oversight

FHFA's Targeted Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed

Published by the Federal Housing Finance Agency, Office of Inspector General on 2016-09-30.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          Federal Housing Finance Agency
              Office of Inspector General




  FHFA’s Targeted Examinations
         of Freddie Mac:
  Just Over Half of the Targeted
     Examinations Planned for
2012 through 2015 Were Completed




Audit Report  AUD-2016-007  September 30, 2016
                Executive Summary
                The Federal Housing Finance Agency (FHFA or the Agency) is responsible for,
                among other things, ensuring that the Federal National Mortgage Association
                (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac)
                (together, the Enterprises) operate in a safe and sound manner. Within FHFA,
                the Division of Enterprise Regulation (DER) is responsible for the supervision
AUD-2016-007    of the Enterprises. Led by an Examiner-in-Charge (EIC), a core team of DER
                examiners is assigned to conduct supervisory activities for each Enterprise.
September 30,
    2016        Like other federal financial regulators, FHFA maintains that it uses a risk-based
                approach to carry out its supervisory activities. Based on the analysis in its risk
                assessments, DER is to prepare an annual supervisory strategy, followed by a
                supervisory plan that schedules the specific supervisory activities it intends to
                conduct during the year. Those supervisory activities include targeted examinations
                and ongoing monitoring. According to FHFA, targeted examinations enable
                examiners to conduct a deep or comprehensive assessment of selected areas of
                high importance or risk, while the purpose of ongoing monitoring is to analyze
                real-time information and to use those analyses to identify Enterprise practices
                and changes in an Enterprise’s risk profile that may warrant supervisory
                attention. DER is to summarize its examination results in an annual report of
                examination (ROE) issued to the relevant Enterprise’s board of directors. The
                purpose of an ROE is to clearly communicate what FHFA found and its
                supervisory concerns for board action.

                FHFA Office of Inspector General’s (OIG) February 2016 Audit and Evaluation
                Plan identified FHFA’s supervision of its regulated entities as a significant risk
                area. Earlier this year, we assessed the process used by DER to develop its risk
                assessments and recommended a number of measures to improve the
                preparation of these risk assessments. Building on that work, we conducted this
                audit to determine whether DER (1) supported its 2014 and 2015 high-priority
                planned targeted examinations identified in its annual supervisory plans with
                risk assessments and completed those planned high-priority examinations; (2)
                performed its planned targeted examinations for Fannie Mae from 2012 through
                2015 and, if it did not, whether FHFA documented the deviations from its plan
                in accordance with policies and procedures; and (3) performed its planned
                targeted examinations for Freddie Mac from 2012 through 2015 and, if it did
                not, whether FHFA documented the deviations from its plan in accordance with
                policies and procedures. We are issuing three reports from this audit today.

                The first report, FHFA’s Supervisory Planning Process for the Enterprises:
                Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted
                Examinations Did Not Trace to Risk Assessments and Most High-Priority
                Planned Examinations Were Not Completed (September 30, 2016) (AUD-
                2016-005), analyzes whether the high-priority planned targeted examinations
                identified by DER in its annual supervisory plans for 2014 and 2015 for each
                Enterprise were supported by risk assessments and whether those planned high-
                priority targeted examinations were completed.

                The second report, FHFA’s Targeted Examinations of Fannie Mae: Less than
                Half of the Targeted Examination Planned for 2012 through 2015 Were
AUD-2016-007    Completed and No Examinations Planned for 2015 Were Completed Before the
                Report of Examination Issued (September 30, 2016) (AUD-2016-006), analyzes
September 30,   whether DER examiners performed the planned targeted examinations for
    2016        Fannie Mae from 2012 through 2015 and, in those instances where the planned
                targeted examinations were not completed, whether DER documented the
                deviations from its plan in accordance with policies and procedures. This report,
                the third of three, undertakes the same assessment for DER’s targeted
                examinations for Freddie Mac.

                Our audit found that DER planned 90 targeted examinations for Freddie Mac
                from 2012 through 2015. Of these 90, 50 were completed. Based on our review
                of the documents provided to us by DER, we determined that of the remaining
                40 planned targeted examinations: 17 were cancelled, 4 were deferred, 7 were
                converted to ongoing monitoring, 4 were commenced but were not completed,
                and 8 lacked documentation as to their disposition, as of the end of our
                fieldwork on June 17, 2016. Overall, we found that both the number and percent
                of completed targeted examinations that were identified in the annual
                supervisory plans decreased significantly during this four-year period.

                According to FHFA, examination results, conclusions, findings, and
                supervisory concerns from the supervisory activities completed during the
                annual supervisory cycle are summarized in an ROE, which is issued to the
                relevant Enterprise’s board of directors. Because targeted examinations involve
                a “deep or comprehensive assessment” of areas deemed by DER to be of the
                highest importance or risk to the Enterprise, each ROE is intended to clearly
                and concisely summarize the targeted examination activities and findings
                during the annual supervisory cycle, report the results of ongoing monitoring,
                and discuss deficient practices and excessive risks giving rise to supervisory
                concerns. For Enterprise directors to carry out their oversight responsibilities
                under FHFA’s regulations and guidance, they must be made aware of the
                overall condition and risk profile of the Enterprise from the examination results
                and findings during the annual supervisory cycle.

                For the 2014 supervisory cycle, DER planned 36 targeted examinations. Of the
                36 planned targeted examinations, DER completed only 7 before the ROE for
                that cycle issued. As a consequence, the ROE issued for the 2014 supervisory
                cycle was based on only 19 percent of the 36 targeted examinations planned for
                that cycle.

                For the 2015 supervisory cycle, DER planned 18 targeted examinations. Of
                these 18 planned targeted examinations, DER examiners completed 7 before the
                ROE for that supervisory cycle issued on March 11, 2016. Four (4) additional
                targeted examinations were completed after that ROE was issued and 4 targeted
AUD-2016-007    examinations for that cycle were commenced but not completed as of the end of
                our fieldwork on June 17, 2016. As a consequence, findings for 8 (44 percent)
September 30,   targeted examinations conducted for the 2015 supervisory cycle were not
    2016        included in the ROE because they had not been finalized and were not factored
                into FHFA’s CAMELSO ratings for that cycle.

                Effective January 1, 2014, DER requires that changes to supervisory plans
                must be risk-related, approved by the EIC, and documented. Of the 54 targeted
                examinations that were planned for 2014 and 2015, DER documentation
                showed that 21 were not conducted as of June 17, 2016, and DER provided no
                documentation to show the disposition of 7. While DER’s documentation for
                the 21 reported the change in status for each of them, it only included risk-
                related reasons for changing 4 of the 21. When the 7 planned targeted
                examinations for which DER provided no documentation to explain the change
                in status are added to the 17 for which no risk-related basis was provided for
                a change in status, a total of 24 planned targeted examinations out of 28 (86
                percent) lacked a documented risk-related basis for a change, in contravention
                of DER requirements.

                In past evaluation reports, we found that DER (as well as FHFA’s Division
                of Bank Regulation) lacked a sufficient number of examiners and that FHFA
                lacked an adequate number of commissioned examiners. In response to our
                prior reports, FHFA committed to add, and has added, examiners. This audit
                shows that DER failed to conduct and complete just under half of the planned
                targeted examinations for the past four supervisory cycles for Freddie Mac. The
                reason repeatedly provided to us by DER officials for this failure was resource
                constraints, notwithstanding the consistent position of DER leadership, and
                recently reiterated by FHFA senior leadership, that DER has an adequate
                complement of examiners. For a federal financial regulator, responsible for
                supervising two Enterprises that together own or guarantee more than $5 trillion
                in mortgage assets and operate in conservatorship, to fail to complete a
                substantial number of planned targeted examinations is an unsound supervisory
                practice and strategy.

                Our audit work was hampered by the lack of DER’s supervisory documentation
                maintained in its official system of record. In our judgment, the lack of such
                documentation creates a significant risk exposure. This significant risk
                exposure, coupled with the other deficiencies identified in this audit, threatens
                FHFA’s ability to fulfill its statutory mission to ensure that the Enterprises
                operate in a safe and sound manner.

                In the above-mentioned companion reports issued today, we make five
                recommendations that apply with equal force to address the deficiencies related
                to the targeted examinations of Freddie Mac. We are not including any
AUD-2016-007    additional recommendations as a result of our audit work related to Freddie
                Mac. In its written comments to our draft report, FHFA agreed with one
September 30,   recommendation, stated that it issued internal guidance in May 2016 that it
    2016        believes confirmed its general agreement with two other recommendations,
                partially agreed with one recommendation, and disagreed with one
                recommendation. FHFA management’s comments and our response are
                provided in the body of this report.

                Key contributors to this report were Robert Taylor, Assistant Inspector General
                for Audits; Tara Lewis, Director; Pamela L. Williams, Auditor; Terese
                Blanchard, Senior Auditor; Julio Santos, Lead Auditor; and Anya Philbert,
                Senior Auditor. We appreciate the cooperation of FHFA staff, as well as the
                assistance of all those who contributed to the preparation of this report.

                This report has been distributed to Congress, the Office of Management and
                Budget, and others and will be posted on our website, www.fhfaoig.gov.



                /s/

                Marla A. Freedman
                Deputy Inspector General for Audits
TABLE OF CONTENTS……………………………………………………………….
EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................8

BACKGROUND .............................................................................................................................9
      Effective Supervision by FHFA Is Vital to Ensure Freddie Mac’s Safety and
      Soundness .................................................................................................................................9

FACTS AND ANALYSIS.............................................................................................................12
      Analysis of FHFA’s Freddie Mac Planned Targeted Examinations for 2012 through
      2015 ........................................................................................................................................12
             Methodology ...................................................................................................................12
             Analysis ..........................................................................................................................14
      Changes to Supervisory Activities and Plans Were Not Always Documented, and
      When Changes Were Documented, the Reasons Provided Were Largely Not Risk-
      Related ....................................................................................................................................19

FINDINGS .....................................................................................................................................21
      1. DER completed just over half of its planned targeted examinations for the 2012
      through 2015 supervisory cycles and could not account for all of its planned targeted
      examinations. ..........................................................................................................................21
             Just over half of planned targeted examinations for the period 2012-2015 were
                  completed. ...............................................................................................................21
             The usefulness of ROEs is diminished when planned targeted examinations for
                 a supervisory cycle are not completed until after the ROEs issue. .........................21
      2. The number of planned targeted examinations that were completed has dropped
      since 2012. ..............................................................................................................................21
      3. DER’s official system of record for its supervisory activities for Freddie Mac is
      not complete and could not be relied upon, and DER lacked documentation to
      account for all of its supervisory activities. ............................................................................22
      4. DER examiners did not always document changes to supervisory plans and,
      when changes were documented, the reasons provided were largely not risk related,
      in contravention of DER requirements. ..................................................................................22

CONCLUSION ..............................................................................................................................24


                                          OIG  AUD-2016-007  September 30, 2016                                                                 6
      Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records ...............24

RECOMMENDATIONS ...............................................................................................................26

FHFA COMMENTS AND OIG RESPONSE….………………………………. .........................27

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................33

APPENDIX A ................................................................................................................................35
      FHFA’s Comments on OIG’s Findings and Recommendations ............................................35

ADDITIONAL INFORMATION AND COPIES .........................................................................40




                                         OIG  AUD-2016-007  September 30, 2016                                                           7
ABBREVIATIONS .......................................................................

DER                Division of Enterprise Regulation

EIC                Examiner-in-Charge

Enterprises        Fannie Mae and Freddie Mac

Fannie Mae         Federal National Mortgage Association

FHFA or Agency     Federal Housing Finance Agency

Freddie Mac        Federal Home Loan Mortgage Corporation

IMS                Information Management System

MRA                Matter Requiring Attention

OESO               Office of Enterprise Supervision Operations

OIG                Federal Housing Finance Agency Office of Inspector General

OPB                Operating Procedures Bulletin

ROE                Report of Examination




                         OIG  AUD-2016-007  September 30, 2016                    8
BACKGROUND ..............................................................................

Effective Supervision by FHFA Is Vital to Ensure Freddie Mac’s Safety and Soundness

FHFA, created by Congress in 2008, is charged by the Housing and Economic Recovery Act
of 2008 with, among other things, the supervision of the Enterprises and the Federal Home
Loan Banks. Its mission as a federal financial regulator includes ensuring the safety and
soundness of its regulated entities so that they serve as a reliable source of liquidity and
funding for housing finance and community investment. FHFA maintains that it uses a risk-
based approach to plan and execute its supervisory activities. Supervision by risk requires a
comprehensive, risk-focused view of each regulated entity so that supervisory activities can
be tailored to the risks with the highest supervisory concerns.

FHFA’s DER is responsible for supervision of the Enterprises. Pursuant to DER’s Operating
Procedures Bulletin (OPB), Supervisory Planning Process (2013-DER-OPB-03.1), effective
January 1, 2014, the Deputy Director of DER is responsible for developing a supervisory
framework for the Enterprises and ensuring that the supervisory planning is documented and
incorporated into official agency records. Implementation of that supervisory plan is the
responsibility of each EIC who is assigned to lead a core team of examiners for each
Enterprise.

According to FHFA’s Examination Manual, risk assessments provide the foundation for
DER’s annual supervisory strategy for each Enterprise. These semiannual risk assessments
should be revised based upon an updated view of risk developed through supervisory
activities. Using the risk assessments, a supervisory strategy is prepared for each Enterprise
by the DER core teams.1 Once the annual supervisory strategy is approved, the strategy is
implemented through an annual supervisory plan, prepared by the EIC for each Enterprise and
approved by the Deputy Director of DER.

The annual supervisory plan for each Enterprise sets forth the objectives for carrying out the
supervisory strategy and identifies the supervisory activities, both targeted examinations and
ongoing monitoring, for the year. FHFA expects that DER’s supervisory activities will be
prioritized based on the risk that a specific practice poses to the Enterprises’ safe and sound
operations or to their compliance with applicable laws and regulations. FHFA guidance
contemplates that the risk assessments prepared for each Enterprise will identify those areas
of high importance or risk.


1
  FHFA expects EICs to periodically review each supervisory strategy and update it to reflect any changes in
supervisory objectives, the Enterprise’s financial condition, and/or trends in risk exposures. Any risk-based
changes to the supervisory strategy must be approved by the Deputy Director of DER.



                                  OIG  AUD-2016-007  September 30, 2016                                       9
Using that identification, each annual supervisory plan sets forth the planned supervisory
activities for the year, consisting of ongoing monitoring and targeted examinations. According
to FHFA, ongoing monitoring and targeted examinations serve complementary purposes. The
purpose of ongoing monitoring is to analyze real-time information and to use those analyses
to identify Enterprise practices and changes in an Enterprise’s risk profile that may warrant
supervisory attention. Ongoing monitoring is also “used to determine the status of the
Enterprise’s compliance with supervisory guidance, MRAs [Matters Requiring Attention],
and conservatorship directives[.]” Targeted examinations complement ongoing monitoring:
they enable examiners to conduct “a deep or comprehensive assessment” of the areas found
to be of high importance or risk. Because each of these supervisory activities has a separate
purpose, they are not interchangeable.

DER examiners may identify supervisory concerns or deficiencies occurring at an Enterprise
as a result of targeted examinations or ongoing monitoring. According to FHFA, only the
most serious supervisory deficiencies are categorized as MRAs.2 Most of the MRAs issued by
DER have issued out of targeted examinations. FHFA guidance also contemplates that special
“ad hoc” supervisory activities may be initiated throughout the year as a product of ongoing
monitoring. As these supervisory activities are not planned, they are not added to the annual
supervisory plan.

Because supervisory planning is a continuous process, FHFA expects that each EIC will
adjust the applicable supervisory plan to add newly emerging risks that require attention
during the current supervisory cycle. Beginning in 2014, DER guidance instructs that
approved supervisory plans shall only be adjusted for risk-based reasons and justifications for
the adjustments must be approved by the EIC (after consultation with the Deputy Director of
DER, as warranted) and fully documented in the work papers. Adjustments include adding or
deleting supervisory activities, or changing the objective, scope, and methodology of a
supervisory activity.

According to FHFA guidance, examination results, conclusions, findings, and supervisory
concerns from the supervisory activities completed during the annual supervisory cycle are
summarized in a ROE, which is issued to the relevant Enterprise’s board of directors. Each
ROE is intended to clearly and concisely convey the overall condition and risk profile of the



2
  According to FHFA, MRAs are the most serious supervisory matters and they include, among other things,
such matters as non-compliance with laws or regulations that result or may result in significant risk of financial
loss or damage to the regulated entity; repeat deficiencies that have escalated due to insufficient action or
attention; unsafe or unsound practices; and matters that have resulted, or are likely to result, in a regulated
entity being in an unsafe or unsound condition. MRAs also include breakdowns in risk management,
significant control weaknesses, or inappropriate risk-taking.




                                   OIG  AUD-2016-007  September 30, 2016                                           10
Enterprise, summarize examination activities and findings during the annual supervisory
cycle, and discuss deficient practices and excessive risks giving rise to supervisory concerns. 3




3
  For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing
ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify
Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the
Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns
(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG,
FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain
Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those
Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).



                                  OIG  AUD-2016-007  September 30, 2016                                        11
FACTS AND ANALYSIS ..................................................................

Analysis of FHFA’s Freddie Mac Planned Targeted Examinations for 2012 through 2015

      Methodology

Because targeted examinations constitute a critical component of FHFA’s supervisory
activities, we examined, as part of this audit, whether DER examiners conducted and
completed the targeted examinations identified in each supervisory plan for Freddie Mac
from 2012 through 2015, the review period for this audit. For the last two years of the review
period, 2014 and 2015, the two annual supervisory cycles when DER required that any
changes to the supervisory plans be risk-related, approved by the EIC, and documented, we
sought to determine whether DER examiners complied with these requirements when a
planned targeted examination was either (1) not conducted because it was converted to
ongoing monitoring, cancelled, or deferred, (2) commenced but not completed, or
(3) documentation was not provided for us to determine its disposition.

For purposes of this audit, we considered a targeted examination to be “commenced” when
DER issued a request letter.4 We considered a targeted examination to be “completed” when
DER issued a conclusion letter to Freddie Mac.5 We considered a targeted examination to be
“not conducted” when DER documents demonstrated that the status of that examination was
changed to ongoing monitoring, cancelled, or deferred. We considered a targeted examination
to be “commenced but not completed” based on DER’s representation that the examination
was in progress in one of three phases: fieldwork, management review, or quality review,
absent any other conflicting documentation provided or discovered during our review of DER
documentation. We considered a targeted examination to be “disposition not documented”
when DER did not provide any documentation regarding the disposition of the targeted
examination in response to our requests.

To perform our audit, we developed a list of targeted examinations for Freddie Mac planned
by DER for the review period from annual supervisory plans and other information that was
gathered by our Office of Evaluations in support of another assignment6 and supplemented


4
    DER, Operating Procedures Bulletin, DER Supervisory Activities (Sept. 19, 2013) (2013-DER-OPB-04).
5
  Once the fieldwork for a targeted examination has been completed and the examination team develops its
findings, the EIC communicates those findings to the affected Enterprise through issuance of a conclusion
letter.
6
  See OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear
Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at
www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).



                                  OIG  AUD-2016-007  September 30, 2016                                   12
that information with records from FHFA’s Information Management System (IMS), DER’s
official system of record. We then sought to track whether each planned targeted examination
was commenced and later completed. In some instances, IMS did not contain sufficient
information to permit us to complete the tracking exercise. We also found evidence that some
targeted examinations were completed but had not been identified on the annual supervisory
plan.

We asked DER’s Office of Enterprise Supervision Operations (OESO)7 to confirm whether
(1) the universe of planned targeted examinations for the review period that we had identified
was complete; (2) the information we obtained about the commencement and completion of
each planned targeted examination was complete and accurate; and (3) to explain the reasons
why specific targeted examinations were conducted and completed but were not on any
supervisory plan. OESO responded that it could not provide such a confirmation because
there had been a significant shift in DER’s senior management and managers, and DER had
“significantly refined” its records management processes since then.

Seeking answers to our questions, we made subsequent requests to the then-current EIC for
the Freddie Mac core team. He explained to us that the Freddie Mac core team of examiners
used quarterly analysis memoranda to track the status of targeted examinations. Tracking
targeted examinations through quarterly analysis memoranda is a practice developed and used
by the Freddie Mac core team, but is not an official system of record and is not required by
DER. He further explained that examination managers on the Freddie Mac core team used the
quarterly analysis memoranda to document modifications to the supervisory plan, such as
revisions, additions, cancellations, and conversions to ongoing monitoring.

However, we identified eight planned targeted examinations on supervisory plans for the 2012
through 2015 supervisory cycles for which the current status of each targeted examination was
not reflected on the quarterly analysis memoranda. We were not provided a request letter or
conclusion letter issued to Freddie Mac for any of these eight planned targeted examinations by
DER, suggesting to us that none had been commenced. We were also not able to determine the
status of any of these eight from IMS. In response to our questions about the status of each of
these eight, the then-current EIC could not provide documentation to show whether any had been
commenced. The lack of information on the status of these eight targeted examinations in the
quarterly analysis memoranda calls into question the reliability of that method to track the status
of each planned targeted examination in each supervisory plan for Freddie Mac.


7
 Within DER, the purpose of OESO is to provide support for the activities of all DER offices and to promote
consistency, efficient business operations, and adherence to FHFA standards. OESO is responsible for
development of DER policies and procedures for program activities, administration of DER’s quality control
program, and coordination of DER responses to oversight entities such as OIG. Among other things, OESO
coordinates work to ensure DER compliance with FHFA records management and other policies.



                                 OIG  AUD-2016-007  September 30, 2016                                      13
Apart from the quarterly analysis memoranda prepared by the Freddie Mac core team, no
DER official told us about any other controls used by DER examiners to track the status
of targeted examinations and our audit did not identify any such controls. DER examiners
typically track the status of planned targeted examinations in the quarterly analysis
memoranda by reference to the title of the examinations. However, when a title of a planned
targeted examination is changed during the supervisory cycle, DER lacked any control to
track the status of that examination and relied on the recollections of the EIC and other
examiners.

    Analysis

DER planned 90 targeted                FIGURE 1. EXECUTION BY DER OF 90 PLANNED TARGETED
examinations for Freddie Mac            EXAMINATIONS OF FREDDIE MAC 2012 THROUGH 2015
during the four-year review
period. Of these 90 planned
targeted examinations, we                         8                         Completed
                                            4
found, as of the end of our
fieldwork on June 17, 2016:                                                 Not Conducted
50 targeted examinations were                                 50
completed (56 percent), 28 were          28                                 Commenced But Not
not conducted (31 percent), and                                             Completed
4 were commenced but not                                                    Disposition Not
completed (4 percent). Of the                                               Documented
28 that were not conducted,
DER documentation established
that 17 were cancelled outright, 4 were deferred, and 7 were converted to ongoing monitoring
(see Figure 4). For the remaining 8 planned targeted examinations, DER did not provide any
information for us to determine their disposition (9 percent).8 As we discuss in greater detail
below, a number of targeted examinations planned for one supervisory cycle were completed
by DER examiners in subsequent supervisory cycles, so the completion data is as of the end
of our fieldwork, not the end of each supervisory cycle. Figure 1 captures the information for
all years in graphic format.

Looking at the number of planned targeted examinations by year, we found that the 2012,
2013, and 2015 supervisory cycles ranged from 17 to 19, with a spike in the number of
planned targeted examinations for the 2014 supervisory cycle to 36. DER produced its written

8
  We also found evidence in IMS of three targeted examinations during the review period that were not
included in any annual supervisory plans. Of these three targeted examinations that were not contained in
the supervisory plans, DER provided documentation that two were completed. The other examination was
identified by DER as commenced but not completed as of the end of our fieldwork on June 17, 2016.




                                 OIG  AUD-2016-007  September 30, 2016                                    14
Supervisory Strategy for 2014 to us which stated,

            9
             We found no documentation to explain the reasons for the spike in planned
targeted examinations from 17 in 2013 to 36 in 2014. During our fieldwork, we asked DER’s
then-current EIC for Freddie Mac to explain the reasons for the 2014 spike. He told us that
relatively few additional examiners were hired onto the Freddie Mac core team during the
review period. He also speculated that the number of targeted examinations relative to the
number of ongoing monitoring activities may have shifted during that year.

After our fieldwork ended and we submitted a draft report to DER for its technical comments,
DER provided a different explanation for the spike. DER advised that the spike in 2014 was
anomalous, driven by a request from then-senior DER management to examination managers
to “list all issues that could reasonably be topics of targeted examinations, regardless of
resource constraints and including all risk levels.” DER’s explanation, if accurate, would
reduce the risk-based planning process for the 2014 supervisory cycle to a nullity because the
supervisory plan would amount to an unprioritized wish list.

Our analysis of DER’s execution of       FIGURE 2. DER’S PLANNED TARGETED EXAMINATIONS FOR
its planned targeted examinations        FREDDIE MAC—PERCENT COMPLETED AS OF JUNE 17, 2016*
for each year of the review period
                                        100%              95%
found significant disparities from
                                         90%
year to year regarding the number
                                         80%
of completed targeted examinations.
                                         70%
Overall, we found that both the                                        59%                            61%
                                         60%
number and percent of completed          50%
targeted examinations identified in      40%
the annual supervisory plans             30%
                                                                             31%
significantly decreased after the        20%
2012 supervisory cycle, even when        10%
DER is credited with the                  0%
completion of planned targeted                       2012          2013          2014            2015
examinations after the supervisory      * Includes targeted examinations completed after the respective
cycle ended. As noted, DER              ROE issued.
completed 18 of 19 targeted
examinations (95 percent) planned for the 2012 supervisory cycle, which declined to 10 of 17
targeted examinations (59 percent) planned for the 2013 supervisory cycle. For the 2014
supervisory cycle, 11 of 36 planned targeted examinations (31 percent) were completed and

9
  Thirty-four (34) planned targeted examinations were identified in FHFA’s initial supervisory plan for Freddie
Mac. Two more planned targeted examinations were added during the mid-year update for the 2014
supervisory cycle, bringing the total number of targeted examinations planned for the supervisory cycle to 36.



                                  OIG  AUD-2016-007  September 30, 2016                                         15
for the 2015 supervisory cycle, 11 of 18 planned targeted examinations (61 percent) were
completed as of the end of our fieldwork on June 17, 2016. Figure 2 captures this information
graphically.

As Figure 2 reflects, the percentage           FIGURE 3. FHFA’S NO. OF COMPLETED, PLANNED TARGETED
of completed targeted examinations               EXAMINATIONS FOR FREDDIE MAC AS OF JUNE 17, 2016
identified on the supervisory plans
ticked up from 2014 to 2015, from              45
31 to 61 percent. The explanation              40                                       11 of 36

for this increase is because the               35
                                               30
number of planned targeted
                                               25
examinations dropped from 36                             18 of 19
                                               20                       10 of 17                       11 of 18
in 2014 to 18 in 2015, while the
                                               15
number of targeted examinations
                                               10
completed for each of these two
                                                5
supervisory cycles remained
                                                0
constant at 11. Figure 3 captures this
                                                          2012            2013           2014           2015
information by year for the review
                                                    * Includes targeted examinations completed after the respective
period.                                             ROE issued.

As discussed earlier in this report, DER is to summarize its examination results and
conclusions, findings, and supervisory concerns from the supervisory activities completed
during the annual supervisory cycle in an annual ROE issued to the relevant Enterprise’s
board of directors. The purpose of an ROE is to clearly communicate to the board of directors
of the Enterprise: the examination results and conclusions; findings and other supervisory
concerns, such as deficient, unsafe, and unsound practices; and the composite and component
ratings assigned in accordance with FHFA’s rating system. For Enterprise directors to carry
out their oversight responsibilities under FHFA’s regulations and guidance, they must be
made aware of the overall condition and risk profile of the Enterprise from the examination
results and findings during the annual supervisory cycle.10 According to FHFA’s performance
plan, DER must approve the final ROE for the prior supervisory cycle for each Enterprise by
March 31.


10
   For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing
ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify
Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the
Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns
(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG,
FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain
Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those
Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).




                                  OIG  AUD-2016-007  September 30, 2016                                         16
According to FHFA, it uses targeted examinations to conduct deep or comprehensive
assessments of areas found to be of high importance or risk and most of the MRAs issued
by DER, for the most significant supervisory deficiencies, have been issued as a result of
findings from targeted examinations.

For the 2014 supervisory cycle, DER planned 36 targeted examinations, significantly higher
than the number of targeted examinations planned in prior cycles.11 Of these 36, DER
completed only 7 before the ROE for that supervisory cycle issued. As a consequence, the
ROE issued for the 2014 supervisory cycle was based on only 19 percent of the 36 targeted
examinations planned for that cycle. Four (4) of the 36 targeted examinations planned for
2014 were completed after the 2014 ROE issued and were included in the 2015 ROE, which
issued in March 2016.12 While there may be some usefulness to completing a targeted
examination planned for one supervisory cycle in a subsequent cycle, there is also a risk that
the examination fieldwork could be outdated by the time the conclusion letter, with findings,
is issued to the Enterprise.

For the 2015 supervisory cycle, DER planned 18 targeted examinations and completed 7
during the supervisory cycle as well as 4 targeted examinations planned for and commenced
during the 2014 supervisory cycle and completed in 2015. Four additional targeted
examinations, planned for the 2015 supervisory cycle and commenced in that cycle, were
completed between April and June 2016, after the 2015 ROE issued.13          MRAs were
issued in connection with these four targeted examinations but will not be reported by DER to
the Freddie Mac board until the 2016 ROE issues in March 2017.14 Based on our review of
DER records, four more planned targeted examinations for the 2015 supervisory cycle were
commenced but not completed as of the end of our fieldwork on June 17, 2016.




11
  As previously discussed, the explanation for this spike in planned targeted examinations for the 2014
supervisory cycle provided by the then-current EIC, during our fieldwork, was different than the explanation
subsequently provided by DER after it reviewed our draft.
12
  Conclusion letters for the four targeted examinations were dated March 30, 2015; March 31, 2015; April 13,
2015; and May 15, 2015.
13
  Conclusion letters for these four targeted examinations were dated April 7, 2016; May 9, 2016; June 8,
2016; and June 10, 2016.
14
  The 2015 ROE reported         new MRAs from the 11 targeted examinations completed during the 2015
supervisory cycle.



                                  OIG  AUD-2016-007  September 30, 2016                                      17
Effective with the 2013 ROE, FHFA has used the CAMELSO rating system to report
examination findings and conclusions to the Enterprise’s board of directors.15 The
CAMELSO rating for Freddie Mac for the 2014 supervisory cycle was informed by 11
targeted examinations, 4 began in 2013 and completed in 2014, and 7 planned and completed
during the 2014 cycle. The CAMELSO rating for the 2015 supervisory cycle was informed
by 11 completed targeted examinations, 4 began in 2014 and completed in 2015, and 7
commenced and completed in 2015. By not completing all planned targeted examinations for
the supervisory cycles, the findings from those examinations were not available to inform the
CAMELSO ratings for each cycle.

Figure 4 captures, by year, the disposition of DER’s planned targeted examinations for
Freddie Mac.

        FIGURE 4. SUMMARY OF FHFA’S PLANNED TARGETED EXAMINATIONS FOR FREDDIE MAC
                           2012 THROUGH 2015, AS OF JUNE 17, 2016
                                                               2012      2013     2014a/     2015      Totals
     Planned Targeted Examinations                              19        17        36        18           90
     Completed                                                  18        10        11        11           50
       Before ROE for that Supervisory Cycle Issuedb/           13         6         7         7
       After ROE for that Supervisory Cycle Issuedc/             5         4         4         4
     Commenced But Not Completed                                 0         0         0         4            4
     Not Conducted                                               1         6        20         1           28
       Cancelled                                                 0         0        16         1
       Deferred                                                  0         2         2         0
       Converted to Ongoing Monitoring                           1         4         2         0
     Disposition Not Documented                                  0         1         5         2               8
a/
  The explanation for this spike in planned targeted examinations for the 2014 supervisory cycle provided by the
then-current EIC, during our fieldwork, was different than the explanation subsequently provided by DER after it
reviewed our draft.
b/
  For 2012 and 2013, there was not a requirement that targeted examinations be completed before the ROE
issued.
c/
  These targeted examinations were completed before the ROE for the subsequent supervisory cycle issued
except for one targeted examination planned for 2012 that was not completed until the 2014 supervisory cycle
ROE issued.




15
   The term CAMELSO is the acronym used to describe the following seven components: Capital, Asset
Quality, Management, Earnings, Liquidity, Sensitivity to Market Risk, and Operational Risk. The CAMELSO
rating system consists of: (1) an overall condition of each regulated entity (the composite rating), and
(2) individual components of financial condition and risk management (the component ratings). The composite
and component ratings are on a scale from “l” to “5”, with a “1” indicating the lowest degree of supervisory
concern and a “5” the highest.



                                 OIG  AUD-2016-007  September 30, 2016                                           18
Changes to Supervisory Activities and Plans Were Not Always Documented, and When
Changes Were Documented, the Reasons Provided Were Largely Not Risk-Related

Because supervisory planning is a continuous process, supervisory plans need to be adjusted
during each year to address newly emerging risks that require attention during the current
supervisory cycle. Beginning with the 2014 supervisory cycle, DER’s guidance in
2013-DER-OPB-03.1 directs that approved supervisory plans shall only be adjusted for risk-
related reasons, and justifications for the adjustments must be approved by the EIC (after
consultation with the Deputy Director of DER, as warranted) and fully documented in the
work papers.

As shown in Figure 4 above, a total of 54 targeted examinations were identified on DER’s
supervisory plans for 2014 and 2015. Of those 54 planned targeted examinations, 22 were
completed and 4 were commenced but not completed at the end of our fieldwork in June
2016. Twenty-eight (28) of the 54 (52 percent) planned targeted examinations for 2014 and
2015 were either not conducted or their disposition was not documented. Of these 28, DER
produced no documentation relating to the disposition for 7. DER had ample opportunity to
provide us with such documentation; beginning in December 2015, we asked DER, on
multiple occasions, to provide us documentation for specific planned supervisory activities
that we could not find in its official system of record. DER provided us with some
documentation related to other planned supervisory activities but no documentation to show
the disposition of these 7 planned targeted examinations.

For the other 21 of the 28 planned targeted examinations, DER provided written materials
explaining the change in status: 17 were cancelled, 2 were converted to ongoing monitoring,
and 2 were deferred.16 We sought to determine whether a documented risk-related reason
existed for the change in status for each, as required by 2013-DER-OPB-03.1. DER produced
documentation that, in our view, explained the risk-related change for 4 of these 21.17 For the
remaining 17 of the 21, the documentation provided by DER relating to the change in status
did not provide risk-related reasons, in contravention of 2013-DER-OPB-03.1.18



16
  Those written materials included internal memoranda, a mid-year update document, and a cancellation
memorandum issued to Freddie Mac.
17
  The risk-related reasons for the change in status for 4 planned targeted examinations included: cancellation
because of the results of a Freddie Mac internal audit, ongoing monitoring revealed no concerns, and Freddie
Mac internal business processes changed.
18
   The documentation produced by DER to explain the change in status for the 17 planned targeted
examinations reported: 7 were changed from a higher priority to a lower priority, without an explanation for
the change in priority; 6 were removed from the supervisory plan or converted to ongoing monitoring, without
any reason documented; and 4 were cancelled or deferred for resource constraints.



                                  OIG  AUD-2016-007  September 30, 2016                                        19
Because DER’s guidance instructs that changes to an approved supervisory plan for 2014 and
2015 must be risk-related and approved by the EIC, we asked the then-current EIC for the
Freddie Mac core team if he could recall any risk-related reasons underlying the change in
status for these 17 planned targeted examinations. He could not recall any basis for the
cancellation, conversion to ongoing monitoring, or deferral for 27 of the 28 planned targeted
examinations, although he advised that he would have approved each of the changes through
IMS. He recalled that 1 of the 28 planned targeted examinations was cancelled because the
examination manager determined that the internal process targeted by the examination had
been changed by Freddie Mac and examining an outdated process would be a waste of
resources. His recollection was consistent with the written documentation provided by DER
for this change, which we considered risk-related, although his approval of the documentation
was not reflected in IMS. In all, we found evidence in IMS of the then-current EIC’s approval
for only 1 of the other 27 changes to the planned targeted examinations.




                            OIG  AUD-2016-007  September 30, 2016                             20
FINDINGS .................................................................................

   1. DER completed just over half of its planned targeted examinations for the 2012
      through 2015 supervisory cycles and could not account for all of its planned
      targeted examinations.

   Just over half of planned targeted examinations for the period 2012-2015 were
   completed.

DER prepares an annual supervisory plan that identifies the supervisory activities it intends
to conduct during the year. According to FHFA, targeted examinations enable examiners to
conduct a deep or comprehensive assessment of selected areas of high importance or risk. Our
audit found that DER planned 90 targeted examinations for Freddie Mac from 2012 through
2015 but completed only 50 (56 percent).

After it received our draft report, management asserted to us that the 2014 supervisory
plan was an outlier and an unfair baseline against which to assess completion of targeted
examinations. Even when the planned and completed targeted examinations from the 2014
supervisory cycle are removed from the analysis, DER completed 39 of 54 (72 percent)
planned targeted examinations for three of the four supervisory cycle in this review (2012,
2013, and 2015).

   The usefulness of ROEs is diminished when planned targeted examinations for a
   supervisory cycle are not completed until after the ROEs issue.

DER summarizes its examination results in an annual ROE issued to the relevant Enterprise’s
board of directors. The ROE is intended to clearly and concisely convey the overall condition
and risk profile of the Enterprise, summarize examination activities and findings during the
annual supervisory cycle, and discuss deficient practices and excessive risks giving rise to
supervisory concerns. For the 2012 through 2015 supervisory cycles, DER completed a total
of 17 targeted examinations after the ROE for the respective supervisory cycle issued.

   2. The number of planned targeted examinations that were completed has
      dropped since 2012.

FHFA views targeted examinations as the opportunity to conduct a deep or comprehensive
assessment of selected areas of high importance or risk. For the 2012 supervisory cycle, DER
completed 18 of the 19 planned targeted examinations for Freddie Mac (of which 5 were
completed after the 2012 ROE issued) but completed only 11 of the 18 planned targeted
examinations for the 2015 supervisory cycle, as of the end of our fieldwork (of which 4 were


                            OIG  AUD-2016-007  September 30, 2016                             21
completed after the 2015 ROE issued). During the audit, the then-current EIC provided no
explanation for the notable decrease in the number of completed targeted examinations during
the review period and could only recall one planned targeted examination that was not
completed. Documents prepared by DER examiners and provided to us by DER attributed the
failure to complete certain planned targeted examinations within the review period to resource
constraints.

   3. DER’s official system of record for its supervisory activities for Freddie Mac is
      not complete and could not be relied upon, and DER lacked documentation to
      account for all of its supervisory activities.

DER was unable to provide us with documentation to show the disposition of 8 of 90 targeted
examinations (9 percent) planned during the four supervisory cycles of our review period.

According to its operating procedures, DER is to ensure that the supervisory planning is
documented and incorporated into official agency records. IMS is DER’s official system
of record for documentation of its supervisory activities. Our efforts to track through IMS
whether each planned targeted examination was commenced and completed were not
successful because IMS did not contain sufficient information to permit us to complete
the tracking exercise. Despite repeated requests, DER was unable to provide any
documentation for the disposition of 8 targeted examinations planned during the four
supervisory cycles in our review period. Furthermore, apart from the incomplete quarterly
analysis memoranda maintained by the core team of examiners for Freddie Mac – which is
not DER’s official system of record – we found that DER had no operating controls in place
to ensure that supervisory documentation in IMS was complete and to accurately track the
status of planned targeted examinations through disposition.

   4. DER examiners did not always document changes to supervisory plans and,
      when changes were documented, the reasons provided were largely not risk
      related, in contravention of DER requirements.

Beginning with the 2014 supervisory cycle, DER requires that all changes to supervisory
plans be risk-related, approved by the EIC, and documented. Twenty-eight (28) of the 54 (52
percent) planned targeted examinations for 2014 and 2015 were either not conducted or their
disposition was not documented. Of these 28, DER provided documentation to show a change
in status for 21. Our review of this documentation identified risk-related reasons to support
the change in status only for 4 of the 21. DER provided no documentation to explain the
disposition of 7 of these 28. When the 7 planned targeted examinations for which DER
provided no documentation to explain the change in status are added to the 17 for which
no risk-related basis was documented in the materials provided to us by DER, a total of 24



                            OIG  AUD-2016-007  September 30, 2016                              22
planned targeted examinations out of 28 (86 percent) lacked a documented risk-related basis
for a change, in contravention of DER requirements.




                            OIG  AUD-2016-007  September 30, 2016                           23
CONCLUSION ............................................................................

For the four supervisory cycles assessed in this audit, DER planned 90 targeted examinations
but completed only 50 (56 percent). Because 8 targeted examinations planned for the 2014
and 2015 supervisory cycles were completed after their respective supervisory cycles ended,
the results were not discussed in the ROE for that cycle or factored into the CAMELSO
rating. For the 2014 and 2015 supervisory cycles, DER examiners were only permitted to
make changes to supervisory plans for risk-related reasons and were required to obtain
approvals for those changes and document the risk-related reasons. However, this requirement
was often not followed: of the 54 planned targeted examinations for these cycles, 28 were not
conducted or their disposition was not documented, and only 4 of the 28 documented risk-
related reasons for the changes in the supervisory plans.

In past reports, we found that that FHFA lacked a sufficient number of examiners. In
response, FHFA committed to add examiners and has added examiners.19 As this assessment
shows, DER failed to conduct and complete just under half of the planned targeted
examinations for the past four supervisory cycles. The reason provided to us in a number of
instances by DER officials for this failure was resource constraints, notwithstanding the
consistent position of DER leadership as recently reiterated by FHFA senior leadership that
DER has an adequate complement of examiners. For a federal financial regulator responsible
for supervising two Enterprises that together own or guarantee more than $5 trillion in
mortgage assets and operate in conservatorship, to fail to complete a substantial number of
planned target examinations is an unsound supervisory practice and strategy.

Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records

We consider the lack of DER’s documentation supporting its supervisory activities, as it relates to
this audit, to create a significant risk exposure. This condition impacted the objectives of this
report as well as those in its two companion reports, which were also issued today.

According to DER’s operating procedures, DER is to ensure that the supervisory planning is
documented and incorporated into official agency records. IMS is DER’s official system of
record for documentation of its supervisory activities. Our efforts to track documentation of


19
   OIG, Evaluation of Whether FHFA Has Sufficient Capacity to Examine the GSEs (Sept. 23, 2011) (EVL-
2011-005) (online at www.fhfaoig.gov/Content/Files/EVL-2011-005.pdf); OIG, Update on FHFA’s Efforts to
Strengthen its Capacity to Examine the Enterprises (Dec. 19, 2013) (EVL-2014-002) (online at
www.fhfaoig.gov/Content/Files/EVL-2014-002.pdf). See also FHFA, FY2015 Performance and Accountability
Report (Nov. 16, 2015) (Memorandum to Director Watt from Inspector General Wertheimer re: Fiscal Year
2016 Management and Performance Challenges) (online at
www.fhfa.gov/AboutUs/Reports/ReportDocuments/FHFA-2015-PAR.pdf) (accessed Aug. 2, 2016).



                               OIG  AUD-2016-007  September 30, 2016                                   24
the planning and execution of DER’s supervisory activities through IMS were not successful
because a significant amount of documentation was not retained in IMS. During our audit, we
needed to make multiple information requests to DER for basic documentation relating to
supervisory plans and their execution because such documentation was not always found in
DER’s official system of record. Although DER located some documentation outside the
official system of record, it was not able to find all requested documentation.

DER often relied on the recollections of the then-current EICs to explain the universe of
planned targeted examinations and the disposition of those planned targeted examinations for
the supervisory cycles within the review period of this audit (2012-2015), which, at times,
were later found to be inaccurate. DER’s inability to retrieve all supervisory documentation
from its official system of record, its difficulty in finding documentation outside its official
system of record, and its significant reliance on the imperfect individual recollections of
personnel delayed us from the timely and efficient completion of our work.

DER officials maintained to us that a significant shift in DER’s senior management and
managers led to the lack of proper and complete documentation in IMS supporting its
supervisory activities. That explanation surprises us. FHFA, which was created in 2008, took
over the supervision of the Enterprises from its predecessor agency that had been operating
since 1992, and it is not credible that a federal financial regulator, charged with supervision
of the Enterprises, would be so impacted by a shift in senior management and managers.

That explanation, however, is the only one offered by DER. If it is taken at face value, DER’s
haphazard approach to creating and retaining complete documentation for its supervisory
activities creates enormous risk. This risk, coupled with the other deficiencies identified in
this audit, threatens FHFA’s ability to fulfill its statutory mission.

In our judgment, deliberate urgency and resolute commitment by FHFA management to
resolve these collective deficiencies, and to implement the recommendations in this report and
its two companion reports, is required.20




20
   OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015
High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments, and Most High-Priority
Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted
Examinations of Fannie Mae: Less than Half of the Targeted Examinations Planned for 2012 through 2015
Were Completed and No Examinations Planned for 2015 Were Completed Before the Report of Examination
Issued (Sept. 30, 2016) (AUD-2016-006).



                               OIG  AUD-2016-007  September 30, 2016                                  25
RECOMMENDATIONS ...............................................................

In companion reports issued today, FHFA’s Supervisory Planning Process for the
Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted
Examinations Did Not Trace to Risk Assessments and Most High-Priority Planned
Examinations Were Not Completed (September 30, 2016) (AUD-2016-005) and FHFA’s
Targeted Examinations of Fannie Mae: Less than Half of the 2012 through 2015 Planned
Examinations Were Completed and No Planned Examinations for 2015 Were Completed
Before the Report of Examination Issued (September 30, 2016) (AUD-2016-006), we
recommend that FHFA:

   1. Revise existing guidance to require examiners to prepare complete documentation
      of supervisory activities and maintain such documentation in the official system of
      record, and train DER examiners on this guidance.

   2. Assess whether DER has a sufficient complement of qualified examiners to conduct
      and complete those examinations rated by DER to be of high-priority within each
      supervisory cycle and address the resource constraints that have adversely affected
      DER’s ability to carry out its risk-based supervisory plans.

   3. Develop and implement guidance that clearly requires supervisory plans to identify
      and prioritize the planned targeted examinations that are to be completed for each
      supervisory cycle, in order to fully inform the ROE and CAMELSO ratings for that
      cycle.

   4. Develop and implement a control that provides for the tracking and documentation of
      planned targeted examinations, through disposition, in DER’s official system of
      record.

   5. Reinforce and hold EICs accountable to follow DER’s requirement to fully document
      the risk-based justifications for changes to the supervisory plan, and that changes to
      supervisory plans are documented and approved by the EIC. Ensure that examiners
      follow DER Operating Procedures Bulletin 2013-DER-OPB-03.1 to fully document
      the risk-based justifications for changes to the supervisory plan, and that changes to
      supervisory plans are documented and approved by the EIC.

These recommendations apply with equal force to address the findings identified in this report
on Freddie Mac targeted examinations. Our audit work related to the targeted examinations of
Freddie Mac did not identify any additional findings requiring recommendations.




                            OIG  AUD-2016-007  September 30, 2016                              26
FHFA COMMENTS AND OIG RESPONSE….……………………………….

OIG provided FHFA an opportunity to respond to a draft report of this audit. FHFA provided
technical comments that we incorporated into this final report, as appropriate. On September 22,
2016, FHFA provided its management response, which is provided in Appendix A. In its
response, FHFA provided three general comments to our draft report. In addition, FHFA
disagreed with recommendation 1, partially agreed with recommendation 2, stated that it issued
internal guidance in May 2016 that FHFA believes confirmed its general agreement with
recommendations 3 and 5, and agreed with recommendation 4. FHFA’s comments and our
responses are below.

     FHFA General Comment

     FHFA believes that the reports21 and several of the recommendations are redundant in
     light of ongoing changes and commitments that FHFA has already made, and is in the
     process of implementing, in response to the OIG report dated January 4, 2016.22 The new
     procedures, together with existing practices and procedures, will result in an effective risk
     assessment and examination planning process that assures that supervisory resources are
     focused on the highest risks at the Enterprises. Because the risk assessment changes were
     recently made in May 2016, there were no results to be reviewed in the OIG fieldwork for
     these reports.

     OIG Response to FHFA General Comment. Our evaluation, dated January 4, 2016, found
     significant shortcomings in DER’s risk assessment process, which FHFA committed to
     address. Internal guidance issued by DER in May 2016, when implemented, purportedly
     will correct those shortcomings. As we explained in one of the companion reports issued
     today, this audit sought to build on that evaluation work to determine whether high-
     priority planned targeted examinations were supported by risk assessments and whether
     those examinations were completed. The objective of this audit is far different than the
     objective of our prior evaluation report.



21
  By reports, FHFA is referring to this report and its two companion reports: FHFA’s Supervisory Planning Process
for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted Examinations Did Not
Trace to Risk Assessments and Most High-Priority Planned Examinations Were Not Completed (Sept. 30, 2016)
(AUD-2016-005), and FHFA’s Targeted Examinations of Fannie Mae: Less than Half of the Targeted Examination
Planned for 2012 through 2015 Were Completed and No Examinations Planned for 2015 Were Completed Before
the Report of Examination Issued (Sept. 30, 2016) (AUD-2016-006).

22
   OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear
Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at
www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).



                                 OIG  AUD-2016-007  September 30, 2016                                      27
We performed no work during our prior evaluation to tie planned targeted examinations
back to risk assessments and/or to track the disposition of such examinations. The
recommendations in the three reports from this audit flow directly from the findings of
this audit, not from earlier work.

FHFA General Comment

FHFA disagrees with the reports’ premise or implication that supervisory objectives can
be met only through targeted examinations completed within the calendar year of planning
and that changes to work plans prevented DER from communicating supervisory concerns
to the Enterprises through the ROEs and otherwise. Ongoing monitoring, supervisory
engagement during the course of targeted examination work, completion of examinations
planned in a prior year, examination work added to the plan during the year, and review of
remediation of deficiencies all inform supervisory understanding of Enterprise operations,
risks, and risk management. Advisory Bulletin 2012-03, FHFA Examination Rating
System, dated December 19, 2012 (AB 2012-03), describes FHFA’s CAMELSO ratings
system and provides that ratings take into account various factors, including findings
issued in the current and previous calendar years, progress of remediation of previous
findings, and a regulated entity’s responsiveness to findings by internal and external
parties.

OIG Response to FHFA General Comment. The premise or implication stated by FHFA
was not made in our reports. This audit tracked the disposition of targeted examinations
planned for four supervisory cycles in the review period and found that a significant
number of such examinations were completed after the ROEs for those cycles issued.
From FHFA’s response, it appears that FHFA is comfortable with the fact that a ROE was
issued to one Enterprise for the 2015 supervisory cycle based only on the completion of 3
targeted examinations planned for the 2014 supervisory cycle and completed in 2015, and
no targeted examinations planned for the 2015 supervisory cycle were completed during
that cycle.

FHFA General Comment

FHFA disagrees with the reports’ findings that DER’s documentation of supervisory
activities is lacking or of poor quality. While the documentation recording the basis for
changes to examination plans has been inconsistent at times, the report does not specify
that type of documentation but refers generally to “supervisory documentation.” We
specifically note that FHFA OIG observed in a 2014 report that DER maintained complete




                        OIG  AUD-2016-007  September 30, 2016                              28
     examination documentation for 2013 targeted examinations.23 That OIG report states,
     “We reviewed DER’s workpapers for 28 targeted examinations conducted by the Fannie
     Mae and Freddie Mac Core Teams (together, the Core Teams) in 2013. We found that in
     each of these cases DER staff complied with the Agency’s recordkeeping policies and
     procedures.” Since that report was issued, DER has put in place an enhanced quality
     control review function that will help to ensure that the official records of examination
     activities are complete and maintained appropriately.

     OIG Response to FHFA General Comment. FHFA’s reliance on our 2014 report is
     inapposite. There, we reviewed the examination workpapers for 28 completed targeted
     examinations and found that DER examiners complied with FHFA’s recordkeeping policies
     and procedures. In this audit, other than look for the presence of the request letter and
     conclusion letter, we did not review examination workpapers for completed targeted
     examinations and made no findings about the quality of those workpapers. While FHFA
     takes credit for DER’s quality control process, we note: (1) that this process was only put
     into place in July 2015, after we completed fieldwork for an evaluation which found that
     DER had reneged on its commitments to put such a process into place for the prior four
     years;24 and (2) that the quality control process only reviews documentation maintained for
     examination work products.

     This audit had an entirely different focus: whether DER examiners created and maintained
     records to document the annual supervisory cycle, from planning through execution. As this
     audit found, DER was unable to provide any documentation for the disposition of 18 targeted
     examinations for both Enterprises – 10 for Fannie Mae and 8 for Freddie Mac – during the
     four supervisory cycles in our review period, notwithstanding our multiple requests.

     Our 2014 report, on which FHFA relies in its comment, also states:

        …we also found that DER’s recordkeeping practices have limitations that impede the
        efficient retrieval of these workpapers by FHFA examiners, other FHFA personnel, and
        outside oversight entities such as the OIG.

     Almost two years later, these limitations have not been addressed by FHFA and hampered
     our work on this audit. FHFA’s inability to provide documentation to show the disposition of
     18 planned targeted examinations during the four supervisory cycles reviewed in this audit –
     roughly 10 percent of the total planned – creates a significant risk exposure.


23
  FHFA is referring to OIG report Evaluation of the Division of Enterprise Regulation’s 2013 Examination
Records: Successes and Opportunities (Oct. 6, 2014) (EVL-2015-001).
24
  OIG, Intermittent Efforts Over Almost Four Years to Develop a Quality Control Review Process Deprived
FHFA of Assurance of the Adequacy and Quality of Enterprise Examinations (Sept. 30, 2015)
(EVL-2015-007) (online at https://www.fhfaoig.gov/Content/Files/EVL-2015-007.pdf).



                                OIG  AUD-2016-007  September 30, 2016                                    29
     FHFA Comments to Recommendation 1

     FHFA disagrees with this recommendation. DER has sufficient guidance in place for
     documentation of supervisory activities. Moreover, in mid-2015, DER put in place an
     enhanced quality control function that provides an independent review of targeted
     examination work products to assess whether written communications to the Enterprises
     are supported by documentation of examination work that meets DER standards and
     applicable FHFA guidance for preparation of written products. DER believes that existing
     internal guidance and the quality control reviews now being performed are effective to
     ensure that the official records of examination activities are complete and maintained
     appropriately. To the extent that this recommendation refers to documentation of risk-
     based changes to examination plans, this issue will be addressed in the course of
     implementing the May 2016 guidance referenced above. To the extent that this
     recommendation refers to tracking of examination activity status, see response to
     recommendation 4 below.

     OIG Response to FHFA Comments to Recommendation 1. As discussed in this report as
     well as in two companion reports issued today, DER’s operating procedures direct that
     supervisory planning is documented and incorporated into official agency records.25 As
     we explained in detail, our efforts to track the planning and execution of DER’s
     supervisory activities through documentation maintained in IMS were not successful
     because a significant amount of documentation was not retained in IMS.

     FHFA’s suggestion that DER’s enhanced quality control reviews will remedy these
     problems is unfounded. In accordance with DER’s quality control review process, put in
     place in July 2015, these reviews are focused on documentation for completed targeted
     examinations. This audit found lack of documentation supporting the planning and
     execution of supervisory activities. Of the 18 targeted examinations planned during the
     four supervisory cycles in our review for which DER provide no documentation to show
     their disposition, 3 were planned for the 2015 supervisory cycle, after the 2015 quality
     control reviews were put into place. DER’s inability to produce documentation to show
     the disposition of 3 targeted examinations planned for the 2015 supervisory cycle
     demonstrates that DER’s current quality control reviews are either not working as FHFA
     expected they would or working as intended but do not address this deficiency.



25
   OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015
High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments, and Most High-Priority
Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted
Examinations of Fannie Mae: Less than Half of the Targeted Examinations Planned for 2012 through 2015
Were Completed and No Examinations Planned for 2015 Were Completed Before the Report of Examination
Issued (Sept. 30, 2016) (AUD-2016-006).



                               OIG  AUD-2016-007  September 30, 2016                                  30
As we explained in the companion reports, DER has required, since January 1, 2014, that
all changes to supervisory plans be risk-based, documented in writing, and approved. The
reports issued today demonstrate widespread non-compliance with that requirement.
Instead of addressing that deficiency, FHFA promises that documentation of risk-based
changes to supervisory plans will be addressed in the course of implementing the May
2016 guidance and in enhancements to DER’s mechanisms for tracking changes to
supervisory plans but does not explain how it intends to change examiner behavior.
Simply reiterating an existing requirement that has not been followed is unlikely to
increase compliance.

FHFA Comments to Recommendation 2

DER partially agrees with this recommendation. DER does not agree that current staffing
levels have adversely affected DER’s ability to meet its supervisory responsibilities. DER
agrees, however, that it is a sound practice to regularly assess whether staffing levels are
sufficient to carry out DER responsibilities for fulfillment of FHFA’s mission. As part of
the agency-wide budget process for each fiscal year, DER assesses its resource needs in
making its submission for preparation of FHFA’s annual budget. DER will continue to
provide this information and will seek to promptly fill open positions.

OIG Response to FHFA Comments to Recommendation 2. FHFA’s assertion that DER’s
staffing levels have not adversely affected its ability to meet its supervisory responsibilities
cannot be squared with findings from this audit: DER failed to conduct and complete more
than half of its planned targeted examinations of Fannie Mae for the past four supervisory
cycles and almost half of its planned targeted examinations of Freddie Mac and the reason
repeatedly provided by DER officials for this failure was resource constraints. FHFA’s
commitment to regularly assess staffing levels and fill open positions meets the intent of our
recommendation, provided that these assessments address the resource constraints invoked
by DER officials as the explanation for DER’s inability to complete the targeted
examinations it planned.

FHFA Comments to Recommendations 3 and 5

On May 25, 2016, FHFA issued internal guidance which FHFA believes confirms our
general agreement with these recommendations. As we previously advised OIG staff,
during the first quarter of 2017 FHFA will assess the effectiveness of the enhanced risk
assessment procedures outlined in the guidance and determine whether any revisions are
needed before the mid-year risk assessment process commences in 2017. To the extent
that recommendations 3 and 5 contemplate steps other than those to which FHFA has
previously agreed in response to the OIG’s January 4, 2016 report, we disagree with the
recommendations at this time, but will consider them as part of our 2017 assessment.



                         OIG  AUD-2016-007  September 30, 2016                               31
OIG Response to FHFA Comments to Recommendations 3 and 5. Since FHFA is
committed to implementing recommendations 3 and 5, either through the implementation
of its May 25, 2016 internal guidance or as part of its 2017 assessment, we consider
FHFA’s response to these recommendations to be an agreement. After FHFA performs its
2017 planned mid-year assessment of the implementation of the May 2016 guidance, we
plan to review the results of that assessment. To the extent that FHFA’s assessment finds
that OIG’s recommendations 3 and 5 are not fully implemented by that guidance, we
expect FHFA to take additional corrective actions.

FHFA Comments to Recommendation 4

DER agrees with this recommendation. By September 23, 2017, DER will establish
an improved mechanism for tracking the status of activities included on Enterprise
examination plans, including changes resulting from the mid-year planning update process
and at year-end. The control will reflect approved changes and note the rationale for those
changes.




                        OIG  AUD-2016-007  September 30, 2016                               32
OBJECTIVE, SCOPE, AND METHODOLOGY .................................

We conducted this audit to determine whether FHFA (1) supported its 2014 and 2015 high-
priority planned targeted examinations with risk assessments and completed those planned
high-priority examinations; (2) performed its planned targeted examinations for Fannie Mae
from 2012 through 2015 and, if it did not, whether FHFA documented the deviations from
its plan in accordance with policies and procedures; and (3) performed its planned targeted
examinations for Freddie Mac from 2012 through 2015 and, if it did not, whether FHFA
documented the deviations from its plan in accordance with policies and procedures.

This report addresses the third objective – determining whether FHFA performed its planned
targeted examinations for Freddie Mac from 2012 through 2015, and if it did not, whether
FHFA documented the deviations from its plans in accordance with policies and procedures.
We conducted this audit from December 2015 through June 2016 at FHFA’s headquarters in
Washington, D.C.

To accomplish the audit objective, we:

      Reviewed FHFA’s Examination Manual; DER’s OPB Supervisory Planning Process
       (2013-DER-OPB-03.1); DER’s OPB DER Supervisory Activities (2013-DER-OPB-
       04); and DER’s OPB Guidelines for Preparing Supervisory Products and Examination
       Workpapers (2014-DER-OPB-01);

      Reviewed FHFA’s supervisory plans for 2012 through 2015 and identified planned
       targeted examinations;

      Compared the number of planned targeted examinations for Freddie Mac – as
       described in FHFA’s supervisory planning documents – to the targeted examination
       request letters, conclusion letters, and other relevant documentation in order to
       determine the disposition of the examinations;

      Reviewed FHFA’s Information Management System in an effort to confirm and
       identify the universe of planned targeted examinations and their disposition;

      Reviewed FHFA’s reasons for not fully implementing its examination plans; and

      Interviewed FHFA DER officials regarding their implementation of the supervisory
       plans.

We held an exit conference with FHFA officials on September 12, 2016.




                            OIG  AUD-2016-007  September 30, 2016                           33
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for the findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.




                            OIG  AUD-2016-007  September 30, 2016                               34
APPENDIX A .............................................................................

FHFA’s Comments on OIG’s Findings and Recommendations




                         OIG  AUD-2016-007  September 30, 2016                     35
OIG  AUD-2016-007  September 30, 2016   36
OIG  AUD-2016-007  September 30, 2016   37
OIG  AUD-2016-007  September 30, 2016   38
OIG  AUD-2016-007  September 30, 2016   39
ADDITIONAL INFORMATION AND COPIES .................................


For additional copies of this report:

      Call: 202-730-0880

      Fax: 202-318-0239

      Visit: www.fhfaoig.gov



To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

      Call: 1-800-793-7724

      Fax: 202-318-0358

      Visit: www.fhfaoig.gov/ReportFraud

      Write:

                FHFA Office of Inspector General
                Attn: Office of Investigations – Hotline
                400 Seventh Street SW
                Washington, DC 20219




                             OIG  AUD-2016-007  September 30, 2016                       40