FEDERAL HOUSING FINANCE AGENCY OFFICE OF INSPECTOR GENERAL FHFA’s Call Report System Audit Report: AUD-2012-006 July 19, 2012 July 19, 2012 TO: Jon Greenlee, Deputy Director of Enterprise Regulation Naa Awaa Tagoe, Senior Associate Director of Financial Analysis, Modeling & Simulations FROM: Russell A. Rau, Deputy Inspector General for Audits SUBJECT: FHFA’s Call Report System (Audit Report No. AUD-2012-006) Summary The mission of the Federal Housing Finance Agency (FHFA or Agency) includes supervising and regulating the Federal National Mortgage Association (Fannie Mae), the Federal Home Loan Mortgage Corporation (Freddie Mac), and the 12 Federal Home Loan Banks (FHLBanks)— collectively, the GSEs. In the wake of the housing crisis, the importance of this mission is made clear by the approximately $187.5 billion in taxpayer funds that have been invested through March 31, 2012, to stabilize Fannie Mae and Freddie Mac (collectively, the Enterprises).1 In part, the Agency safeguards the public’s investment by analyzing the GSEs’ financial and performance data to ensure their safety and soundness. FHFA’s Office of Inspector General (FHFA-OIG) concludes that FHFA can enhance its supervision of the Enterprises by analyzing opportunities to better use the Agency’s call report system (CRS). CRS gathers GSE data and funnels valuable oversight information, such as quarterly financial reports, into a central database that FHFA divisions can access to monitor and examine GSE activity. For example, CRS contains data on the $5.3 trillion total net assets held by Fannie Mae and Freddie Mac through 2011. However, despite requiring the Enterprises to enter data into CRS, FHFA has not optimized its use of the system to enhance its oversight. For example, two FHFA supervisory divisions rarely use CRS in their analysis and oversight of the Enterprises; instead, they receive routine submissions of loan-level data and standard management reports 1 The Housing and Economic Reform Act of 2008 authorized the Department of the Treasury to support the Enterprises by purchasing their preferred stock pursuant to Senior Preferred Stock Purchase Agreements. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 containing relevant metrics and data.2 These submissions are supplemented by ad hoc requests for additional data. The standard management reports submitted by the Enterprises are the same reports used by their senior executives to track financial performance and risk exposure, and in some instances to brief the Board of Directors. Given the existence of CRS (and the pre-existing investment in it), FHFA should consider using the system’s data to supplement or replace information drawn from these other sources. In addition, data produced pursuant to ad hoc requests may not be subject to the same integrity controls as are associated with CRS information. For example, CRS security controls have been independently evaluated in accordance with Federal guidelines.3 Also, FHLBank and Enterprise management attest to the accuracy of CRS data in their respective call reports. Recently, FHFA has taken some positive steps with respect to CRS. For example, the division that examines the Enterprises has a new management team that is experienced with CRS and has expressed support for using the system. Along with FHFA-OIG’s recommendations to analyze further integrating CRS data into GSE oversight, such steps can advance FHFA’s ability to promote the GSEs’ safety and soundness and to protect the taxpayers’ financial stake in their performance. Background The Housing and Recovery Act of 2008 (HERA) created FHFA out of two agencies, the Federal Housing Finance Board (FHFB) and the Office of Federal Housing Enterprise Oversight (OFHEO), to: promote the GSEs’ safety and soundness; support housing finance and affordable housing goals; and facilitate a stable and liquid mortgage market. To help meet these objectives, FHFA established one support and three supervisory divisions that correspond to the Agency’s major oversight responsibilities. 2 In contrast, the Agency’s Division of Bank Regulation, which oversees the FHLBanks, extensively uses CRS data to monitor, examine, and verify FHLBank activity. 3 In 2009, FHFA’s Chief Information Security Officer reported that an independent security certification of CRS was conducted in 2009 in accordance with certification and accreditation guidance from the Office of Management and Budget and the National Institute of Standards and Technology. Based on a review of the certification results, FHFA’s Chief Information Officer determined that CRS system risk was acceptable in terms of agency operations and assets. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 2 Figure 1: FHFA’s Supervisory and Support Divisions FHFA's Acting Director Division of Division of Division of Bank Enterprise Housing Mission Regulation Regulation and Goals Division of Examination Programs and Support As shown in Figure 1 above, FHFA’s supervisory divisions oversee the FHLBanks, the Enterprises, and the accomplishment of their respective housing goals (e.g., affordable housing), while the support division helps the three supervisory divisions apply consistent examination programs. More specifically: The Division of Bank Regulation (DBR) FHFA’s DBR monitors the FHLBanks and uses the results to plan annual examinations. Along with periodic visits, this helps the division assess the banks’ financial condition and performance in addition to their regulatory compliance. The Division of Enterprise Regulation (DER) Similar to DBR, the Agency’s DER monitors the Enterprises and uses the results to plan annual examinations, which also combine with periodic visits to help the division assess their financial condition and performance and their regulatory compliance. The Division of Housing Mission and Goals (DHMG) DHMG is responsible for the development, analysis, and oversight of: the Agency’s housing and regulatory policy; the Enterprises’ mission and goals; and the FHLBanks’ housing finance and community and economic development missions. The Division of Examination Programs and Support (DEPS) FHFA’s DEPS develops and supports examination programs for the three supervisory divisions, including their risk examination and modeling. DEPS also develops guidance for ensuring the GSEs’ safety and soundness; establishes policies for their accounting, auditing, and financial disclosure; monitors their compliance with policy; and promotes consistent accounting practices that provide for financial transparency. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 3 In general, the divisions supervise by monitoring and examining the GSEs, which means they need efficient access to current, quality information about GSE finances and performance. To help the divisions accomplish their oversight, FHFA requires GSEs to submit data about their condition and performance via multiple platforms, including loan-level data submissions, submissions of routine management reports, and CRS. What is CRS? CRS is a centralized information system that can provide data for various oversight analyses. In 2001, one of FHFA’s predecessor organizations, FHFB, implemented CRS to collect information from the FHLBanks. In 2006, the Agency’s other predecessor, OFHEO,4 initiated a project to develop its own CRS to manage the Enterprises’ data and make their condition and risks more transparent.5 The project’s participant included a number of key stakeholders, including many who are now members of FHFA’s executive management team (e.g., the Acting Director). In 2008, FHFA adopted FHFB’s CRS and expanded its scope to include Enterprise data. In 2011, FHFA established goals for enhancing CRS as an automated supervisory tool to measure risk, analyze finances, and examine both the FHLBanks’ and the Enterprises’ performance and compliance. The Enterprises and the FHLBanks funnel their information into CRS through different channels. The Enterprises enter data directly into the system. Alternatively, the FHLBanks generally submit their information to the Office of Finance, which validates, manages, and controls the data. As a safeguard, the FHLBanks can enter data into the system manually to adjust (e.g., correct, clarify, etc.) the Office of Finance’s submissions. The following figure shows the information flow from the GSEs to the FHFA divisions that monitor, examine, and analyze the GSEs’ data. 4 OFHEO and FHFB preceded FHFA; HERA abolished both predecessor agencies. 5 OFHEO Strategic Plan, 2006-2011. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 4 Figure 2: Data Flow from GSEs Through CRS to FHFA’s Supervisory Divisions External Users Call Report System FHFA Examination (Data Input) and Support Teams Financial Reporting System Office of Finance DBR ‒ FHLBank Data Monitoring and Analysis Call Manually Report FHLBank Data DBR ‒ FHLB FHLBanks Examination System Teams Fair Value FHLBank Data Enterprises Balance Sheet DHMG ‒ Financial Analysis DER ‒ does not use CRS The GSEs and FHFA divisions have taken steps to provide for the integrity of CRS data, including manual and automated controls to help ensure accuracy and completeness. DBR’s bank evaluation teams test those controls at each bank. Similarly, uploaded data are validated against information that GSEs submit in other reports (e.g., FHLBanks’ financial statements). Moreover, the FHLBanks and the Enterprises are required by FHFA policy to have a senior official attest that their call report data are true and correct. Also, for verification purposes, supporting records must be maintained. CRS provides an integrated framework through which the GSEs report data that FHFA’s supervisory divisions can use to assess their safety, soundness, and mission compliance. Yet, only DBR uses the system comprehensively. Divisions’ Use of CRS Data to Supervise GSEs CRS provides almost all the data DBR uses to facilitate its day-to-day oversight of the FHLBanks.6 For example, the division pulls data from CRS, such as accounting information, to 6 Roughly 90% of all the data DBR uses comes from CRS; the division also relies on the FHLBanks’ financial statements, their membership database, and public sources such as Securities and Exchange Commission reports. These sources are useful because they contain comparative data about the broader financial markets. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 5 populate charts and graphs that show the banks’ financial activity and condition. This information helps DBR analyze financial trends or activities, including investments, mortgages, and earnings. DBR’s examination teams also use CRS data to plan their examinations and to validate information provided by the FHLBanks. For example, CRS contains financial statement data, including performance/risk metrics, that help DBR plan its examinations. Specifically, DBR can pull data about an FHLBank’s investment portfolio and measure it against similar investments by other FHLBanks.7 If the portfolio is underperforming comparatively, DBR may focus its examination resources to find out why. According to DBR officials, CRS is critical to the success of their financial analyses and examinations. Unlike DBR’s well-established use of the FHLBanks’ CRS data since 2001, the Enterprises did not begin entering information into CRS until 2008. Further, with resources focused on merging its two predecessors (i.e., FHFB and OFHEO) and stabilizing the GSEs, FHFA did not fully integrate the relatively new data system for the Enterprises into its oversight of them through DHMG and DER. For example, in contrast to DBR’s robust use, DHMG’s Financial Analysis Branch of the Office of Financial Analysis, Modeling and Simulations uses only one CRS report for analysis of the Enterprises: Fannie Mae’s fair value balance sheet, which is an accounting estimate of assets and liabilities. DHMG uses the estimate together with data from multiple sources to prepare monthly financial performance reports. Otherwise, the Enterprises submit data used for DHMG’s oversight via loan-level data submissions and Excel spreadsheets. DHMG also relies on routine submissions of electronic copies of standard management reports, quarterly financial reports, industry reports, and commercial sources of financial data. DER does not use any information in the system to plan, validate, or otherwise facilitate its Enterprise examinations. Instead, the division relies on ad hoc data requests and conversations with Enterprise management to assess emerging risks. DEPS, which manages CRS and supports the other divisions’ examinations, also has not developed guidance for fully integrating the system into supervisory activities. In summary, CRS offers FHFA supervisory divisions a central data repository that can help them monitor, assess, and examine GSEs to ensure their safety and soundness. The various divisions’ use of CRS, however, differ considerably. 7 For the FHLBanks, there are nine categories of schedules (i.e., reports): monthly, quarterly, book value, income/expense, fair value, derivatives, member summary, community investments, and advances. Each category has multiple reports, which include mortgage loans held in portfolio, securities, and liquidity. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 6 Audit Objective FHFA-OIG initiated this performance audit to assess FHFA’s use of CRS to facilitate its oversight of the GSEs. Specifically, the audit addressed: (1) DBR, DHMG, and DER’s comparative use of CRS; and (2) FHFA’s reliance on ad hoc data collection and reporting in lieu of CRS. Finding: FHFA Can Enhance Its Supervision of the Enterprises by Analyzing Opportunities to Better Use CRS FHFA has supported using CRS to strengthen its oversight of the Enterprises. In 2011, the Agency set a goal of enhancing automated supervisory tools, such as CRS, to facilitate oversight activities.8 This goal is in line with the Office of Management and Budget’s Management of Federal Information Resources directive, which requires federal agencies to review periodically their information systems to determine if they fit agency mission requirements.9 Generally, such evaluative reviews can “document effective management practices for broader use.”10 Further, after implementing systems such as CRS, agencies should analyze what information they use and how it flows through their organization, which indicates “where the information is needed and how the information is shared to support mission functions.”11 However, DHMG’s use of CRS data for analysis of the Enterprises is limited and DER does not use any CRS data to plan, validate, or otherwise facilitate Enterprise examinations. This limited use is partly due to CRS not becoming available for Enterprise data until 2008 when HERA created FHFA. Further, due to the need to merge its two predecessors into one Agency and simultaneously stabilizing the GSEs, FHFA has yet to establish processes that fully integrate the system into its day-to-day supervision of the Enterprises. As a result, the Enterprises populate the system with financial statements and related information, but DHMG and DER rely on the submissions of loan-level data and electronic copies of management reports used by executives at the Enterprises to track financial performance and risk exposure. This alternative information is supplemented by ad hoc data requests as necessary. Gathering data this way outside of CRS, however, can lead to inefficiency, uncertainty, and inconsistency. 8 FHFA, 2011 Annual Performance Plan (Goal 4.4). 9 Office of Management and Budget, Management of Federal Information Resources, Circular A-130 Revised, “Policy,” (b)(1)(c)(ii). 10 Id., (b)(1)(d)(i). 11 Id., (b)(2)(b)(ii). Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 7 FHFA’s supervisory efficiency could increase if GSEs regularly populate CRS with data routinely required by its divisions, such as information about seriously delinquent loans, borrower assistance, and property inventory. Instead, FHFA’s divisions separately–and potentially duplicatively–draw information from over 200 data reports, including the Enterprises, newspapers, and other commercial data providers (e.g., Bloomberg). With this data available in CRS, FHFA’s divisions could reduce their reliance on so many outside sources and instead query a more centralized database. Uncertainty is another risk of not using CRS. For example, the Office of Finance helps assure the integrity and quality of data submitted by FHLBanks. Similarly, the Enterprises are required to have their respective CFOs (or designees) validate CRS data. FHFA’s divisions, however, do not have the same level of assurance of the integrity of data gathered through other sources. In particular, information collected through conversations or compiled in response to ad hoc data requests may be less reliable to the extent that it is only as good as an individual’s memory or a compiler’s care. Last, decentralized data collection can cause inconsistency. Because requests are separate, responses can differ in terms of what and how data is presented. For example, although both Enterprises follow generally accepted accounting principles, they account differently for interest income associated with loans that have missed payments.12 Consistent use of CRS would help standardize how Enterprises report such data and would facilitate cross-comparisons. Having faced its initial start-up challenges, FHFA can now mitigate these less than optimal potential consequences by identifying effective practices that warrant wider use. For instance, DHMG has initiated a project to determine if CRS contains the data its users need to conduct their analyses and examinations, which is a prerequisite for using the system. And, in early 2012, a new DER management team—with practical experience using CRS—assumed Enterprise examination responsibilities and expressed interest in expanding its use of the system as it revises DER’s examination strategies. Such Agency efforts can prove cost effective because the costs associated with creating, designing, developing, and testing the system have already been paid. In addition, the system underwent two major upgrades in 2005 and 2009. With DEPS finalizing plans to standardize GSE supervisory examination processes, FHFA has an opportunity to analyze how to integrate CRS more fully into its supervision and regulation of the Enterprises. Such steps can help 12 Specifically, Fannie Mae’s non-accrual is triggered at two months of missed payments, and accrued interest remains on the balance sheet and is included in the allowance process; but Freddie Mac’s non-accrual is triggered at three months of missed payments, and accrued interest is reversed through interest income at the time the loan is placed in non-accrual. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 8 advance FHFA’s overall ability to promote the GSEs’ safety and soundness, and to protect the taxpayers’ investment in the Enterprises. Recommendations FHFA-OIG recommends that DER’s Deputy Director, in collaboration with the Office of Financial Analysis’ Senior Associate Director, ensure that the Agency: 1. Analyzes opportunities to use CRS information to facilitate supervision and regulation of the Enterprises; 2. Supports identified opportunities with detailed supervisory and support division requirements for using CRS in its oversight planning and monitoring; and 3. If current CRS capabilities need improvement, directs divisions to work with FHFA’s Office of Technology and Information Management and CRS system owners to enhance CRS to meet the Agency’s supervisory needs. FHFA Comments As shown in the attached appendices, FHFA agreed with FHFA-OIG’s recommendations and is planning to take responsive corrective actions. Scope and Methodology FHFA-OIG performed its fieldwork for this performance audit from October 2011 through March 2012. The audit was conducted at FHFA’s headquarters in Washington, DC. To achieve its objective, FHFA-OIG reviewed relevant FHFA policies and procedures and CRS schedules, reports, and system documentation. As necessary and appropriate, the audit team also interviewed officials with FHFA, Fannie Mae, and Freddie Mac. In accordance with FHFA- OIG’s policies and procedures, these reviews and interviews were to understand and support its conclusions about: The breadth and significance of CRS; Criteria used to implement CRS, including legal and regulatory requirements; and Related internal controls. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 9 The Agency has determined that loss of the system’s security with respect to data confidentiality, integrity, and availability would have a low impact on FHFA according to federal information processing standards,13 and, thus, FHFA-OIG did not review or test CRS’ controls. FHFA-OIG conducted this performance audit in accordance with Generally Accepted Government Auditing Standards, which require that audits be planned and performed to obtain sufficient, appropriate evidence to provide a reasonable basis for FHFA-OIG’s findings and conclusions based on the audit objective. FHFA-OIG believes that the evidence obtained provides a reasonable basis for the finding and recommendations included herein, based on the audit objective. FHFA-OIG considers its finding to be significant in context of the audit objective. cc: Edward DeMarco, Acting Director Richard Hornsby, Chief Operating Officer Mark Kinsey, Chief Financial Officer Kevin Winkler, Chief Information Officer John Major, Internal Controls and Audit Follow-Up Manager Bruce Crandlemire, Senior Advisor for IG Operations Attachments: Appendix A, FHFA’s Comments on the Finding and Recommendations Appendix B, FHFA-OIG’s Response to FHFA’s Comments Appendix C, Summary of Management’s Comments on the Recommendations 13 See National Institute of Standards and Technology, Federal Information Processing Standards Publication199: Standards for Security Categorization of Federal Information and Information Systems (February 2004). Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 10 Appendix A: FHFA’s Comments on the Finding and Recommendations Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 11 Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 12 Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 13 Appendix B: FHFA-OIG’s Response to FHFA’s Comments On June 27, 2012, FHFA provided comments to a draft of this report, agreeing with all of the recommendations and identifying FHFA actions to address them. FHFA-OIG considers FHFA’s proposed actions sufficient to resolve the recommendations, which will remain open until FHFA- OIG determines that agreed upon corrective actions are completed and responsive to the recommendations. FHFA-OIG has attached the Agency’s full response (see Appendix A), which was considered in finalizing this report. Appendix C provides a summary of management’s comments on the recommendations and the status of agreed upon corrective actions. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 14 Appendix C: Summary of Management’s Comments on the Recommendations This table presents management’s response to the recommendations in FHFA-OIG’s report and the status of the recommendations as of when the report was issued. Expected Rec. Corrective Action: Taken or Completion Monetary Resolved: Open or No. Planned Date Benefits Yes or Noa Closedb 1. FHFA agreed with this 12/27/2012 $0 Yes Open recommendation and plans to ensure that the current uses of CRS are fully reviewed, with the primary goal of identifying any gaps or inconsistencies in current usage of existing data, either for supervision or for policy and regulation in furtherance of DHMG’s mission. The review and the identification of opportunities to better use CRS data with appropriate consideration of costs and benefits will be completed within a six-month period. FHFA will then decide the extent to which the Agency and the Enterprises should implement enhancements to CRS. 2. A project plan will be developed to 6/27/2013 $0 Yes Open chart a path forward to execute the opportunities identified. Depending on the nature and breadth of opportunities identified, there may be multiple project plans to address all data usage issues. Development of project plans will take place within the six-month period after completion of the review referenced in Recommendation #1. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 15 Expected Rec. Corrective Action: Taken or Completion Monetary Resolved: Open or No. Planned Date Benefits Yes or Noa Closedb 3. FHFA will embark on systems TBD14 $0 Yes Open enhancements that are needed to acquire additional data or improve existing means of maintaining or accessing data. The Office of Technology and Information Management will be engaged, as necessary, if an identified opportunity requires additional capabilities. Technical enhancements will be included, as appropriate, in the project plans referenced in the response to Recommendation #2. Total $0 a Resolved means: (1) Management concurs with the recommendation, and the planned, ongoing, or completed corrective action is consistent with the recommendation; (2) Management does not concur with the recommendation, but alternative action meets the intent of the recommendation; or (3) Management agrees to the FHFA-OIG monetary benefits, a different amount, or no amount ($0). Monetary benefits are considered resolved as long as management provides an amount. b Once FHFA-OIG determines that the agreed-upon corrective actions have been completed and are responsive, the recommendations can be closed. 14 Date to be determined. Any actions taken on Recommendation #3 depend on the results of the determination of CRS enhancements addressed in Recommendation #1 as well as the development of the project plan addressed in Recommendation #2. As such, an estimated completion date for Recommendation #3 cannot be determined by the Agency at this time. FHFA-OIG will follow up with the Agency on June 27, 2013, to obtain an estimated date for Recommendation #3 should CRS system changes be required. Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 16 ADDITIONAL INFORMATION AND COPIES For additional copies of this report: Call the Office of Inspector General: (202) 730-0880 Fax your request: (202) 318-0239 Visit FHFA-OIG’s website at: www.fhfaoig.gov To report alleged fraud, waste, abuse, mismanagement, or any other kind of criminal or noncriminal misconduct relative to FHFA’s programs or operations: Call our Hotline at: (800) 793-7724 Fax your written complaint: (202) 318-0385 Email us: firstname.lastname@example.org Write us: FHFA Office of Inspector General Attn: Office of Investigation – Hotline 400 7th Street, SW Washington, DC 20024 Federal Housing Finance Agency Office of Inspector General • AUD-2012-006 • July 19, 2012 17
FHFA's Call Report System
Published by the Federal Housing Finance Agency, Office of Inspector General on 2012-07-19.
Below is a raw (and likely hideous) rendition of the original report. (PDF)