On October 8, HUD’s Office of Inspector General reported that Puerto Rico could not support 49 of the 74 disaster recovery payments auditors sampled, totaling $47.8 million. Puerto Rico says the paperwork exists and the real problem is presentation. HUD’s disaster office, asked to weigh in, agreed with the auditors on every recommendation, and then noted that FEMA is the agency that decides whether a project’s cost share was met.
That last point is the story. The gap underneath it has been in the public record since February 2025.
A Buffer Is Not a Receipt
When FEMA pays for disaster repairs, the grantee covers a share of each project, typically 10 to 25 percent. Federal law lets grantees use HUD disaster block grant money (CDBG-DR) for that share, which puts one agency’s dollars to work satisfying another agency’s rules. Congress has given HUD $109 billion in disaster supplementals since 2001. The audit examined the $9.7 billion HUD awarded Puerto Rico under two Hurricane Irma and Maria grants, narrowing to four match activities, 780 payment line items, and roughly $84 million spent as of July 2024. Auditors sampled 74.
Forty-nine did not hold up. Seven payments leaned on the same invoices as other payments. Thirty-nine were incomplete: for 29 of them, Puerto Rico supplied invoices roughly equal to the match percentage plus a 5 percent “buffer,” without the total project costs needed to verify the allocation, and for ten it offered lists of invoices or proof-of-payment records instead of invoices. Three came with invoices totaling $6.2 million against projects whose match payments implied total costs of about $4.5 million, leaving auditors unable to tell which documents supported which payment.
The buffer deserves its own paragraph. Puerto Rico’s program guidelines let staff keep support for only the match amount plus 5 percent, on the theory that some invoices might later prove ineligible. OIG’s view is that the extra paperwork added noise rather than evidence, since it could not be traced to any specific payment.
Separately, 26 of the 74 payments folded in costs FEMA would not allow on those projects, including the grantee’s own salaries and its contractors’. Those were eligible disaster expenses wearing the wrong label. The sample held $2.8 million of them, and OIG projects at least $7.17 million across the full universe.
Recordkeeping, Said the Record-Keeper
Puerto Rico’s formal response calls the findings recordkeeping and data-presentation matters, not improper payments. It says reimbursements move in stages, so total project costs often are not known when each request is reviewed, and that one invoice can appear in several requests because only an allocated slice supports each payment. It concedes that documents for eight of the 49 were inadvertently left out of what auditors received, and maintains the other 41 were adequately supported. It has agreed to tighten its procedures, some of which it says are already in place.
OIG’s rebuttal rests on definitions. Under the federal cost rules quoted in the report’s criteria appendix, a payment counts as improper when missing or insufficient documentation prevents a reviewer from determining whether it was proper. “Unsupported” is a category, not an accusation. OIG says Puerto Rico’s records never showed how the shared invoices were divided among the payments, so each payment stayed unsupported.
Some fairness belongs here. The report does not find that money was stolen or wasted, and its recommendation is that Puerto Rico “support or repay,” which leaves room for the documents to appear. The headline fraction also needs care. The 66 percent figure describes the sample, which was weighted toward large payments. Projected across all 780 payments, OIG estimates at least 24 percent, or 189 payments, are unsupported. The $54.8 million projection is a lower bound at 95 percent confidence across that whole universe. It appears to include the sampled items rather than sit on top of the $47.8 million, though the report’s use of “additional” is ambiguous on that point.
Everyone Agrees, Eventually
Puerto Rico’s defense leans on an argument HUD supplied. Its letter invokes CPD’s “previously stated position” that the Disaster Recovery Grant Reporting system, DRGR, is built for activity-level reporting rather than cost-category accounting. It agrees that match spending cannot be separately identified inside DRGR, while insisting its own records can. The letter does not say where CPD stated that position. The nearest match I found is CPD’s response to OIG’s February 2025 interim report, and that connection is my inference, resting on the similarity between the two documents’ descriptions of DRGR.
That interim report is the hinge. While auditing Puerto Rico and three other grantees, OIG found that CPD recommends, but does not require, that grantees report match activity in DRGR. Of 79 active grantees, 34 indicated they were using more than $1.2 billion for match, and 12 of those reported no amounts. Two of the four audited grantees reported nothing while confirming $401 million in match activity, and the other two left out more than $512 million. OIG recommended making the reporting mandatory.
CPD declined to commit. It said no regulation requires a specific format, that adding reporting to DRGR was impractical given the system’s limited capacity and maintenance backlog, and that DRGR is not an accounting system or a tool for other agencies to track match. It pointed to monitoring visits, to narrative text in quarterly reports, and to payment-integrity risk assessments for fiscal 2021 through 2023 that found the program under the overpayment threshold with no findings. OIG answered that the fields already exist, that narrative text is an unreliable way to find match activity, and that GAO had previously flagged the risk of duplicated benefits between HUD and FEMA.
The 2026 audits then arrived on schedule. Colorado, April 23: no duplicate or significant unsupported match payments, but $1.3 million of other disaster costs reported as match. New Jersey, June 30: 17 of 64 Hurricane Sandy items and all eight Hurricane Irene items unsupported, plus $174,352 in commingled costs. Puerto Rico, October 8. Three audits, three severities, one repeated explanation: CPD’s policies did not require separate reporting. OIG’s website still lists its Colorado recommendation, that CPD require match reporting that documents the FEMA percentage was met, among its open recommendations.
The Law Is New. The Blind Spot Is Not.
The 21st Century ROAD to Housing Act became law in July without the President’s signature. It authorizes CDBG-DR for three years, which the OIG report treats as the first formal codification of the program. Until now, HUD ran disaster recovery on Federal Register notices bolted onto the regular block grant framework. Those rules direct HUD to give states “maximum feasible deference” in interpreting requirements, a phrase the report says originated with HUD’s lawyers rather than the statute, and one it says states have used to adopt looser requirements.
The report does not blame that doctrine for the Puerto Rico findings. Here is my inference, resting on that footnote and on the report’s observation that the joint HUD and FEMA match guidance (Notice CPD-20-10) never mentions the federal cost principles requiring documented, allocable costs: a program that defers to the grantee’s definitions and omits the audit-trail rules from its match guidance leaves each grantee to invent its own ledger. A 5 percent buffer is what that looks like in practice.
What to watch is the $617 million in match funds Puerto Rico had not yet spent as of March 31, 2026, the money the recommendations aim to protect. The summaries of the new law I reviewed do not mention match tracking, and I have not read the statutory text, so whether HUD’s implementing rules will require separate reporting is an open question. The audit resolution process, in which HUD decides whether Puerto Rico supports or repays $47.8 million, is the next place to look.
The auditors asked for a ledger. HUD asked whether a ledger was practical. Puerto Rico supplied a buffer. It turns out the ledger was optional, and so was knowing whether the match was met.
