Certified Mortgage Planning Specialist (CMPS)

Correct: Under HUD Handbook 4350.3 and the Privacy Act of 1974, owners and agents are legally required to protect Personally Identifiable Information (PII). This includes ensuring that any individual with access to the EIV system has signed the Rules of Behavior and that all sensitive documents are disposed of in a manner that makes them unreadable and undecipherable, such as shredding or burning, to maintain regulatory compliance.

Incorrect: Granting maintenance staff full access to tenant files violates the ‘need to know’ principle, as maintenance duties rarely require access to sensitive financial or personal data. Sharing information with law enforcement without a subpoena or specific written consent violates the Privacy Act. Storing files in an unlocked area, even during business hours, fails to meet the security requirements for safeguarding PII against unauthorized access.

Takeaway: Strict adherence to HUD’s security protocols, including signed behavioral agreements and secure disposal methods, is mandatory for protecting tenant confidentiality and maintaining program compliance.

Correct: Under Section 504 of the Rehabilitation Act and the Fair Housing Act, housing providers are permitted to verify the nexus between a disability and a requested modification if the need is not obvious. However, they are strictly prohibited from requesting specific medical diagnoses or full medical histories. Implementing a standardized protocol that uses a reliable third party (such as a doctor or social worker) to confirm the need for the modification ensures the property meets regulatory documentation standards while protecting tenant privacy.

Incorrect: Requesting full medical records is a violation of privacy and exceeds the scope of permissible inquiry under Fair Housing laws. Suspending requests constitutes an unreasonable delay, which HUD and other regulatory bodies interpret as a de facto denial of the request, potentially leading to discrimination charges. Property manager affidavits are generally insufficient for verifying non-obvious disabilities and do not meet the professional standard for third-party verification required by state housing finance agencies.

Takeaway: Effective compliance in affordable housing requires balancing the verification of disability-related needs with the strict privacy protections afforded to tenants under federal law.

Correct: According to HUD guidelines for Management and Occupancy Reviews, owners must respond to findings within 30 days. If certain items cannot be completed due to factors outside the owner’s control, such as delayed third-party verifications, the owner must proactively request an extension from the Contract Administrator or HUD, documenting the progress made and the expected completion date to demonstrate a good-faith effort toward compliance.

Incorrect: Using self-certifications as a permanent substitute for required third-party verification without following the proper hierarchy of verification is a violation of HUD Handbook 4350.3. Delaying the entire submission past the 30-day deadline without an approved extension can lead to further sanctions or a referral to the Departmental Enforcement Center. Internal re-classification of findings does not satisfy the regulatory requirement to resolve the actual deficiency identified by the HUD auditor and would be considered an audit failure.

Takeaway: Effective Corrective Action Plans require proactive communication and formal extension requests when regulatory deadlines cannot be met due to external delays.

Correct: Under the Fair Housing Act and Section 504, when a disability is not obvious, a housing provider may request reliable disability-related information that is necessary to verify that the person has a physical or mental impairment that substantially limits one or more major life activities and that there is a disability-related need for the requested accommodation (the nexus). The provider must engage in an interactive process but cannot require the disclosure of a specific diagnosis. Documenting the connection between the disability and the requested accommodation is the standard for professional compliance.

Incorrect: Denying a request because a specific diagnosis is not provided is a violation of privacy and fair housing laws, as residents are not required to disclose their specific medical condition. Granting all requests without verifying the nexus can lead to inconsistent policy application and may not be sustainable for property operations. Requiring a specific, proprietary form or notarization is considered an unnecessary barrier to the accommodation process and is generally prohibited by HUD guidance.

Takeaway: Effective management of reasonable accommodation requests relies on an interactive process that verifies the nexus between a disability and the requested accommodation without demanding a specific medical diagnosis or using restrictive verification forms.

Correct: According to HUD Handbook 4350.3, owners of subsidized properties are required to follow an Affirmative Fair Housing Marketing Plan (AFHMP) to ensure that individuals of similar income levels in the same housing market area have a like range of housing choices available to them. When vacancy rates are high despite market demand, it often indicates a failure in marketing outreach or waitlist management. Reviewing the AFHMP and waitlist procedures ensures the property is actively and fairly seeking eligible tenants as required by federal regulations.

Incorrect: Reclassifying units as non-assisted does not address the underlying compliance failure regarding unit utilization and may violate the Housing Assistance Payments (HAP) contract. Waiving citizenship or immigration status requirements is a direct violation of Section 214 of the Housing and Community Development Act of 1980, which restricts assistance to eligible individuals. Adjusting utility allowances is a regulated process based on actual consumption data and cannot be used as a marketing tool to bypass standard leasing procedures.

Takeaway: Maintaining low vacancy rates in HUD-subsidized housing requires strict adherence to the Affirmative Fair Housing Marketing Plan and proactive, non-discriminatory waitlist management.

Correct: A Data Use Agreement (DUA) is a critical control in Public-Private Partnerships to ensure that both parties understand their responsibilities regarding PII. It limits data usage to specific, authorized purposes and ensures that data is disposed of properly, aligning with HUD and LIHTC compliance standards and protecting tenant privacy throughout the long-term compliance period.

Incorrect: Shifting liability through insurance does not address the procedural gap or prevent data breaches, and such policies are often difficult to secure for third-party errors. Verbal communication is insufficient for regulatory compliance, as it prevents proper auditing of eligibility determinations and violates record-keeping requirements. Anonymizing data is often impossible in housing programs because the public agency must verify the specific identity of the tenant to confirm program eligibility and prevent fraud.

Takeaway: Formalizing data-sharing protocols through agreements is essential for managing privacy risks and ensuring regulatory compliance in housing-related Public-Private Partnerships.

Correct: According to HUD’s 2016 Office of General Counsel guidance, blanket bans on individuals with criminal records often result in a disparate impact on protected classes. To avoid litigation and enforcement actions, housing providers must demonstrate that their screening criteria are necessary to achieve a substantial, legitimate, non-discriminatory interest. An individualized assessment that takes into account the specific nature of the crime and the time passed since the conviction is the standard for ensuring the policy is not discriminatory in practice.

Incorrect: Applying a blanket ban consistently does not protect a provider from disparate impact claims, which focus on the outcome of the policy rather than the intent. A 15-year look-back period is often considered too long and arbitrary by HUD without an individualized assessment, and there is no official 15-year safe harbor. Finally, a housing provider cannot delegate away their legal responsibility for Fair Housing compliance; they remain liable for the discriminatory effects of policies implemented by third-party vendors acting on their behalf.

Takeaway: To mitigate Fair Housing litigation risk, providers must replace blanket criminal exclusions with individualized assessments that evaluate the specific circumstances of an applicant’s history.

Correct: In the context of HUD-assisted housing and risk management, transparency and proactive mitigation are essential. Reporting to stakeholders must include a clear identification of the regulatory breach (EIV reconciliation failure), the potential impact (negative MOR rating and loss of subsidy standing), and a concrete plan for remediation. This ensures that executive leadership can make informed decisions regarding the bank’s exposure and the performance of the outsourced vendor.

Incorrect: Classifying a recurring regulatory failure as a low-priority variance ignores the immediate risk of an ‘Unsatisfactory’ or ‘Below Average’ MOR rating, which can have severe financial and legal consequences. Requesting a postponement from HUD based on internal vendor issues is unlikely to be granted and may invite further scrutiny. Withholding information from stakeholders or relying on liability waivers does not address the underlying compliance failure and violates the principles of professional audit and risk management judgment.

Takeaway: Effective stakeholder reporting requires the timely communication of regulatory non-compliance alongside a viable mitigation strategy to protect the organization from financial and reputational damage.

Correct: HUD requires that owners and agents use the most current income limits and affordability data as soon as they become effective. When a control failure reveals that outdated data was used, the correct course of action is to update the system immediately and perform a retrospective review to ensure that all households admitted or recertified during the period of the error meet the actual regulatory requirements for affordability and income eligibility.

Incorrect: Delaying the update for reporting consistency (option b) is a violation of HUD’s mandatory effective dates for income limits. Applying new indices only to new applicants (option c) fails to address the potential non-compliance of certifications already processed with incorrect data. Adjusting risk thresholds (option d) is a model management technique that does not resolve the underlying regulatory compliance failure regarding individual tenant eligibility and rent calculations.

Takeaway: Regulatory compliance in housing affordability requires the immediate application of updated HUD income limits and the correction of any certifications made using outdated data.