Audit 296494

2023-001 - Internal Control over Federal Award – Reporting (VMS) – Significant Deficiency in internal controls over compliance over reporting. ALN and Title: 14.871 Section 8 Housing Choice Vouchers Federal Agency: US Department of Housing and Urban Development Award Year: 2023 Criteria - Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In addition, program reporting requires HUD-52681-B, Voucher for Payment of Annual Contributions and Operating Statement (OMB No. 2577-0169). The PHA submits this form monthly to HUD electronically via the VMS. Congress has instructed HUD to use VMS data to determine renewal funding levels. Condition - The HUD 52681-B VMS report is not reviewed prior to submission. Cause - Because the Authority has few employees they communicate daily and therefore did not recognize the need for review. Effect - Potential non-compliance with program requirements and that non-compliance may go undetected for an extended period of time. Questioned Costs - None Perspective - The documentation of review was not retained for any of the twelve monthly reports. Recommendation - The Authority should establish a clearly documented review process wherein someone other than the preparer reviews the VMS report prior to submission. Management Response: The Authority will have a member of management review VMS submission prior to submission. Estimated Completion Date: February, 2024 Responsible Party: Executive Director, Deputy Director and Assistant Deputy Director.

2023-009 Application Access Control – Significant Deficiency in internal control over compliance over reporting ALN and Title: 14.871 Section 8 Housing Choice Vouchers Federal Agency: US Department of Housing and Urban Development Award Year: 2023 Criteria – NMAC 1.12.20.14 (A) Application Access Control, “Access to agency business and systems applications shall be restricted to those individuals who have an identified business need to access those applications or systems in the performance of their job responsibilities.” ”In addition, Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – All the users for the Housing Authority within the “Housing Pro” software have administrative level access. Cause – The Housing Authority gave all of their section 8 and public housing employees’ full access within the “Housing Pro” software, without considering the need to modify user permission based on their job responsibilities. Effect – The users can access modules within the “Housing Pro” software for which their job duties do not allow for. Questioned Costs - None Perspective –All employees have administrative access to the Housing Pro software. Recommendation – We recommend that the Housing Authority should review each employees’ access permissions within the “Housing Pro” software and modify their access according to their job responsibilities. Management Response: All employee access was reviewed and corrected so that only the two Deputy Directors have administrative access. Estimated Completion Date: November 30, 2023 Responsible Party: Deputy Director

2023-001 - Internal Control over Federal Award – Reporting (VMS) – Significant Deficiency in internal controls over compliance over reporting. ALN and Title: 14.871 Section 8 Housing Choice Vouchers Federal Agency: US Department of Housing and Urban Development Award Year: 2023 Criteria - Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In addition, program reporting requires HUD-52681-B, Voucher for Payment of Annual Contributions and Operating Statement (OMB No. 2577-0169). The PHA submits this form monthly to HUD electronically via the VMS. Congress has instructed HUD to use VMS data to determine renewal funding levels. Condition - The HUD 52681-B VMS report is not reviewed prior to submission. Cause - Because the Authority has few employees they communicate daily and therefore did not recognize the need for review. Effect - Potential non-compliance with program requirements and that non-compliance may go undetected for an extended period of time. Questioned Costs - None Perspective - The documentation of review was not retained for any of the twelve monthly reports. Recommendation - The Authority should establish a clearly documented review process wherein someone other than the preparer reviews the VMS report prior to submission. Management Response: The Authority will have a member of management review VMS submission prior to submission. Estimated Completion Date: February, 2024 Responsible Party: Executive Director, Deputy Director and Assistant Deputy Director.

2023-009 Application Access Control – Significant Deficiency in internal control over compliance over reporting ALN and Title: 14.871 Section 8 Housing Choice Vouchers Federal Agency: US Department of Housing and Urban Development Award Year: 2023 Criteria – NMAC 1.12.20.14 (A) Application Access Control, “Access to agency business and systems applications shall be restricted to those individuals who have an identified business need to access those applications or systems in the performance of their job responsibilities.” ”In addition, Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – All the users for the Housing Authority within the “Housing Pro” software have administrative level access. Cause – The Housing Authority gave all of their section 8 and public housing employees’ full access within the “Housing Pro” software, without considering the need to modify user permission based on their job responsibilities. Effect – The users can access modules within the “Housing Pro” software for which their job duties do not allow for. Questioned Costs - None Perspective –All employees have administrative access to the Housing Pro software. Recommendation – We recommend that the Housing Authority should review each employees’ access permissions within the “Housing Pro” software and modify their access according to their job responsibilities. Management Response: All employee access was reviewed and corrected so that only the two Deputy Directors have administrative access. Estimated Completion Date: November 30, 2023 Responsible Party: Deputy Director