during fiscal year 1997 had prevented them from conducting the assessments. The Inspector General concluded that CPD could not ensure that all grantees were expending funds only on eligible activities and individuals. In addition, the independent accounting firm assigned to the verification review of CPD’s actions to correct material weaknesses in the Community Development Block Grant Program faulted CPD’s practices for monitoring grantees. Its report indicated that four of the six field offices visited had not conducted significant on-site monitoring visits for fiscal years 1996 and 1997. “CPD had conducted Field Office Reviews in the past, however these reviews have been discontinued. We were unable to identify any procedures being performed by Headquarters that would be adequate for evaluating the quality and sufficiency of procedures being applied by the Field Offices.” In addition, the representatives of the accounting firm said that the lack of headquarters oversight represents a material weakness in internal controls. The report recommended that CPD headquarters design a methodology for determining the adequacy of field offices’ compliance-monitoring procedures. HUD is still reviewing the report to determine how it will respond to the recommendations. Headquarters staff infrequently visit the 42 field offices—making fewer than five visits in the last 2 years—according to the Director of the Field Management Division. When they do visit, headquarters staff do not have to formally report their findings. These limited visits to field offices reflect a change in headquarters’ oversight in recent years. One desk officer told us that headquarters had moved away from field office monitoring in an attempt to improve relationships with the field offices—headquarters believed that these visits antagonized the field offices. However, he believed that monitoring visits helped bring headquarters closer to the problems and realities that the field offices faced. In the past, he explained, these visits always generated findings, and the field offices welcomed the feedback and suggestions for improvement that resulted. But now, he stated, he does not have enough information to assess the field offices’ performance. In addition, the desk officers’ primary monitoring tool—the Grants Management Process information system—yields incomplete and inconsistent data. Consequently, headquarters staff do not know if field offices are fulfilling their program responsibilities. Our review of a Grant Management Process report on the field offices’ compliance with the time requirement for approving or disapproving grantees’ annual action plans showed that the field offices are interpreting the requirement differently and consequently entering different, sometimes misleading, approval dates into the system. For example, one field office we visited believed that the approval date was the day the CPD representative approved the plan; another, that it was the date the field office director approved the plan; and a third, that it was the date the local Congressman notified the grantee that the grant had been approved. Moreover, the desk officer responsible for one of these offices could not explain an apparently significant number of late approvals. However, in our visit to this field office, we learned that, for many of the plans reviewed, field office staff had either incorrectly entered the data or had found deficiencies in the plans but failed to reject them while they waited a resolution of the deficiencies. On-site monitoring, or even more questioning of the field offices, would have identified this problem and allowed the headquarters staff to resolve it. Finally, while the Grant Management Process’s information system is supposed to be the headquarters staff’s principal monitoring tool, it has not been useful for recording information about field offices’ monitoring of grantees. At the time of our review, it did not contain a clear data entry point for field offices to record the results of their monitoring activities in the database. Therefore, field offices entered these results in different locations in the system. In order to determine where field offices were recording this information, HUD hired a contractor to peruse the system and identify all recorded information that appeared to be related to monitoring. The contractor’s report—covering the third and fourth quarters of fiscal year 1997—showed that the field offices were entering monitoring data in three of the system’s eight data entry points, and no monitoring information was entered for more than 75 percent of the grantees that were scheduled for on-site monitoring. Without a specific area in which field offices can record monitoring activities, headquarters staff cannot be assured that they have access to all pertinent monitoring information to oversee field offices’ operations. We were told by HUD that a process for tracking on-site monitoring activities was implemented. This includes the addition of Grants Management Process screens to allow field offices to describe their on-site monitoring activities in terms of the program monitored, program issues covered, the number of days spent with the grantee, issues identified and sanctions imposed. According to HUD, this addition to the system was implemented on March 29, 1999. As it is currently implemented, CPD’s Grants Management System provides little assurance that four block grant programs, funded at nearly $6 billion annually, are meeting their objectives and that the funds are being managed appropriately. While the Grants Management System’s approach to monitoring seems logical, it has not been effective. The field offices we visited are conducting limited on-site monitoring of grantees, although such monitoring is all the more important because of the shortcomings of IDIS. And when on-site monitoring does occur, it does not focus on the grantees who are the poorest performers, and it is not uniform or comprehensive. These problems are caused in part by a lack of uniform criteria on how to assess the level of performance for each grantee and the lack of specificity in the broad criteria that do exist to determine grantees’ compliance with program requirements, although such requirements are intended to encourage the safeguarding of funds. According to the directors of the field offices, the level of on-site monitoring is also lower because of a combination of a lack of staff resources and travel funds and increased responsibilities. While we found these problems with field offices’ monitoring of grantees, we also found that the headquarters staff’s oversight of the field offices was problematic. Headquarters staff rarely visit the field offices, and while the Grants Management Process information system is intended to be headquarters’ staff primary tool to oversee the field offices’ monitoring of grantees, at the time of our review, the information system did not contain a specific data entry point for field offices to enter data on their monitoring activities. In all, HUD has no assurance that program requirements are being fulfilled. These requirements are critical to its goal of restoring the public trust in its management of billions of dollars in formula grant funds. Until HUD strengthens its monitoring of the financial operations of and results achieved by program grantees and its field office operations, the integrity of its formula grant programs is at risk. In order to ensure that the Grants Management System identifies problems in achieving program objectives and safeguarding grant funds and protects the integrity of the block grant programs, we recommend that Secretary of Housing and Urban Development direct the Assistant Secretary for Community Planning and Development to take the following actions to improve oversight by field offices and headquarters: • Emphasize the importance of on-site monitoring by specifying the level of grantee performance that requires on-site monitoring and the steps that should be taken in conducting such monitoring. • Conduct analyses to determine the staffing and travel funds that may be required to better support the monitoring of grantees and direct available resources to the field offices as needed. • Direct desk officers within the Office of Community Planning and Development at headquarters to visit their field offices to better assess how well the field offices are monitoring their grantees, to determine what problems the field offices are experiencing, and to provide technical assistance. Improve the Grants Management Process information system by providing guidance to the field offices to ensure that they are entering information consistently. While HUD did not comment on our recommendations, it commented that our report did not recognize its recent improvements to internal controls and that our report focused too much on on-site monitoring. Specifically, it commented that its revamped approach to grants management ensures basic program compliance through a continuing, on-going process that includes on-site monitoring along with other elements. HUD commented that the majority of its monitoring activities can be done remotely, including review of key documents, the high risk assessment process, the grantee consultation, and the effective use of the Grants Management Process information system and IDIS. HUD also stated that it conducts on-site monitoring when conditions require it. Furthermore, HUD commented that it has distributed guidance adding more traditional risk factors to its annual comparative review and is in the process of updating its Grants Management Policy Notebook and Grants Management Process information system to better account for on-site monitoring. We disagree that the majority of monitoring activities can be done remotely. Our report shows that the tools other than on-site monitoring are not, at this time, providing the accurate and complete information HUD needs to effectively monitor program performance. We believe the questionable quality of the data from remote monitoring sources such as IDIS increases the need for on-site monitoring at this time. Additionally, for the field offices we visited, we found that HUD did not conduct on-site visits to many of the grantees it regarded as the poorest performers in 1998. Consequently, we continue to believe that HUD’s approach to managing the programs, as implemented, provides little assurance that the four grant programs are meeting their objectives and that the funds are being managed appropriately. In a draft of this report, we proposed that HUD provide clearer and more detailed guidance on the factors that should be considered in evaluating grantee performance, with a heavier emphasis on the factors that ensure compliance with program requirements. In view of the fact that HUD has distributed guidance adding more traditional risk factors to its annual comparative review, we deleted our proposed recommendation from the report. Furthermore, GAO proposed that HUD improve the Grants Management Process information system so that field offices have a single data entry point for information on their monitoring activities. In view of the fact that on March 29, 1999 HUD added Grants Management Process screens to allow field offices to describe their monitoring activities, GAO has deleted that proposed recommendation from the report. In addition, we added information to our report to reflect HUD’s new guidance on conducting its annual comparative review and its plans to update the Grants Management Policy Notebook. CPD’s chief monitoring tool for the Grants Management System—the Integrated Disbursement and Information System (IDIS)—does not produce the complete, accurate, and timely information that the Department should obtain from a computerized database to effectively manage and monitor almost $6 billion in block grants. The first of nine new standard integrated systems deployed by HUD to manage and monitor the programs, IDIS has major design flaws that make it difficult for grantees to enter information accurately and for field office officials and grantees to use the information to monitor performance. Furthermore, CPD cannot ensure that IDIS is safe from fraud and abuse because it has not put into place the security controls needed to safeguard the formula block grant funds. CPD has not developed a security plan to control and monitor access to the system to minimize opportunities for unauthorized or inappropriate transactions. In addition, CPD has not ensured that the security officer in charge of the system has clearly defined duties and the technical expertise and staff needed to oversee the system. HUD is now developing an agencywide information system that manages all 51 grant programs for the agency, and it plans to use IDIS, along with a grants management system being developed by the Department of Health and Human Services, as the basis for the new system. Although IDIS was designed to provide CPD with accurate, complete, and timely information on grantees’ expenditures and program performance, these goals are not being achieved because of four significant problems. Specifically, (1) the process for establishing and maintaining grant activity information is time-consuming and cumbersome and provides ample opportunity for major data entry problems, (2) correcting major data entry problems in IDIS is difficult, (3) IDIS does not readily enable grantees to accurately report income generated by grant-funded revolving funds (program income), and (4) grantees find it difficult to produce comprehensive and timely reports using IDIS. IDIS information is critically important in managing and monitoring grantees’ performance given CPD’s emphasis on remote monitoring (as discussed in ch. 2). Nevertheless, the system is so cumbersome that grantees, even though trained on IDIS, find it difficult to use to set up project and activity accounts and to maintain those accounts. For most of the grantees we visited, grantees had to enter data two or more times, found accessing and using IDIS to be time consuming, and had to work through a complicated series of steps to enter or retrieve information. To set up project and activity accounts, grantees have to enter much of the same information into two separate HUD information systems—IDIS and HUD’s Community 2020 system (or its precursor, Consolidated Planning Software). These systems are not automatically linked so that entering data into one system would automatically update both systems. In addition to the errors that grantees could make simply because they have to enter the data twice, other types of errors could occur that reduce the quality of the information produced by these systems. For example, one grantee we visited numbered projects differently between the two systems; consequently, it was difficult to compare the grantees’ project plan with the actual use of grant funds. While this initial set of double data entries is time-consuming and cumbersome, IDIS’ design provides yet another opportunity for redundancy. For example, for some projects grantees must enter nearly exactly the same information a third time to describe the projects’ activity. In one field office, the IDIS focal point told us that for 98 percent of the office’s projects, data had to be entered three times. Redundant data entry problems also occurred for most of the grantees we visited because they must enter activity information into their own automated accounting systems, as well as HUD’s systems, to comply with their city’s requirements. At the time of our review, CPD had not developed a reliable method to electronically transfer data between grantees’ systems and IDIS. This problem is especially troublesome for states that must enter data for all small cities under their program. For example, Texas—which at the time of our review had not yet started using IDIS—has the largest state community development program—287 subrecipient cities for which it must enter data. According to HUD, as of mid-February 1999, grantees had access to a batch file transfer process, referred to as Electronic Data Interchange, which allows grantees to automatically extract data from their own information systems and pass it to IDIS. Another difficulty for grantees is simply the amount of time it can take to access and use IDIS. Each time grantees enter information into IDIS, they use their desktop computers to link to a communications system, dial into IDIS, and enter a user identification number and password to obtain access to IDIS at authorized levels. We observed that it took up to 40 minutes to obtain access to IDIS. Remaining connected to IDIS is also difficult. One grantee estimates that it loses its connection to IDIS prematurely 50 percent of the time. Once they have obtained access, IDIS’ design forces grantees to work through a complicated series of steps to enter or retrieve information. The grantees must use designated function keys on the computer keyboard to take required actions at various points in this process, but the meaning of the function keys sometimes changes from screen to screen, causing some confusion and missteps for the grantees and prolonging the time it takes to enter data. In addition, a grantee must work through and exit two separate series of screens in order to enter both financial and performance data for the same activity. When grantees enter incorrect data, IDIS does not easily allow them to rectify the errors. Five of the 11 grantees we visited reported having multiple, significant errors in IDIS data entries that they could not readily correct. To address these problems, the IDIS technical assistance staff instructed grantees to open accounts for nonexistent activities (“dummy accounts”) in some instances, which in effect reverse the incorrect data. In one case, a grantee had incorrectly entered program income funds and had to open multiple dummy activity accounts and charge false amounts against them to rectify its error. Some grantees we spoke to were reluctant to create dummy accounts because these accounts would appear inaccurate or fraudulent to outside observers. Some of these problems were so severe that they made CPD’s monitoring activities through IDIS impossible. For example, one grantee had incorrectly entered all of its 1997 program year activities as occurring in the 1996 program year, thereby mixing activities for both years. To further complicate matters, this grantee had not expended all grant funds for 1996. As a result, CPD field and headquarters officials could not determine the amount of funds drawn down or the performance of program activities for either year without actually auditing the grantee’s documents. We brought this matter to CPD’s and the grantee’s attention in October 1998, and as of January 1999, it had still not been resolved. At 8 of the 11 grantees we visited, we compared data shown in IDIS with the information in the grantee’s files on the same activities. Although we only looked at a small number of randomly selected activities, we found a wide variety of significant data problems, ranging from a complete lack of performance data at one grantee to double-counting of accomplishments at another. For example, one grantee set up an activity to cover five types of services for senior citizens, ranging from home maintenance to transportation to a recreational center. The grantee then lumped all accomplishment data for these widely varying services together as one total number of elderly people served, even though individuals might participate in more than one of the services or be multiple users of the same service. These types of problems would not only make reports on individual grantees inaccurate but also make reports that combined data at a regional or national level meaningless or misleading. In addition to its overall design problems, IDIS also does not enable grantees to link program income—income produced by projects they have funded or repayments into revolving loan accounts—to the activity that generated it, such as economic development loans. HUD has instructed formula grantees not to enter program income from revolving fund programs into IDIS when they are received, as is done with other types of program income. This is because the design of IDIS does not allow grantees to segregate revolving fund income from other types of program income. IDIS operates on the assumption that all program income is depleted before grant funds are used, regardless of the type of grant activity being funded. Handling program revenues in this manner does not create a problem unless the income is associated with a revolving fund. However, CPD regulations provide grantees with specific permission to reserve program income from revolving fund programs for re-use exclusively in the revolving fund. According to a HUD official, 3,230 revolving funds were created in the Community Development Block Grant Program in 1994. To ensure that the program income from revolving funds is recycled into the revolving fund, HUD instructs grantees to only enter the income in IDIS at the moment they redistribute the money. However, HUD’s recommended remedy is flawed. It requires grantees to keep two sets of books: the actual amount of the revolving fund and the amount entered into IDIS. Entering program income only when it is needed for another loan shields the true amount from CPD representatives that monitor the project remotely through IDIS. It also makes it very difficult to ensure that the grantee is meeting its regulatory requirements. For example, because CPD cannot use IDIS to determine how much program income is being generated from revolving funds and therefore what a grantee’s total program income is, CPD cannot use IDIS to determine if a grantee is meeting a requirement to spend grant money in a timely manner. In addition, interest produced by revolving funds should not be recycled into the revolving fund for future use but should instead be returned to CPD, which is responsible for overseeing interest repayments—and forwarding the interest to the U.S. Treasury. Given the lack of information about revolving fund balances in IDIS, CPD will have trouble determining if a grantee is repaying interest as required. One regional CPD office, for example, received large interest repayment checks that resulted from revolving fund balances, but the office had not expected these repayments because it had been unaware of the balances. One grantee sent a check for $10,728.03 for interest earned by a revolving fund balance during a 13-month period. While IDIS was intended to allow CPD to track grantees’ performance on a real-time basis, it does not do so for several reasons. First, a grantee can withdraw all funds for an activity without entering any performance information for that activity, as was often the case with the grantees we visited. Most did not enter any performance data until the end of the program year, when such data were required to complete annual reports. Second, three grantees that did try to enter performance data were hindered from doing so because IDIS requires grantees to enter financial and performance data separately. Third, even when grantees enter information more frequently, the information may not be useful for tracking performance because IDIS does not identify when the performance data were entered. IDIS has only one entry field for entering performance data for the year, so that additional data entries erase previous entries. In addition to these overall problems, IDIS does not enable grantees to always record exact information on the outcomes of activities. Specifically, IDIS provides 12 choices for describing benefits, such as the number of youth, households, or businesses benefiting from projects. However, this list is not comprehensive enough to cover the wide range of benefits that occur in program activities. For example, one grantee had demolished four blighted buildings and to record this information in IDIS had to describe the work as four “public facilities” because there was no better option. At the field office level, then, real-time inquiries to IDIS for information on grantees’ performance are unreliable. Equally important, creating reports at the end of the program year or at any time is difficult. To create and print a report, the user—either the grantee or field office staff—must work through a series of IDIS screens—as many as 70 at one field office we visited—to begin to create a report. Problems can occur during this process. For example, at one field office, the staff could not produce any of the reports we had requested for 3 days because the IDIS software for producing reports was not functioning. In another field office, the staff could create reports for only one grantee—the first on the list of choices—and it took 24 hours to correct the problem. Furthermore, IDIS’ error messages can be difficult to decipher, making the task of fixing the problem even more time-consuming. Once the report is produced in IDIS’ mainframe computer, the user still has to transfer it to a desktop computer and edit it before it can be printed. Because of these difficulties, many of the grantees we visited did not produce any more reports from IDIS than were necessary for the end of program year reporting to HUD. In addition, at the time of our review, CPD had removed the function for the consolidated annual performance and evaluation report—a report all grantees must submit to HUD at the end of the program year—because IDIS was generating reports with errors. For example, we found that one grantee had entered correct information into IDIS, but the system produced a report with incorrect information. Besides reporting to HUD, grantees use the end of the year report to communicate information about the use of block grant funds to their citizens. This problem also frustrated the ability of CPD field office staff to provide headquarters with some progress reports. In January 1999, HUD was still attempting to correct the reporting capability within IDIS. Although grantees use IDIS to initiate the transfer of approximately $6 billion a year in grant funds, CPD has not established a secure method for setting up and maintaining access rights for using IDIS. While HUD cannot select which grantee staff should have access rights—that is the grantee’s responsibility—it can take actions to ensure that designated grantee staff have appropriate levels of access and that staff who leave the grantee’s employment do not retain access. To provide security against the inappropriate use of funds, for example, grantee staff should have limited, or segregated, access to the computer system. In such a case, the individual who could establish activity accounts would not also be able to approve the withdrawal of funds for those activities. However, HUD has not taken these actions to safeguard federal grants, either at headquarters or in the field offices. Furthermore, according to the HUD official responsible for IDIS security, at a basic level the staff resources devoted to this task are strained. He explained that the thousands of requests for new user accounts, reinstatement of expired user accounts, and revocation of accounts are handled only by himself, an assistant, and one contract employee. As a result, assigning access rights to a new user takes a month or more and there are no staff to catalogue the forms requesting access, making it difficult to review original access rights or retrieve forms when necessary. Additionally, neither the security official nor his staff review these requests for appropriateness, to determine whether the requested access rights are necessary to perform the duties assigned to the user or whether access rights ensure segregation of tasks such as setting up activities and approval of drawdowns. Instead, their main function has been to assign access rights to IDIS or to reinstate rights when passwords have expired. Even when notified by grantees that IDIS access rights should be revoked because the person with those rights is no longer employed by the grantee, the security official told us that removing the person’s rights is not a high priority. Once IDIS accounts have been established, grantees have the authority to change access levels for their staff without any level of oversight by CPD. At the time of our review, CPD did not periodically produce any reports for the grantees’ IDIS focal points or field office staff that showed the current access rights of the grantees’ staff. Not surprisingly, given this absence of oversight, we found multiple problems with access rights at five of the eight grantees with whom we discussed access rights. Specifically: • Duties among authorized users were not adequately segregated at three of the grantees, so these users could both set up activity accounts and draw down funds for those activities. Consequently, one individual could control key aspects of grant funding, increasing the opportunities for undetected error or fraud. IDIS user accounts for terminated employees or those on extended leave had not been revoked at two grantees. Furthermore, at one grantee, the terminated former IDIS system administrator continued to have all rights to the system, including the right to change access rights for other users. • HUD had erroneously assigned three individuals who had never been employees of one grantee a variety of access rights to the grantee’s data. In combination, the access rights for these individuals would have allowed them to set up activities as well as approve and draw funds. • Accounts were shared or used by individuals other than the authorized individual at two grantees. We also found a key control—passwords that cannot be easily replicated—was not in place to ensure that access to grantees’ IDIS resources is restricted to authorized users. Authorized access rights are circumvented when an authorized user’s account is used by another individual. We found that the combination of user account identifications and passwords to gain access to IDIS could be easily duplicated by knowledgeable users, making it hard to detect error, fraud, and abuse—including malicious tampering. The security official’s lack of basic knowledge about computer security generally, and security for IDIS in particular, presents another problem. The security officer told us that, although he is familiar with networks and desktop computers, his background does not include any security work, and he has not had any training in security methods for information systems since becoming a security officer for IDIS. He also does not have a working knowledge of the security software that contractors use to grant access and therefore cannot properly oversee them. Moreover, it is unclear whether CPD expects this official to oversee the contractor staff and what the scope of his duties should be in general. The officer could not provide us with a clearly defined position description that included his specific IDIS duties. Finally, he explained he views himself more as an “access facilitator” than a security person. HUD’s Inspector General’s report on HUD’s fiscal year 1998 consolidated financial statements also noted the need to improve IDIS’ security. The HUD Inspector General expressed concern that until the software for access controls is fully implemented, the mainframe system on which IDIS resides will not be protected against accidental or intentional damage. The Inspector General also reported that there is no consistent method of controlling changes in HUD’s applications system software, of which IDIS is a part. This creates an unnecessary risk to the software integrity of HUD’s mainframe application systems, according to HUD’s Inspector General. HUD officials told us they are in the process of developing a new Department-wide information system that manages all of its 51 grant programs. In September 1998, HUD completed a feasibility study on using existing information systems, such as IDIS, as the basis for that system. The study, performed by two HUD officials and a group of contractors, included interviews with a variety of HUD officials and other federal government officials, but none with users of IDIS. The study recommended that HUD develop a new system, called the Departmental Grants Management System, modeled on IDIS and the Grants Administration Tracking and Evaluation System, a grants management system being developed by the Department of Health and Human Services. The Grants Administration Tracking and Evaluation System, which uses a Windows environment, would provide the user interface for the Departmental Grants Management System. IDIS, converted for use in the new environment, would be used as the basis for withdrawing grant funds and reporting performance. On the basis of this recommendation, HUD is proceeding with development of the Departmental Grants Management System, which will rely on Windows and therefore be more user-friendly than the system we reviewed. In November 1998, HUD informed us that it is moving forward with the project, and HUD plans to have a pilot test of the converted IDIS in September 1999. With billions of dollars and the needs of millions of people at stake in the formula grant programs, HUD has recognized that it needs effective systems for overseeing the handling of program funds and the achievement of program objectives. While we agree that a tool providing timely and accurate data about grantees’ financial activities and performance would be greatly beneficial in overseeing the grant programs, the current system, IDIS, is not capable of serving as such a tool. IDIS has not provided the complete, accurate, and timely information field offices need for such monitoring. IDIS’ design makes grantees’ efforts unnecessarily difficult; affords multiple opportunities for incorrect data entry that grantees cannot then readily rectify; does not provide grantees with a straightforward method for managing program income from revolving funds, which results in an inaccurate portrayal of grantees’ financial activities; and does not require grantees to provide performance information when they draw down funds. In addition, without adequate security controls to prevent unauthorized access to the system, CPD cannot ensure that information in the system is reliable and that funds are safeguarded. Although HUD is in the process of developing the Departmental Grants Management System, it plans to convert IDIS and use it as a basis for the new system, which is to be used by all 51 of HUD’s grant programs. We agree that a more user-friendly system would be an improvement; but given the extent and nature of problems with IDIS, we question the use of IDIS as a model for the Department-wide system. To address the problems we identified, IDIS will need to be modified extensively or replaced, whichever is more cost effective. Of immediate concern, IDIS is not secure, and while it continues to be insecure, federal funds will not be protected appropriately. Because IDIS has not proven to be a useful tool in managing grantees, we recommend that the Secretary of Housing and Urban Development direct the Assistant Secretary for Community Planning and Development to consider whether it is more cost-effective to modify IDIS or replace it. After this determination is made and before IDIS is used as the base for developing the new grants management information system for all of HUD’s 51 grant programs, the problems we identified with IDIS should be corrected. HUD should ensure that the new system does not require redundant data entry, reduces the time needed to enter information, readily allows timely corrections of data, provides a straightforward method of accounting for program income from revolving funds, provides timely and accurate information on grantees’ performance, and readily produces reports. We also recommend that the Secretary—regardless of the decision on the future of IDIS—immediately take steps to ensure that access to IDIS is limited to authorized users and that those users have access levels appropriate to the duties they perform. Steps should also be taken to ensure that the security officer for IDIS is fully aware of the responsibilities that must be carried out and has the appropriate training and staff for those responsibilities. While HUD did not comment on our recommendations, it commented that our assessment of IDIS fails to consider recent efforts to improve IDIS. HUD commented that several of the weaknesses we identified did not take into account compensating factors. For instance, HUD commented that our assessment of IDIS’ inability to accurately track program income from revolving funds did not account for the quarterly Federal Cash Transaction Report (SF 272), which includes information on program income. Similarly, HUD commented that limitations in IDIS security are less important because accounts automatically expire after a period of nonuse. For other weaknesses we identified, HUD pointed out recent or planned changes to IDIS that it believed will correct the problems we identified. We continue to believe that IDIS’ untimely, inaccurate, and incomplete data, as well as its inability to track program income, hinder HUD’s ability to remotely monitor its grantees. While the Federal Transaction Report provides quarterly information on program income, as does IDIS, that information can be used only to track program income from nonrevolving funds. Furthermore, HUD is right that automatic account expirations resulting from nonuse have a security benefit, but the system is still vulnerable to unauthorized access until the account expires, and the account will not expire if someone continues to access the system inappropriately. We believe that HUD’s recent and planned changes could, if properly implemented, improve the integrity of IDIS. Training the IDIS security officer and providing periodic reports to field offices that show the current access rights of the grantees’ staff will improve security. Additionally, the data quality review effort could improve the quality of the data currently in IDIS, but future data quality may be impaired by the unresolved system design problems we noted. We also believe that the numerous additional problems in usability, accuracy, and security detailed in our report still compromise HUD’s ability to ensure the integrity of the four formula block grant programs. Therefore, we did not make any changes to the recommendations.

Summary: Pursuant to a congressional request, GAO provided information on whether controls are in place to ensure that block grant programs' objectives are being achieved and that funds are being managed appropriately, focusing on whether: (1) the Department of Housing and Urban Development's (HUD) on-site monitoring of grantees under the Grants Management System is adequate; and (2) the Integrated Disbursement and Information System provides the data HUD needs to accurately assess grantees' performance. GAO noted that: (1) while the Grants Management System provides a logical, structured approach to managing the four block grant programs, HUD's monitoring under the system--including on-site monitoring of grantees and the Integrated Disbursement and Information System--does not ensure that the programs' objectives are being met and that grantees are managing their funds appropriately; (2) HUD considers its on-site monitoring of grantees essential, but GAO found this monitoring is inadequate; (3) the five field offices GAO visited (accounting for about 20 percent of all block grant funds in fiscal year (FY) 1998, or $1.18 billion) conduct on-site monitoring infrequently because of a shift to a more collaborative relationship with the grantees and because of a lack of resources, according to the directors of the field offices; (4) furthermore, on-site monitoring seldom targets the grantees that receive the poorest evaluations from the field officers compared with other grantees, and this monitoring is not uniform or comprehensive because the field officers lack specific guidance; (5) the reviews of some grantees conducted by GAO and others, especially HUD's Inspector General, have identified significant problems in grantees' finances and performance; (6) while such reviews are not generalizable to all block grant programs, these reviews, along with the breakdowns in monitoring, call into question the integrity of programs funded at nearly $6 billion in FY 1998, including their safeguards against fraud, waste, and abuse; (7) for its part, HUD's Integrated Disbursement and Information System does not provide the information HUD needs to accurately assess grantees' performance and thus does not compensate for these breakdowns in monitoring; (8) fraught with major design flaws, the information system makes the process for establishing and maintaining accounts difficult and provides ample opportunity for major problems with entering data, does not allow such problems to be corrected easily, cannot track the program income from the revolving funds that grantees establish, does not provide timely and accurate information, and has difficulty producing reports; and (9) GAO also determined that the security controls for the information system are weak and therefore do not provide assurance that the system is safe from fraud and abuse.