oversight

FHFA's Targeted Examinations of Fannie Mae: Less than Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed and No Examinations Planned for 2015 Were Completed Before the Report of Examination Issued

Published by the Federal Housing Finance Agency, Office of Inspector General on 2016-09-30.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

            Federal Housing Finance Agency
                Office of Inspector General




    FHFA’s Targeted Examinations
            of Fannie Mae:
     Less than Half of the Targeted
       Examinations Planned for
2012 through 2015 Were Completed and
  No Examinations Planned for 2015
 Were Completed Before the Report of
          Examination Issued




  Audit Report  AUD-2016-006  September 30, 2016
                Executive Summary
                The Federal Housing Finance Agency (FHFA or the Agency) is responsible for,
                among other things, ensuring that the Federal National Mortgage Association
                (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac)
                (together, the Enterprises) operate in a safe and sound manner. Within FHFA,
                the Division of Enterprise Regulation (DER) is responsible for the supervision
AUD-2016-006    of the Enterprises. Led by an Examiner-in-Charge (EIC), a core team of DER
                examiners is assigned to conduct supervisory activities for each Enterprise.
September 30,
    2016        Like other federal financial regulators, FHFA maintains that it uses a risk-based
                approach to carry out its supervisory activities. Based on the analysis in its risk
                assessments, DER is to prepare an annual supervisory strategy followed by a
                supervisory plan that schedules the specific supervisory activities it intends to
                conduct during the year. Those supervisory activities include targeted examinations
                and ongoing monitoring. According to FHFA, targeted examinations enable
                examiners to conduct a deep or comprehensive assessment of selected areas of
                high importance or risk, while the purpose of ongoing monitoring is to analyze
                real-time information and to use those analyses to identify Enterprise practices
                and changes in an Enterprise’s risk profile that may warrant supervisory
                attention. DER is to summarize its examination results in an annual report of
                examination (ROE) issued to the relevant Enterprise’s board of directors. The
                purpose of an ROE is to clearly communicate what FHFA found and its
                supervisory concerns for board action.

                FHFA Office of Inspector General’s (OIG) February 2016 Audit and Evaluation
                Plan identified FHFA’s supervision of its regulated entities as a significant risk
                area. Earlier this year, we assessed the process used by DER to develop its risk
                assessments and recommended a number of measures to improve the
                preparation of these risk assessments. Building on that work, we conducted this
                audit to determine whether DER (1) supported its 2014 and 2015 high-priority
                planned targeted examinations identified in its annual supervisory plans with
                risk assessments and completed those planned high-priority examinations; (2)
                performed its planned targeted examinations for Fannie Mae from 2012 through
                2015 and, if it did not, whether FHFA documented the deviations from its plan
                in accordance with policies and procedures; and (3) performed its planned
                targeted examinations for Freddie Mac from 2012 through 2015 and, if it did
                not, whether FHFA documented the deviations from its plan in accordance with
                policies and procedures. We are issuing three reports from this audit today.

                The first report, FHFA’s Supervisory Planning Process for the Enterprises:
                Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted
                Examinations Did Not Trace to Risk Assessments and Most High-Priority
                Planned Examinations Were Not Completed (September 30, 2016) (AUD-2016-
                005), analyzes whether the high-priority planned targeted examinations
                identified by DER in its annual supervisory plans for 2014 and 2015 for each
                Enterprise were supported by risk assessments and whether those planned high-
                priority targeted examinations were completed.

                This report, the second of three, analyzes whether DER examiners performed
                the planned targeted examinations for Fannie Mae from 2012 through 2015 and,
AUD-2016-006    in those instances where the planned targeted examinations were not completed,
                whether DER documented the deviations from its plan in accordance with
September 30,   policies and procedures. The third report, FHFA’s Targeted Examinations of
    2016        Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012
                through 2015 Were Completed (September 30, 2016) (AUD-2016-007),
                undertakes the same assessment for DER’s targeted examinations for Freddie
                Mac.

                Our audit found that DER planned 102 targeted examinations for Fannie Mae
                from 2012 through 2015. Of these 102, we found that 43 were completed.
                Based on our review of the documents provided to us by DER, we determined
                that of the remaining 59 planned targeted examinations: 19 were cancelled,
                9 were deferred, 14 were converted to ongoing monitoring, 7 were commenced
                but were not completed, and 10 lacked documentation as to their disposition, as
                of the end of our fieldwork on June 17, 2016. Overall, we found that both the
                number and percent of completed targeted examinations that were identified in
                the annual supervisory plans decreased significantly during this four-year
                period.

                According to FHFA, examination results, conclusions, findings, and
                supervisory concerns from the supervisory activities completed during the
                annual supervisory cycle are summarized in a ROE, which is issued to the
                relevant Enterprise’s board of directors. Because targeted examinations involve
                a “deep or comprehensive assessment” of areas deemed by DER to be of the
                highest importance or risk to the Enterprise, each ROE is intended to clearly
                and concisely summarize the targeted examination activities and findings
                during the annual supervisory cycle, report the results of ongoing monitoring,
                and discuss deficient practices and excessive risks giving rise to supervisory
                concerns. For Enterprise directors to carry out their oversight responsibilities
                under FHFA’s regulations and guidance, they must be made aware of the
                overall condition and risk profile of the Enterprise from the examination results
                and findings during the annual supervisory cycle.

                For the 2014 supervisory cycle, DER planned 53 targeted examinations. Of
                these 53 planned targeted examinations, DER completed only 8 before the ROE
                for that supervisory cycle issued. As a consequence, the ROE issued for the
                2014 supervisory cycle was based on only 15 percent of the 53 targeted
                examinations planned for that cycle.

                For the 2015 supervisory cycle, DER’s performance was more dismal. For this
                cycle, DER planned 11 targeted examinations, but completed none before the
                2015 ROE issued on March 23, 2016. As a consequence, the 2015 ROE was
                based on zero percent of the 11 targeted examinations planned for that cycle.
AUD-2016-006    The only targeted examinations for which findings were reported in the 2015
                ROE were 3 examinations planned for the 2014 supervisory cycle and
September 30,   completed in the 2015 supervisory cycle.
    2016
                As of the end of our fieldwork on June 17, 2016, DER examiners continued
                work on 4 targeted examinations planned for the 2014 supervisory cycle, all
                commenced in 2014, and on 3 targeted examinations planned for the 2015
                supervisory cycle, commenced in 2015. At the earliest, the findings for these 7
                targeted examinations, planned for 2014 and 2015, will first be included in the
                2016 ROE to be issued in March 2017.

                Effective January 1, 2014, DER requires that changes to supervisory plans
                must be risk-related, approved by the EIC, and documented. Of the 64 targeted
                examinations that were planned for 2014 and 2015, DER documentation
                showed that 33 were not conducted as of June 17, 2016, and DER provided no
                documentation to show the disposition of 7. While DER’s documentation for
                the 33 reported the change in status for each of them, it only included risk-
                related reasons for changing 11 of the 33. When the 7 planned targeted
                examinations for which DER provided no documentation to explain the
                change in status are added to the 22 for which no risk-related basis was
                provided for a change in status, a total of 29 planned targeted examinations
                out of 40 (73 percent) lacked a documented risk-related basis for a change, in
                contravention of DER requirements.

                In past evaluation reports, we found that DER (as well as FHFA’s Division of
                Bank Regulation) lacked a sufficient number of examiners and that FHFA
                lacked an adequate number of commissioned examiners. In response to our
                prior reports, FHFA committed to add, and has added, examiners. This audit
                shows that DER failed to conduct and complete more than half of the planned
                targeted examinations for the past four supervisory cycles for Fannie Mae. The
                reason repeatedly provided by DER examiners and the then-current EIC for this
                failure was resource constraints, notwithstanding the consistent position of DER
                leadership, and recently reiterated by FHFA senior leadership, that DER has
                an adequate complement of examiners. For a federal financial regulator,
                responsible for supervising two Enterprises that together own or guarantee
                more than $5 trillion in mortgage assets and operate in conservatorship, to fail
                to complete a substantial number of planned targeted examinations, including
                failure to complete any of its 2015 planned targeted examinations for Fannie
                Mae within the 2015 supervisory cycle, is an unsound supervisory practice and
                strategy.

                Our audit work was hampered by the lack of DER’s supervisory documentation,
                maintained in its official system of record. In our judgment, the lack of such
                documentation creates a significant risk exposure. This significant risk
AUD-2016-006    exposure, coupled with the other deficiencies identified in this audit, threatens
                FHFA’s ability to fulfill its statutory mission to ensure that the Enterprises
September 30,   operate in a safe and sound manner.
    2016
                We make five recommendations to address the findings identified in this report.
                In its written comments to our draft report, FHFA agreed with one
                recommendation, stated that it issued internal guidance in May 2016 that it
                believes confirmed its general agreement with two other recommendations,
                partially agreed with one recommendation, and disagreed with one
                recommendation. FHFA management’s comments and our response are
                provided in the body of this report.

                Key contributors to this report were Robert Taylor, Assistant Inspector General
                for Audits; Tara Lewis, Director; Pamela L. Williams, Auditor; Terese
                Blanchard, Senior Auditor; and Anya Philbert, Senior Auditor. We appreciate
                the cooperation of FHFA staff, as well as the assistance of all those who
                contributed to the preparation of this report.

                This report has been distributed to Congress, the Office of Management and
                Budget, and others and will be posted on our website, www.fhfaoig.gov.



                /s/

                Marla A. Freedman
                Deputy Inspector General for Audits
TABLE OF CONTENTS……………………………………………………………….
EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................8

BACKGROUND .............................................................................................................................9
      Effective Supervision by FHFA Is Vital to Ensure Fannie Mae’s Safety and
      Soundness .................................................................................................................................9

FACTS AND ANALYSIS.............................................................................................................12
      Analysis of FHFA’s Fannie Mae Planned Targeted Examinations for 2012 through
      2015 ........................................................................................................................................12
             Methodology ...................................................................................................................12
             Analysis ..........................................................................................................................14
      Changes to Supervisory Activities and Plans Were Not Always Documented, and
      When Changes Were Documented, the Reasons Provided Were Largely Not Risk-
      Related ....................................................................................................................................19

FINDINGS .....................................................................................................................................22
      1. DER completed less than half of its 2012 through 2015 planned targeted
      examinations and did not complete many of its planned targeted examinations for
      each supervisory cycle prior to the issuance of the respective cycle’s ROE. .........................22
             Less than half of planned targeted examinations for the period 2012-2015 were
                 completed. ...............................................................................................................22
             The usefulness of ROEs is diminished when planned targeted examinations for
                 a supervisory cycle are not completed until after the ROEs issue. .........................22
      2. The number of planned targeted examinations that were completed has dropped
      significantly since 2012, and no planned targeted examinations for the 2015
      supervisory cycle were completed within that supervisory cycle. .........................................23
      3. DER’s official system of record for its supervisory activities for Fannie Mae is
      not complete and could not be relied upon, and DER lacked documentation to
      account for all of its supervisory activities. ............................................................................23
      4. DER examiners did not always document changes to supervisory plans and,
      when changes were documented, the reasons provided were largely not risk related,
      in contravention of DER requirements. ..................................................................................24



                                          OIG  AUD-2016-006  September 30, 2016                                                                 6
CONCLUSION ..............................................................................................................................25
      Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records ...............25

RECOMMENDATIONS ...............................................................................................................27

FHFA COMMENTS AND OIG RESPONSE……………………………… ...............................29

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................35

APPENDIX A ................................................................................................................................37
      FHFA’s Comments on OIG’s Findings and Recommendations ............................................37

ADDITIONAL INFORMATION AND COPIES .........................................................................42




                                         OIG  AUD-2016-006  September 30, 2016                                                           7
ABBREVIATIONS .......................................................................

DER                Division of Enterprise Regulation

EIC                Examiner-in-Charge

Enterprises        Fannie Mae and Freddie Mac

Fannie Mae         Federal National Mortgage Association

FHFA or Agency     Federal Housing Finance Agency

Freddie Mac        Federal Home Loan Mortgage Corporation

IMS                Information Management System

MRA                Matter Requiring Attention

OESO               Office of Enterprise Supervision Operations

OIG                Federal Housing Finance Agency Office of Inspector General

OPB                Operating Procedures Bulletin

ROE                Report of Examination




                         OIG  AUD-2016-006  September 30, 2016                    8
BACKGROUND ..............................................................................

Effective Supervision by FHFA Is Vital to Ensure Fannie Mae’s Safety and Soundness

FHFA, created by Congress in 2008, is charged by the Housing and Economic Recovery Act
of 2008 with, among other things, the supervision of the Enterprises and the Federal Home
Loan Banks. Its mission as a federal financial regulator includes ensuring the safety and
soundness of its regulated entities so that they serve as a reliable source of liquidity and
funding for housing finance and community investment. FHFA maintains that it uses a risk-
based approach to plan and execute its supervisory activities. Supervision by risk requires a
comprehensive, risk-focused view of each regulated entity so that supervisory activities can
be tailored to the risks with the highest supervisory concerns.

FHFA’s DER is responsible for supervision of the Enterprises. Pursuant to DER’s Operating
Procedures Bulletin (OPB), Supervisory Planning Process (2013-DER-OPB-03.1), effective
January 1, 2014, the Deputy Director of DER is responsible for developing a supervisory
framework for the Enterprises and ensuring that the supervisory planning is documented and
incorporated into official agency records. Implementation of that supervisory plan is the
responsibility of each EIC who is assigned to lead a core team of examiners for each
Enterprise.

According to FHFA’s Examination Manual, risk assessments provide the foundation for
DER’s annual supervisory strategy for each Enterprise. These semiannual risk assessments
should be revised based upon an updated view of risk developed through supervisory
activities. Using the risk assessments, a supervisory strategy is prepared for each Enterprise
by the DER core teams.1 Once the annual supervisory strategy is approved, the strategy is
implemented through an annual supervisory plan, prepared by the EIC for each Enterprise and
approved by the Deputy Director of DER.

The annual supervisory plan for each Enterprise sets forth the objectives for carrying out the
supervisory strategy and identifies the supervisory activities, both targeted examinations and
ongoing monitoring, for the year. FHFA expects that DER’s supervisory activities will be
prioritized based on the risk that a specific practice poses to the Enterprises’ safe and sound
operations or to their compliance with applicable laws and regulations. FHFA guidance
contemplates that the risk assessments prepared for each Enterprise will identify those areas
of high importance or risk.


1
  FHFA expects EICs to periodically review each supervisory strategy and update it to reflect any changes in
supervisory objectives, the Enterprise’s financial condition, and/or trends in risk exposures. Any risk-based
changes to the supervisory strategy must be approved by the Deputy Director of DER.



                                  OIG  AUD-2016-006  September 30, 2016                                       9
Using that identification, each annual supervisory plan sets forth the planned supervisory
activities for the year, consisting of ongoing monitoring and targeted examinations. According
to FHFA, ongoing monitoring and targeted examinations serve complementary purposes. The
purpose of ongoing monitoring is to analyze real-time information and to use those analyses
to identify Enterprise practices and changes in an Enterprise’s risk profile that may warrant
supervisory attention. Ongoing monitoring is also “used to determine the status of the
Enterprise’s compliance with supervisory guidance, MRAs [Matters Requiring Attention],
and conservatorship directives[.]” Targeted examinations complement ongoing monitoring:
they enable examiners to conduct “a deep or comprehensive assessment” of the areas found to
be of high importance or risk. Because each of these supervisory activities has a separate
purpose, they are not interchangeable.

DER examiners may identify supervisory concerns or deficiencies occurring at an Enterprise
as a result of targeted examinations or ongoing monitoring. According to FHFA, only the
most serious supervisory deficiencies are categorized as MRAs.2 Most of the MRAs issued by
DER have issued out of targeted examinations. FHFA guidance also contemplates that special
“ad hoc” supervisory activities may be initiated throughout the year as a product of ongoing
monitoring. As these supervisory activities are not planned, they are not added to the annual
supervisory plan.

Because supervisory planning is a continuous process, FHFA expects that each EIC will
adjust the applicable supervisory plan to add newly emerging risks that require attention
during the current supervisory cycle. Beginning in 2014, DER guidance instructs that
approved supervisory plans shall only be adjusted for risk-based reasons and justifications for
the adjustments must be approved by the EIC (after consultation with the Deputy Director of
DER, as warranted) and fully documented in the work papers. Adjustments include adding or
deleting supervisory activities, or changing the objective, scope, and methodology of a
supervisory activity.

According to FHFA guidance, examination results, conclusions, findings, and supervisory
concerns from the supervisory activities completed during the annual supervisory cycle are
summarized in a ROE, which is issued to the relevant Enterprise’s board of directors. Each
ROE is intended to clearly and concisely convey the overall condition and risk profile of the



2
  According to FHFA, MRAs are the most serious supervisory matters and they include, among other things,
such matters as non-compliance with laws or regulations that result or may result in significant risk of financial
loss or damage to the regulated entity; repeat deficiencies that have escalated due to insufficient action or
attention; unsafe or unsound practices; and matters that have resulted, or are likely to result, in a regulated
entity being in an unsafe or unsound condition. MRAs also include breakdowns in risk management,
significant control weaknesses, or inappropriate risk-taking.




                                   OIG  AUD-2016-006  September 30, 2016                                           10
Enterprise, summarize examination activities and findings during the annual supervisory
cycle, and discuss deficient practices and excessive risks giving rise to supervisory concerns. 3




3
  For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing
ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify
Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the
Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns
(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG,
FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain
Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those
Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).



                                  OIG  AUD-2016-006  September 30, 2016                                        11
FACTS AND ANALYSIS ..................................................................

Analysis of FHFA’s Fannie Mae Planned Targeted Examinations for 2012 through 2015

      Methodology

Because targeted examinations constitute a critical component of FHFA’s supervisory
activities, we examined, as part of this audit, whether DER examiners conducted and
completed the targeted examinations identified in each supervisory plan for Fannie Mae
from 2012 through 2015, the review period for this audit. For the last two years of the review
period, 2014 and 2015, the two annual supervisory cycles when DER required that any
changes to the supervisory plans be risk-related, approved by the EIC, and documented, we
sought to determine whether DER examiners complied with these requirements when a
planned targeted examination was either (1) not conducted because it was converted to
ongoing monitoring, cancelled, or deferred, (2) commenced but not completed, or
(3) documentation was not provided for us to determine its disposition.

For purposes of this audit, we considered a targeted examination to be “commenced” when
DER issued a request letter.4 We considered a targeted examination to be “completed” when
DER issued a conclusion letter to Fannie Mae.5 We considered a targeted examination to be
“not conducted” when DER documents demonstrated that the status of that examination was
changed to ongoing monitoring, cancelled, or deferred. We considered a targeted examination
to be “commenced but not completed” based on DER’s representation that the examination
was in progress in one of three phases: fieldwork, management review, or quality review,
absent any other conflicting documentation provided or discovered during our review of DER
documentation. We considered a targeted examination to be “disposition not documented”
when DER did not provide any documentation regarding the disposition of the targeted
examination in response to our requests.

To perform our audit, we developed a list of Fannie Mae targeted examinations planned by
DER for the review period from annual supervisory plans and other information that was
gathered by our Office of Evaluations in support of another assignment6 and supplemented


4
    DER, Operating Procedures Bulletin, DER Supervisory Activities (Sept. 19, 2013) (2013-DER-OPB-04).
5
  Once the fieldwork for a targeted examination has been completed and the examination team develops its
findings, the EIC communicates those findings to the affected Enterprise through issuance of a conclusion
letter.
6
  See OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear
Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at
www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).



                                  OIG  AUD-2016-006  September 30, 2016                                   12
that information with records from FHFA’s Information Management System (IMS), DER’s
official system of record. We then sought to track whether each planned targeted examination
was commenced and later completed. In some instances, IMS did not contain sufficient
information to permit us to complete the tracking exercise. We also found evidence that some
targeted examinations were completed but had not been identified on the annual supervisory
plan.

We asked DER’s Office of Enterprise Supervision Operations (OESO)7 to confirm whether
(1) the universe of planned targeted examinations for the review period that we had identified
was complete, (2) the information we obtained about the commencement and completion of
each planned targeted examination was complete and accurate, and (3) to explain the reasons
why specific targeted examinations were conducted and completed but were not on any
supervisory plan. OESO responded that it could not provide such a confirmation because
there had been a significant shift in DER’s senior management and managers, and DER had
“significantly refined” its records management processes since then.

Because we were not able to track the status of all planned targeted examinations from the
documentation either in IMS or provided to us by DER, we asked the then-current EIC for the
Fannie Mae core team for his recollection of the disposition of planned examinations that we
were unable to track. For example, we asked him about the status of four planned targeted
examinations for which there was no documentation provided by DER and he reported that all
had been cancelled. When we sought documentation from him to support his recollection, he
explained to us that the Fannie Mae core team of examiners tracked targeted examinations in
SharePoint – which is not the official system of record. To test the accuracy of the tracking
information in SharePoint, we reviewed the SharePoint entries for each of these four planned
targeted examinations. SharePoint reported “no change” in the status for each, meaning that
each continued to be planned. The contradiction between the tracking information in
SharePoint and the then-current EIC’s recollections calls into question the reliability of
DER’s controls to track the status of each planned targeted examination in each supervisory
plan for Fannie Mae.

Apart from the tracking information in SharePoint, no DER official told us about any other
controls used by DER examiners to track the status of targeted examinations and our audit did
not identify any such controls. DER examiners typically track the status of planned targeted
examinations in SharePoint by reference to the title of the examinations. However, when a
title of a planned targeted examination is changed during the supervisory cycle, DER lacked

7
 Within DER, the purpose of OESO is to provide support for the activities of all DER offices and to promote
consistency, efficient business operations, and adherence to FHFA standards. OESO is responsible for
development of DER policies and procedures for program activities, administration of DER’s quality control
program, and coordination of DER responses to oversight entities such as OIG. Among other things, OESO
coordinates work to ensure DER compliance with FHFA records management and other policies.



                                 OIG  AUD-2016-006  September 30, 2016                                      13
any control to track the status of that examination and relied on the recollections of the EIC
and other examiners.

    Analysis

DER planned 102 targeted               FIGURE 1. EXECUTION BY DER OF 102 PLANNED TARGETED
examinations for Fannie Mae              EXAMINATIONS OF FANNIE MAE 2012 THROUGH 2015
during the four-year review
period. Of these 102 planned
targeted examinations, we                                                   Completed
                                                 10
found, as of the end of our                7
fieldwork on June 17, 2016:                                                 Not Conducted
                                                              43
43 targeted examinations were
completed (42 percent); 42 were                                             Commenced But Not
not conducted (41 percent); and            42                               Completed
7 were commenced but not                                                    Disposition Not
completed (7 percent). Of the                                               Documented
42 that were not conducted,
DER documentation established
that 19 were cancelled, 9 were deferred, and 14 were converted to ongoing monitoring (see
Figure 4). For the remaining 10 planned targeted examinations, DER did not provide any
documentation for us to determine their disposition (10 percent).8 As we discuss in greater
detail below, a number of targeted examinations planned for one supervisory cycle were
completed by DER examiners in subsequent supervisory cycles, so the completion data is
as of the end of our fieldwork, not the end of each supervisory cycle. Figure 1 captures the
information for all years in graphic format.

Looking at the number of planned targeted examinations by year, we found that the 2012,
2013, and 2015 supervisory cycles ranged from 11 to 22, with a spike in the number of
planned targeted examinations for the 2014 supervisory cycle to 53. DER produced its written
Supervisory Strategy for 2014 to us which stated,

           We found no documentation to explain the reasons for the spike in planned
targeted examinations from 16 in 2013 to 53 in 2014. During our fieldwork, we asked DER’s
then-current EIC for Fannie Mae to explain the reasons for a spike. He told us that those
numbers could represent a number of things. He explained that some managers break out each

8
  We also found evidence in IMS of 13 targeted examinations during the review period that were not included
in any annual supervisory plans and DER reported to us that it identified an additional 3 targeted examinations
outside of the supervisory plans and IMS. Of these 16 targeted examinations that were not contained in the
supervisory plans, DER provided documentation that 15 were completed. The disposition of the other
examination was not documented.



                                  OIG  AUD-2016-006  September 30, 2016                                         14
targeted examination by objective, whereas others would have multiple objectives within one
examination, which could lead to greater or fewer targeted examinations in each year. He
posited that some years could include a higher number of planned targeted examinations and
a lower number of ongoing monitoring activities and others could reflect the opposite. Last,
he reported that the Fannie Mae core team lost about half its examination staff in 2013,
approximately 15 people. On its face, this last explanation is not convincing to us; a loss of
roughly 50 percent of examiners from the Fannie Mae core team in 2013 would not support a
rise in the number of planned targeted examinations from 16 in 2013 to 53 in 2014.

After our fieldwork ended and we submitted a draft report to DER for its technical comments,
DER provided a different explanation for the spike. DER advised that the spike in 2014 was
anomalous, driven by a request from then-senior DER management to examination managers
to “list all issues that could reasonably be topics of targeted examinations, regardless of
resource constraints and including all risk levels.” DER’s explanation, if accurate, would
reduce the risk-based planning process for the 2014 supervisory cycle to a nullity because the
supervisory plan would amount to an unprioritized wish list.

Our analysis of DER’s execution of       FIGURE 2. DER’S PLANNED TARGETED EXAMINATIONS FOR
its planned targeted examinations        FANNIE MAE—PERCENT COMPLETED AS OF JUNE 17, 2016*
for each year of the review period
found significant disparities from      90%
                                                          82%
year to year regarding the number       80%
of completed targeted examinations. 70%
Overall, we found that both the         60%
                                        50%                            50%
number and percent of completed
targeted examinations identified        40%                                                           36%
in the annual supervisory plans         30%
decreased significantly, even           20%                                  25%
when DER is credited with the           10%
completion of planned targeted            0%
examinations after the supervisory                   2012          2013           2014            2015
cycle ended. As noted, DER              * Includes targeted examinations completed after the respective
completed 18 of 22 planned              ROE issued.
examinations (82 percent) for the
2012 supervisory cycle, which declined to 8 of 16 planned examinations (50 percent) for the
2013 supervisory cycle, before further declining to 13 of 53 planned targeted examinations
(25 percent) for the 2014 supervisory cycle. For the 2015 supervisory cycle, 4 of 11 planned
targeted examinations (36 percent) were completed as of the end of our fieldwork on June 17,
2016. Figure 2 captures this information graphically.




                               OIG  AUD-2016-006  September 30, 2016                                 15
As Figure 2 reflects, the percentage            FIGURE 3. FHFA’S NO. OF COMPLETED, PLANNED TARGETED
of completed targeted examinations                EXAMINATIONS FOR FANNIE MAE AS OF JUNE 17, 2016*
identified on the supervisory plans
ticked up slightly from 2014 to               60
                                                                                       13 of 53
2015, from 25 to 36 percent.
                                              50
However, the actual number of
completed targeted examinations               40
dropped significantly from 13 for
                                              30
2014 to 4 for 2015. Figure 3                           18 of 22
captures this information by year             20                        8 of 16
for the review period.                                                                                  4 of 11
                                              10
As discussed earlier in this              0
report, DER is to summarize                        2012           2013           2014              2015
its examination results and
                                          * Includes targeted examinations completed after the respective
conclusions, findings, and                ROE issued.
supervisory concerns from the
supervisory activities completed during the annual supervisory cycle in an annual ROE
issued to the relevant Enterprise’s board of directors. The purpose of an ROE is to clearly
communicate to the board of directors of the Enterprise: the examination results and
conclusions; findings and other supervisory concerns, such as deficient, unsafe, and unsound
practices; and the composite and component ratings assigned in accordance with FHFA’s
rating system. For Enterprise directors to carry out their oversight responsibilities under
FHFA’s regulations and guidance, they must be made aware of the overall condition and
risk profile of the Enterprise from the examination results and findings during the annual
supervisory cycle.9 According to FHFA’s performance plan, DER must approve the final
ROE for the prior supervisory cycle for each Enterprise by March 31.

According to FHFA, it uses targeted examinations to conduct deep or comprehensive
assessments of areas found to be of high importance or risk and most of the MRAs issued
by DER, for the most significant supervisory deficiencies, have been issued as a result of
findings from targeted examinations.


9
  For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing
ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify
Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the
Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns
(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG,
FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain
Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those
Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).




                                  OIG  AUD-2016-006  September 30, 2016                                         16
For the 2014 supervisory cycle, DER planned 53 targeted examinations, significantly higher
than the number of targeted examinations planned in prior cycles.10 Of these 53, DER
completed only 8 before the ROE for that supervisory cycle issued. As a consequence, the
ROE issued for the 2014 supervisory cycle was based on only 15 percent of the 53 targeted
examinations planned for that cycle.

Three (3) of the 53 targeted examinations planned for 2014 were completed after the 2014
ROE issued and were included in the 2015 ROE issued March 23, 2016.11 An additional 2 of
the 53 targeted examinations planned for 2014, which were commenced in April and July
2014, were completed in May 2016 and will first be included in the 2016 ROE, to be issued in
March 2017.12 Based on our review of DER records, four targeted examinations planned for
the 2014 supervisory cycle were commenced in 2014, but not completed as of the end of our
fieldwork on June 17, 2016. While there may be some usefulness to completing a targeted
examination planned for one supervisory cycle in a subsequent cycle, there is also a risk that
the examination fieldwork could be outdated by the time the conclusion letter, with findings,
is issued to the Enterprise.

Assuming the understanding expressed by FHFA senior leadership that the 2014 supervisory
plan was an outlier and an unfair baseline against which to assess completion of targeted
examinations, DER’s completion of targeted examinations during the 2015 supervisory cycle
against those on the 2015 supervisory plan was dismal even when compared to its 2013
performance. For the 2013 supervisory cycle, DER planned 16 targeted examinations and
completed 8, all before the ROE for that cycle issued. For the 2015 supervisory cycle, DER
planned only 11 targeted examinations and completed none before the ROE for that
supervisory cycle issued. The only findings from planned targeted examinations included in
the 2015 ROE were from the three targeted examinations planned for the 2014 supervisory
cycle and completed in April and September 2015 and March 2016. As FHFA has explained,
the purpose of an ROE is to summarize results and conclusions, findings, and supervisory
concerns from completed supervisory activities during the cycle. Because no targeted
examinations planned for 2015 were completed for the 2015 supervisory cycle before the
ROE issued, that ROE could not and did not include the results and conclusions, findings, and
supervisory concerns on these areas deemed by DER to be of the highest importance or risk
planned for the 2015 supervisory cycle. Of the 11 targeted examinations planned for 2015,

10
  As previously discussed, the explanation for this spike in planned targeted examinations for the 2014
supervisory cycle provided by the then-current EIC, during our fieldwork, was different than the explanation
subsequently provided by DER after it reviewed our draft.
11
 Conclusion letters for the three targeted examinations were dated April 23, 2015; September 23, 2015; and
March 1, 2016.
12
     Conclusion letters for these two targeted examinations were dated May 9, 2016; and May 23, 2016.




                                   OIG  AUD-2016-006  September 30, 2016                                     17
DER only completed 4 of them, after the ROE for that supervisory cycle issued on March 23,
2016.13 Three additional targeted examinations planned for the 2015 supervisory cycle
commenced before the 2015 ROE issued but were not completed as of the end of our
fieldwork, June 17, 2016.

To illustrate a consequence of DER’s desultory supervision,       MRAs were identified in the
conclusion letters issued for the four targeted examinations planned for the 2015 supervisory
cycle and completed after the 2015 ROE issued. None of those MRAs were available to
inform that ROE.14

Effective with the 2013 ROE, FHFA has used the CAMELSO rating system to report
examination findings and conclusions to the Enterprise’s board of directors.15 The
CAMELSO rating for Fannie Mae for the 2014 supervisory cycle was informed by eight
targeted examinations planned and completed during the 2014 cycle. The CAMELSO rating
for Fannie Mae for the 2015 supervisory cycle was informed by three targeted examinations
planned and commenced in the 2014 supervisory cycle, for which the conclusion letters
issued in April and September 2015, and in March 2016. The small number of targeted
examinations completed during each of these two supervisory cycles necessarily limited the
basis for the CAMELSO ratings for each cycle.

Figure 4 captures, by year, the disposition of DER’s planned targeted examinations for Fannie
Mae.




13
  Conclusion letters for these four targeted examinations were dated April 8, 2016; April 13, 2016; April 27,
2016; and June 8, 2016.
14
   The 2015 ROE reported      new MRAs identified through ongoing monitoring activities conducted during
the 2015 supervisory cycle.
15
   The term CAMELSO is the acronym used to describe the following seven components: Capital, Asset
Quality, Management, Earnings, Liquidity, Sensitivity to Market Risk, and Operational Risk. The CAMELSO
rating system consists of: (1) an overall condition of each regulated entity (the composite rating), and
(2) individual components of financial condition and risk management (the component ratings). The composite
and component ratings are on a scale from “l” to “5”, with a “1” indicating the lowest degree of supervisory
concern and a “5” the highest.



                                  OIG  AUD-2016-006  September 30, 2016                                       18
         FIGURE 4. SUMMARY OF FHFA’S PLANNED TARGETED EXAMINATIONS FOR FANNIE MAE
                           2012 THROUGH 2015, AS OF JUNE 17, 2016
                                                                  2012       2013      2014a/     2015      Totals
Planned Targeted Examinations                                       22         16        53         11         102
Completed                                                           18          8        13          4          43
  Before ROE for that Supervisory Cycle Issued b/                   12          8         8          0
  Before ROE for Subsequent Supervisory Cycle Issued b/              6          0         3          4
  Before ROE to be Issued for Current Supervisory Cycle
                                                                     0          0          2         0
  (2016)
Commenced But Not Completed                                          0          0         4          3              7
Not Conducted                                                        4          5        30          3             42
  Cancelled                                                          1          0        16          2
  Deferred                                                           0          0         9          0
  Converted to Ongoing Monitoring                                    3          5         5          1
Disposition Not Documented                                           0          3         6          1             10
a/
  The explanation for this spike in planned targeted examinations for the 2014 supervisory cycle provided by the
then-current EIC, during our fieldwork, was different than the explanation subsequently provided by DER after it
reviewed our draft.
b/
  For 2012 and 2013, there was not a requirement that targeted examinations be completed before the ROE
issued.

Changes to Supervisory Activities and Plans Were Not Always Documented, and When
Changes Were Documented, the Reasons Provided Were Largely Not Risk-Related

Because supervisory planning is a continuous process, supervisory plans need to be adjusted
during each year to address newly emerging risks that require attention during the current
supervisory cycle. Beginning with the 2014 supervisory cycle, DER’s guidance in
2013-DER-OPB-03.1 directs that approved supervisory plans shall only be adjusted for risk-
related reasons and justifications for the adjustments must be approved by the EIC (after
consultation with the Deputy Director of DER, as warranted) and fully documented in the
work papers.

As shown in Figure 4 above, a total of 64 targeted examinations were identified on DER’s
supervisory plans for 2014 and 2015. Of those 64 planned targeted examinations, 17 were
completed and 7 were commenced but not completed at the end of our fieldwork in June
2016. Forty (40) of the 64 (63 percent) planned targeted examinations for 2014 and 2015 were
either not conducted or their disposition was not documented. Of these 40, DER produced no
documentation relating to the disposition for 7. DER had ample opportunity to provide us
with such documentation: beginning in December 2015, we asked DER, on multiple
occasions, to provide us documentation for specific planned supervisory activities that we
could not find in its official system of record. DER provided us with some documentation


                                 OIG  AUD-2016-006  September 30, 2016                                           19
related to other planned supervisory activities but no documentation to show the disposition of
these 7 planned targeted examinations.

For the other 33 of the 40 planned targeted examinations, DER provided written materials
explaining the change in status: 18 were cancelled, 6 were converted to ongoing monitoring,
and 9 were deferred.16 We sought to determine whether a documented risk-related reason
existed for the change in status for each, as required by 2013-DER-OPB-03.1. DER produced
documentation that, in our view, provided risk-related reasons for changes to 11 of these 33.17

For the remaining 22 of the 33, the documentation provided by DER relating to the change in
status did not provide risk-related reasons, in contravention of 2013-DER-OPB-03.1.18 For
example, a July 2014 memorandum titled “Rationale for Changes to 2014 Supervisory Plan –
Credit Risk” included the following explanation for removing 11 medium-priority and 2 low-
priority targeted examinations from the supervisory plan at the end of the first quarter of
2014:

         The original approved supervisory plan called for twenty-seven (27) Targeted
         Examinations based on the risks and resources present at the time. As a result
         of contracting issues, the credit team lost a key subject matter expert (SME)
         that was critical to the execution of a significant number of [targeted
         examinations] that included credit risk assessments and testing for credit
         quality, accuracy of risk ratings etc. The SME was also expected to fulfill the
         role of on-the-job instructor for the less experienced members on the credit
         (and other) team allowing the other experienced examiners time and
         opportunity to execute [targeted examinations] in relatively short order. Upon
         departure by the SME and with an improved understanding of the credit risk
         profile of the Enterprise, the Credit Team Examination Plan was updated and




16
   Those written materials included internal memoranda, a mid-year update document, and a reassessment
letter issued to Fannie Mae.
17
   The risk-related reasons for the change in status for 11 planned targeted examinations were: process changes
at the Enterprise (3), Enterprise integration implementation delays (2), increased supervisory comfort gained
by an enhanced internal credit program (1), lower risk than anticipated (1), change in direction and policy per
FHFA (1), insignificance of a process to credit risk management (1), objective of the planned targeted
examination was largely covered by another targeted examination (1), and Enterprise’s organizational structure
was reevaluated (1).
18
   The documentation produced by DER to explain the change in status for the 22 planned targeted
examinations reported: cancelled for resource constraints (12); deferred for resource constraints (1); changed
from a higher to a lower priority, without any explanation for the change in priority (2); removed from the
supervisory plan, without any reason documented (4); and cancelled because area covered by ongoing
monitoring, without a risk-related explanation (3).



                                  OIG  AUD-2016-006  September 30, 2016                                         20
       activities were re-prioritized by simply dropping the low and medium priority
       [targeted examinations]…

Because DER’s guidance instructs that changes to an approved supervisory plan for 2014 and
2015 must be risk-related and approved by the EIC, we asked the then-current EIC for the
Fannie Mae core team if he could recall any risk-related reasons underlying the change in
status for these 22 planned targeted examinations. He only offered resource constraints as the
reason by explaining that several key examination managers and staff left FHFA, which
caused DER to cancel planned targeted examinations.




                            OIG  AUD-2016-006  September 30, 2016                              21
FINDINGS .................................................................................

   1. DER completed less than half of its 2012 through 2015 planned targeted
      examinations and did not complete many of its planned targeted examinations
      for each supervisory cycle prior to the issuance of the respective cycle’s ROE.

   Less than half of planned targeted examinations for the period 2012-2015 were
   completed.

DER prepares an annual supervisory plan that identifies the supervisory activities it intends
to conduct during the year. According to FHFA, targeted examinations enable examiners to
conduct a deep or comprehensive assessment of selected areas of high importance or risk. Our
audit found that DER planned 102 targeted examinations for Fannie Mae from 2012 through
2015 but completed only 43 (42 percent).

After it received our draft report, DER management asserted to us that the 2014 supervisory
plan was an outlier and an unfair baseline against which to assess completion of targeted
examinations. Even when the planned and completed targeted examinations from the 2014
supervisory cycle are removed from the analysis, DER completed 30 of 49 (61 percent)
planned targeted examinations for three of the four supervisory cycles in this review (2012,
2013, and 2015), and none of the 11 planned targeted examinations for the 2015 supervisory
cycle were completed within the 2015 supervisory cycle.

   The usefulness of ROEs is diminished when planned targeted examinations for a
   supervisory cycle are not completed until after the ROEs issue.

DER summarizes its examination results in an annual ROE issued to the relevant Enterprise’s
board of directors. The ROE is intended to clearly and concisely convey the overall condition
and risk profile of the Enterprise, summarize examination activities and findings during the
annual supervisory cycle, and discuss deficient practices and excessive risks giving rise to
supervisory concerns.

While the ROE for the 2012 supervisory cycle was based on 12 targeted examinations
planned and completed during that cycle, the ROE for the 2014 supervisory cycle was based
on eight targeted examinations planned and completed during that cycle and the ROE for
the 2015 supervisory cycle was based on three targeted examinations planned for and
commenced during the 2014 supervisory cycle and completed prior to the issuance of the
2015 ROE. No targeted examinations planned for the 2015 supervisory cycle were completed
prior to the 2015 ROE.



                            OIG  AUD-2016-006  September 30, 2016                             22
According to FHFA, the purpose of an ROE is to summarize results and conclusions,
findings, and supervisory concerns from completed supervisory activities during the cycle.
Because no targeted examinations planned for 2015 were completed during this cycle,
the 2015 ROE could not and did not include the results and conclusions, findings, and
supervisory concerns on these areas deemed by DER to be of the highest importance or risk
for that supervisory cycle.

   2. The number of planned targeted examinations that were completed has
      dropped significantly since 2012, and no planned targeted examinations for the
      2015 supervisory cycle were completed within that supervisory cycle.

FHFA views targeted examinations as the opportunity to conduct a deep or comprehensive
assessment of selected areas of high importance or risk. During the 2012 supervisory cycle,
DER completed 12 of the 22 planned targeted examinations for Fannie Mae and completed an
additional 6 during the 2013 supervisory cycle. In contrast, during the 2015 supervisory cycle,
DER completed none of the 11 planned targeted examinations for Fannie Mae during that
supervisory cycle and completed only 4 of the 11 during the 2016 supervisory cycle, as of the
end of our fieldwork.

The explanation provided by DER officials, including the then-current EIC, for this
significant decrease in the number of completed targeted examinations varied and included
the loss of some of the Fannie Mae core team examiners and managers in 2013 and 2014. We
found that the loss of examiners during the 2013 supervisory cycle, when eight targeted
examinations planned for that cycle were completed, does not provide a convincing
explanation of the reasons why no targeted examinations were completed for the 2015
supervisory cycle.

   3. DER’s official system of record for its supervisory activities for Fannie Mae is
      not complete and could not be relied upon, and DER lacked documentation to
      account for all of its supervisory activities.

DER was unable to provide us with documentation to show the disposition of 10 of 102
targeted examinations (10 percent) planned during the four supervisory cycles of our review
period.

According to its operating procedures, DER is to ensure that the supervisory planning is
documented and incorporated into official agency records. IMS is DER’s official system of
record for documentation of its supervisory activities. Our efforts to track through IMS
whether each planned targeted examination was commenced and completed were not
successful because IMS did not contain sufficient information to permit us to complete the
tracking exercise. Despite repeated requests, DER was unable to provide any documentation


                            OIG  AUD-2016-006  September 30, 2016                               23
for the disposition of 10 targeted examinations planned during the four supervisory cycles in
our review period. Lacking any documentation to show the disposition of these 10 planned
targeted examinations, we asked the then-current EIC to explain the disposition. His
recollection was in conflict with tracking information maintained on planned targeted
examinations by the Fannie Mae core team in SharePoint. We found that DER had no
operating controls in place to ensure that supervisory documentation in IMS was complete
and to accurately track the status of planned targeted examinations through disposition.

   4. DER examiners did not always document changes to supervisory plans and,
      when changes were documented, the reasons provided were largely not risk
      related, in contravention of DER requirements.

Beginning with the 2014 supervisory cycle, DER requires that all changes to supervisory
plans must be risk-related, approved by the EIC, and documented. Forty (40) of the 64 (63
percent) planned targeted examinations for 2014 and 2015 were either not conducted or their
disposition was not documented. Of these 40, DER provided documentation to show a change
in status for 33. Our review of this documentation identified risk-related reasons to support
the change in status only for 11 of the 33. DER provided no documentation to explain the
disposition of 7 of these 40. When the 7 planned targeted examinations for which DER
provided no documentation to explain the change in status are added to the 22 for which no
risk-related basis was documented in the materials provided to us by DER, a total of 29
planned targeted examinations out of 40 (73 percent) lacked a documented risk-related basis
for a change, in contravention of DER requirements.




                            OIG  AUD-2016-006  September 30, 2016                             24
CONCLUSION ............................................................................

For the four supervisory cycles assessed in this audit, DER planned 102 targeted examinations
but completed only 43 (42 percent). Because a significant number of targeted examinations
planned for the 2014 and 2015 supervisory cycles were completed after the supervisory cycle
ended, the results were not discussed in the ROE or factored into the CAMELSO rating for
those supervisory cycles. For the 2014 and 2015 supervisory cycles, DER examiners were
only permitted to make changes to supervisory plans for risk-related reasons and were
required to obtain approvals for those changes and document the risk-related reasons.
However, this requirement was often not followed: of the 64 planned targeted examinations
for these cycles, 40 were not conducted or their disposition was not documented, and only 11
of the 40 documented risk-related reasons for the changes in the supervisory plans.

In past reports, we found that that FHFA lacked a sufficient number of examiners. In
response, FHFA committed to add examiners and has added examiners.19 As this assessment
shows, DER failed to conduct and complete more than half of the planned targeted
examinations for the past four supervisory cycles. The reason repeatedly provided to us by
DER officials for this failure was resource constraints, notwithstanding the consistent position
of DER leadership as recently reiterated by FHFA senior leadership that DER has an adequate
complement of examiners. For a federal financial regulator, responsible for supervising two
Enterprises that together own or guarantee more than $5 trillion in mortgage assets and
operate in conservatorship, to fail to complete a substantial number of planned targeted
examinations, including completing none of its 2015 planned targeted examinations for
Fannie Mae within the 2015 supervisory cycle, is an unsound supervisory practice and
strategy.

Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records

We consider the lack of DER’s documentation supporting its supervisory activities, as it
relates to this audit, to create a significant risk exposure. This condition impacted the




19
   OIG, Evaluation of Whether FHFA Has Sufficient Capacity to Examine the GSEs (Sept. 23, 2011) (EVL-
2011-005) (online at www.fhfaoig.gov/Content/Files/EVL-2011-005.pdf); OIG, Update on FHFA’s Efforts to
Strengthen its Capacity to Examine the Enterprises (Dec. 19, 2013) (EVL-2014-002) (online at
www.fhfaoig.gov/Content/Files/EVL-2014-002.pdf). See also FHFA, FY2015 Performance and Accountability
Report (Nov. 16, 2015) (Memorandum to Director Watt from Inspector General Wertheimer re: Fiscal Year
2016 Management and Performance Challenges) (online at
www.fhfa.gov/AboutUs/Reports/ReportDocuments/FHFA-2015-PAR.pdf) (accessed Aug. 2, 2016).




                               OIG  AUD-2016-006  September 30, 2016                                   25
objectives of this report as well as those in its two companion reports, which were also issued
today.20

According to DER’s operating procedures, DER is to ensure that the supervisory planning is
documented and incorporated into official agency records. IMS is DER’s official system of
record for documentation of its supervisory activities. Our efforts to track documentation of
the planning and execution of DER’s supervisory activities through IMS were not successful
because a significant amount of documentation was not retained in IMS. During our audit, we
needed to make multiple information requests to DER for basic documentation relating to
supervisory plans and their execution because such documentation was not always found in
DER’s official system of record. Although DER located some documentation outside the
official system of record, it was not able to find all requested documentation.

DER often relied on the recollections of the then-current EICs to explain the universe of
planned targeted examinations and the disposition of those planned targeted examinations for
the supervisory cycles within the review period of this audit (2012-2015), which, at times,
were later found to be inaccurate. DER’s inability to retrieve all supervisory documentation
from its official system of record, its difficulty in finding documentation outside its official
system of record, and its significant reliance on the imperfect individual recollections of
personnel delayed us from the timely and efficient completion of our work.

DER officials maintained to us that a significant shift in DER’s senior management and
managers led to the lack of proper and complete documentation in IMS supporting its
supervisory activities. That explanation surprises us. FHFA, which was created in 2008, took
over the supervision of the Enterprises from its predecessor agency that had been operating
since 1992, and it is not credible that a federal financial regulator, charged with supervision
of the Enterprises, would be so impacted by a shift in senior management and managers.

That explanation, however, is the only one offered by DER. If it is taken at face value, DER’s
haphazard approach to creating and retaining complete documentation for its supervisory
activities creates enormous risk. This risk, coupled with the other deficiencies identified in
this audit, threatens FHFA’s ability to fulfill its statutory mission.

In our judgment, deliberate urgency and resolute commitment by FHFA management to
resolve these collective deficiencies, and to implement the recommendations in this report and
its two companion reports, is required.

20
  OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015
High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments and Most High-Priority
Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted
Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015
Were Completed (Sept. 30, 2016) (AUD-2016-007).



                                OIG  AUD-2016-006  September 30, 2016                                  26
RECOMMENDATIONS ...............................................................

In a companion report issued today, FHFA’s Supervisory Planning Process for the
Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted
Examinations Did Not Trace to Risk Assessments and Most High-Priority Planned
Examinations Were Not Completed (September 30, 2016) (AUD-2016-005), we included a
recommendation that FHFA:

   1. Revise existing guidance to require examiners to prepare complete documentation of
      supervisory activities and maintain such documentation in the official system of
      record, and train DER examiners on this guidance.

The same recommendation applies with equal force to address the documentation deficiencies
identified in this report on Fannie Mae targeted examinations. As a result of our audit work
related to the targeted examinations of Fannie Mae, we are making additional
recommendations. Specifically, we recommend that FHFA:

   2. Assess whether DER has a sufficient complement of qualified examiners to conduct
      and complete those examinations rated by DER to be of high-priority within each
      supervisory cycle and address the resource constraints that have adversely affected
      DER’s ability to carry out its risk-based supervisory plans.

   3. Develop and implement guidance that clearly requires supervisory plans to identify
      and prioritize the planned targeted examinations that are to be completed for each
      supervisory cycle, in order to fully inform the ROE and CAMELSO ratings for that
      cycle.

   4. Develop and implement a control that provides for the tracking and documentation of
      planned targeted examinations, through disposition, in DER’s official system of
      record.

   5. Reinforce and hold EICs accountable to follow DER’s requirement to fully document
      the risk-based justifications for changes to the supervisory plan, and that changes to
      supervisory plans are documented and approved by the EIC. Ensure that examiners
      follow DER Operating Procedures Bulletin 2013-DER-OPB-03.1 to fully document
      the risk-based justifications for changes to the supervisory plan, and that changes to
      supervisory plans are documented and approved by the EIC.

These recommendations also apply to the deficiencies identified in our companion report on
targeted examinations of Freddie Mac (FHFA’s Targeted Examinations of Freddie Mac: Just



                           OIG  AUD-2016-006  September 30, 2016                             27
Over Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed
(September 30, 2016) (AUD-2016-007)).




                          OIG  AUD-2016-006  September 30, 2016                     28
FHFA COMMENTS AND OIG RESPONSE………………………………

OIG provided FHFA an opportunity to respond to a draft report of this audit. FHFA provided
technical comments that we incorporated into this final report, as appropriate. On September 22,
2016, FHFA provided its management response, which is provided in Appendix A. In its
response, FHFA provided three general comments to our draft report. In addition, FHFA
disagreed with recommendation 1, partially agreed with recommendation 2, stated that it issued
internal guidance in May 2016 that FHFA believes confirmed its general agreement with
recommendations 3 and 5, and agreed with recommendation 4. FHFA’s comments and our
responses are below.

     FHFA General Comment

     FHFA believes that the reports21 and several of the recommendations are redundant in
     light of ongoing changes and commitments that FHFA has already made, and is in the
     process of implementing, in response to the OIG report dated January 4, 2016.22 The new
     procedures, together with existing practices and procedures, will result in an effective risk
     assessment and examination planning process that assures that supervisory resources are
     focused on the highest risks at the Enterprises. Because the risk assessment changes were
     recently made in May 2016, there were no results to be reviewed in the OIG fieldwork for
     these reports.

     OIG Response to FHFA General Comment. Our evaluation, dated January 4, 2016, found
     significant shortcomings in DER’s risk assessment process, which FHFA committed to
     address. Internal guidance issued by DER in May 2016, when implemented, purportedly
     will correct those shortcomings. As we explained in one of the companion reports issued
     today, this audit sought to build on that evaluation work to determine whether high-
     priority planned targeted examinations were supported by risk assessments and whether
     those examinations were completed. The objective of this audit is far different than the
     objective of our prior evaluation report.




21
  By reports, FHFA is referring to this report and its two companion reports: FHFA’s Supervisory Planning
Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted Examinations
Did Not Trace to Risk Assessments and Most High-Priority Planned Examinations Were Not Completed (Sept. 30,
2016) (AUD-2016-005), and FHFA’s Targeted Examinations of Freddie Mac: Just Over Half of the Targeted
Examinations Planned for 2012 through 2015 Were Completed (Sept. 30, 2016) (AUD-2016-007).

22
   OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear
Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at
www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).



                                OIG  AUD-2016-006  September 30, 2016                                   29
We performed no work during our prior evaluation to tie planned targeted examinations
back to risk assessments and/or to track the disposition of such examinations. The
recommendations in the three reports from this audit flow directly from the findings of
this audit, not from earlier work.

FHFA General Comment

FHFA disagrees with the reports’ premise or implication that supervisory objectives can
be met only through targeted examinations completed within the calendar year of planning
and that changes to work plans prevented DER from communicating supervisory concerns
to the Enterprises through the ROEs and otherwise. Ongoing monitoring, supervisory
engagement during the course of targeted examination work, completion of examinations
planned in a prior year, examination work added to the plan during the year, and review of
remediation of deficiencies all inform supervisory understanding of Enterprise operations,
risks, and risk management. Advisory Bulletin 2012-03, FHFA Examination Rating
System, dated December 19, 2012 (AB 2012-03), describes FHFA’s CAMELSO ratings
system and provides that ratings take into account various factors, including findings
issued in the current and previous calendar years, progress of remediation of previous
findings, and a regulated entity’s responsiveness to findings by internal and external
parties.

OIG Response to FHFA General Comment. The premise or implication stated by FHFA
was not made in our reports. This audit tracked the disposition of targeted examinations
planned for four supervisory cycles in the review period and found that a significant
number of such examinations were completed after the ROEs for those cycles issued.
From FHFA’s response, it appears that FHFA is comfortable with the fact that a ROE was
issued to one Enterprise for the 2015 supervisory cycle based only on the completion of 3
targeted examinations planned for the 2014 supervisory cycle and completed in 2015, and
no targeted examinations planned for the 2015 supervisory cycle were completed during
that cycle.

FHFA General Comment

FHFA disagrees with the reports’ findings that DER’s documentation of supervisory
activities is lacking or of poor quality. While the documentation recording the basis for
changes to examination plans has been inconsistent at times, the report does not specify
that type of documentation but refers generally to “supervisory documentation.” We
specifically note that FHFA OIG observed in a 2014 report that DER maintained complete




                        OIG  AUD-2016-006  September 30, 2016                              30
     examination documentation for 2013 targeted examinations.23 That OIG report states,
     “We reviewed DER’s workpapers for 28 targeted examinations conducted by the Fannie
     Mae and Freddie Mac Core Teams (together, the Core Teams) in 2013. We found that in
     each of these cases DER staff complied with the Agency’s recordkeeping policies and
     procedures.” Since that report was issued, DER has put in place an enhanced quality
     control review function that will help to ensure that the official records of examination
     activities are complete and maintained appropriately.

     OIG Response to FHFA General Comment. FHFA’s reliance on our 2014 report is
     inapposite. There, we reviewed the examination workpapers for 28 completed targeted
     examinations and found that DER examiners complied with FHFA’s recordkeeping policies
     and procedures. In this audit, other than to look for the presence of the request letter and
     conclusion letter, we did not review examination workpapers for completed targeted
     examinations and made no findings about the quality of those workpapers. While FHFA
     takes credit for DER’s quality control process, we note: (1) that this process was only put
     into place in July 2015, after we completed fieldwork for an evaluation which found that
     DER had reneged on its commitments to put such a process into place for the prior four
     years;24 and (2) that the quality control process only reviews documentation maintained for
     examination work products.

     This audit had an entirely different focus: whether DER examiners created and maintained
     records to document the annual supervisory cycle, from planning through execution. As this
     audit found, DER was unable to provide any documentation for the disposition of 18 targeted
     examinations for both Enterprises – 10 for Fannie Mae and 8 for Freddie Mac – during the
     four supervisory cycles in our review period, notwithstanding our multiple requests.

     Our 2014 report, on which FHFA relies in its comment, also states:

        …we also found that DER’s recordkeeping practices have limitations that impede the
        efficient retrieval of these workpapers by FHFA examiners, other FHFA personnel, and
        outside oversight entities such as the OIG.

     Almost two years later, these limitations have not been addressed by FHFA and hampered
     our work on this audit. FHFA’s inability to provide documentation to show the disposition of
     18 planned targeted examinations during the four supervisory cycles reviewed in this audit –
     roughly 10 percent of the total planned – creates a significant risk exposure.


23
  FHFA is referring to OIG report Evaluation of the Division of Enterprise Regulation’s 2013 Examination
Records: Successes and Opportunities (Oct. 6, 2014) (EVL-2015-001).
24
  OIG, Intermittent Efforts Over Almost Four Years to Develop a Quality Control Review Process Deprived
FHFA of Assurance of the Adequacy and Quality of Enterprise Examinations (Sept. 30, 2015)
(EVL-2015-007) (online at https://www.fhfaoig.gov/Content/Files/EVL-2015-007.pdf).



                                OIG  AUD-2016-006  September 30, 2016                                    31
     FHFA Comments to Recommendation 1

     FHFA disagrees with this recommendation. DER has sufficient guidance in place for
     documentation of supervisory activities. Moreover, in mid-2015, DER put in place an
     enhanced quality control function that provides an independent review of targeted
     examination work products to assess whether written communications to the Enterprises
     are supported by documentation of examination work that meets DER standards and
     applicable FHFA guidance for preparation of written products. DER believes that existing
     internal guidance and the quality control reviews now being performed are effective to
     ensure that the official records of examination activities are complete and maintained
     appropriately. To the extent that this recommendation refers to documentation of risk-
     based changes to examination plans, this issue will be addressed in the course of
     implementing the May 2016 guidance referenced above. To the extent that this
     recommendation refers to tracking of examination activity status, see response to
     recommendation 4 below.

     OIG Response to FHFA Comments to Recommendation 1. As discussed in this report as
     well as in two companion reports issued today, DER’s operating procedures direct that
     supervisory planning is documented and incorporated into official agency records.25 As
     we explained in detail, our efforts to track the planning and execution of DER’s
     supervisory activities through documentation maintained in IMS were not successful
     because a significant amount of documentation was not retained in IMS.

     FHFA’s suggestion that DER’s enhanced quality control reviews will remedy these
     problems is unfounded. In accordance with DER’s quality control review process, put in
     place in July 2015, these reviews are focused on documentation for completed targeted
     examinations. This audit found lack of documentation supporting the planning and
     execution of supervisory activities. Of the 18 targeted examinations planned during the
     four supervisory cycles in our review for which DER provide no documentation to show
     their disposition, 3 were planned for the 2015 supervisory cycle, after the 2015 quality
     control reviews were put into place. DER’s inability to produce documentation to show
     the disposition of 3 targeted examinations planned for the 2015 supervisory cycle
     demonstrates that DER’s current quality control reviews are either not working as FHFA
     expected they would or working as intended but do not address this deficiency.



25
  OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015
High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments and Most High-Priority
Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted
Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015
Were Completed (Sept. 30, 2016) (AUD-2016-007).



                                OIG  AUD-2016-006  September 30, 2016                                  32
As we explained in the companion reports, DER has required, since January 1, 2014, that
all changes to supervisory plans be risk-based, documented in writing, and approved. The
reports issued today demonstrate widespread non-compliance with that requirement.
Instead of addressing that deficiency, FHFA promises that documentation of risk-based
changes to supervisory plans will be addressed in the course of implementing the May
2016 guidance and in enhancements to DER’s mechanisms for tracking changes to
supervisory plans but does not explain how it intends to change examiner behavior.
Simply reiterating an existing requirement that has not been followed is unlikely to
increase compliance.

FHFA Comments to Recommendation 2

DER partially agrees with this recommendation. DER does not agree that current staffing
levels have adversely affected DER’s ability to meet its supervisory responsibilities. DER
agrees, however, that it is a sound practice to regularly assess whether staffing levels are
sufficient to carry out DER responsibilities for fulfillment of FHFA’s mission. As part of
the agency-wide budget process for each fiscal year, DER assesses its resource needs in
making its submission for preparation of FHFA’s annual budget. DER will continue to
provide this information and will seek to promptly fill open positions.

OIG Response to FHFA Comments to Recommendation 2. FHFA’s assertion that DER’s
staffing levels have not adversely affected its ability to meet its supervisory responsibilities
cannot be squared with findings from this audit: DER failed to conduct and complete more
than half of its planned targeted examinations of Fannie Mae for the past four supervisory
cycles and almost half of its planned targeted examinations of Freddie Mac and the reason
repeatedly provided by DER officials for this failure was resource constraints. FHFA’s
commitment to regularly assess staffing levels and fill open positions meets the intent of our
recommendation, provided that these assessments address the resource constraints invoked
by DER officials as the explanation for DER’s inability to complete the targeted
examinations it planned.

FHFA Comments to Recommendations 3 and 5

On May 25, 2016, FHFA issued internal guidance which FHFA believes confirms our
general agreement with these recommendations. As we previously advised OIG staff,
during the first quarter of 2017 FHFA will assess the effectiveness of the enhanced risk
assessment procedures outlined in the guidance and determine whether any revisions are
needed before the mid-year risk assessment process commences in 2017. To the extent
that recommendations 3 and 5 contemplate steps other than those to which FHFA has
previously agreed in response to the OIG’s January 4, 2016 report, we disagree with the
recommendations at this time, but will consider them as part of our 2017 assessment.



                         OIG  AUD-2016-006  September 30, 2016                               33
OIG Response to FHFA Comments to Recommendations 3 and 5. Since FHFA is
committed to implementing recommendations 3 and 5, either through the implementation
of its May 25, 2016 internal guidance or as part of its 2017 assessment, we consider
FHFA’s response to these recommendations to be an agreement. After FHFA performs its
2017 planned mid-year assessment of the implementation of the May 2016 guidance, we
plan to review the results of that assessment. To the extent that FHFA’s assessment finds
that OIG’s recommendations 3 and 5 are not fully implemented by that guidance, we
expect FHFA to take additional corrective actions.

FHFA Comments to Recommendation 4

DER agrees with this recommendation. By September 23, 2017, DER will establish an
improved mechanism for tracking the status of activities included on Enterprise
examination plans, including changes resulting from the mid-year planning update process
and at year-end. The control will reflect approved changes and note the rationale for those
changes.




                        OIG  AUD-2016-006  September 30, 2016                               34
OBJECTIVE, SCOPE, AND METHODOLOGY .................................

We conducted this audit to determine whether FHFA (1) supported its 2014 and 2015 high-
priority planned targeted examinations with risk assessments and completed those planned
high-priority examinations; (2) performed its planned targeted examinations for Fannie Mae
from 2012 through 2015 and, if it did not, whether FHFA documented the deviations from
its plan in accordance with policies and procedures; and (3) performed its planned targeted
examinations for Freddie Mac from 2012 through 2015 and, if it did not, whether FHFA
documented the deviations from its plan in accordance with policies and procedures.

This report addresses the second objective – determining whether FHFA performed its
planned targeted examinations for Fannie Mae from 2012 through 2015, and if it did not,
whether FHFA documented the deviations from its plans in accordance with policies and
procedures. We conducted this audit from December 2015 through June 2016 at FHFA’s
headquarters in Washington, D.C.

To accomplish the audit objective, we:

      Reviewed FHFA’s Examination Manual; DER’s OPB Supervisory Planning Process
       (2013-DER-OPB-03.1); DER’s OPB DER Supervisory Activities (2013-DER-OPB-
       04); and DER’s OPB Guidelines for Preparing Supervisory Products and Examination
       Workpapers (2014-DER-OPB-01);

      Reviewed FHFA’s supervisory plans for 2012 through 2015 and identified planned
       targeted examinations;

      Compared the number of planned targeted examinations for Fannie Mae – as
       described in FHFA’s supervisory planning documents – to the targeted examination
       request letters, conclusion letters, and other relevant documentation in order to
       determine the disposition of the examinations;

      Reviewed FHFA’s Information Management System in an effort to confirm and
       identify the universe of planned targeted examinations and their disposition;

      Reviewed FHFA’s reasons for not fully implementing its examination plans; and

      Interviewed FHFA DER officials regarding their implementation of the supervisory
       plans.

We held an exit conference with FHFA officials on September 12, 2016.




                            OIG  AUD-2016-006  September 30, 2016                           35
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for the findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.




                            OIG  AUD-2016-006  September 30, 2016                               36
APPENDIX A .............................................................................

FHFA’s Comments on OIG’s Findings and Recommendations




                         OIG  AUD-2016-006  September 30, 2016                     37
OIG  AUD-2016-006  September 30, 2016   38
OIG  AUD-2016-006  September 30, 2016   39
OIG  AUD-2016-006  September 30, 2016   40
OIG  AUD-2016-006  September 30, 2016   41
ADDITIONAL INFORMATION AND COPIES .................................


For additional copies of this report:

      Call: 202-730-0880

      Fax: 202-318-0239

      Visit: www.fhfaoig.gov



      To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal
       or noncriminal misconduct relative to FHFA’s programs or operations:

      Call: 1-800-793-7724

      Fax: 202-318-0358

      Visit: www.fhfaoig.gov/ReportFraud

      Write:

                      FHFA Office of Inspector General
                      Attn: Office of Investigations – Hotline
                      400 Seventh Street SW
                      Washington, DC 20219




                             OIG  AUD-2016-006  September 30, 2016                           42