oversight

Evaluation of FHFA's Oversight of Fannie Mae's Management of Operational Risk

Published by the Federal Housing Finance Agency, Office of Inspector General on 2011-09-23.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          FEDERAL HOUSING FINANCE AGENCY
            OFFICE OF INSPECTOR GENERAL



              Evaluation of FHFA’s Oversight of
         Fannie Mae’s Management of Operational Risk




Evaluation Report: EVL-2011-004         Dated: September 23, 2011
                         Evaluation of FHFA’s Oversight of Fannie Mae’s Management of
                                                Operational Risk

Why FHFA-OIG Did This Evaluation                                     What FHFA-OIG Found
The Federal Housing Finance Agency (FHFA or the Agency) is           Between 2006 and early 2011, FHFA and its predecessor agency
required to oversee the prudential operations of the Federal         repeatedly found that Fannie Mae had not established an acceptable and
National Mortgage Association (Fannie Mae) and the Federal           effective operational risk management program despite outstanding
Home Loan Mortgage Corporation (Freddie Mac)                         requirements to do so. Nonetheless, FHFA has not taken decisive
(collectively the Enterprises), and – through examinations –         action to compel Fannie Mae to create and administer an operational risk
determine whether they operate in a safe and sound manner.           management program. As Fannie Mae’s regulator and conservator,
Additionally, in September 2008, FHFA placed the                     FHFA’s authority over the Enterprises is broad and includes the ability
Enterprises into conservatorships to preserve their assets and       to discipline or remove Enterprise personnel to ensure compliance with
minimize taxpayer losses.                                            Agency mandates. But to date, FHFA has not exercised this or other
                                                                     authorities. Instead, FHFA has pursued the matter principally through
FHFA views operational risk management as an important
                                                                     less forceful supervisory means, such as conducting ongoing operational
financial safety and soundness challenge facing the Enterprises.
                                                                     risk examinations and issuing Matters Requiring Attention, which
The Agency defines operational risk as the
                                                                     were ineffective during the period.
risk of loss resulting from failed people, processes, or systems,
or from external events (such as foreclosure abuses). In             Fannie Mae’s lack of an acceptable and effective operational risk
September 2008, FHFA issued guidance requiring the                   management program may have resulted in missed opportunities
Enterprises to develop and implement programs to identify,           to strengthen the oversight of law firms it contracts with to process
report, and remedy operational risks. Effective operational          foreclosures. For example, in a May 2006 internal report, Fannie Mae
risk management programs can assist FHFA’s safety and                learned that attorneys acting on its behalf in Florida and elsewhere had
soundness examiners to identify trends in such risks and focus       filed false documents in foreclosure proceedings. The report further
their examinations accordingly.                                      stated that Fannie Mae did not oversee the quality of these attorneys’
                                                                     representation or the legal positions taken in their pleadings.
FHFA has reported that Fannie Mae has not taken acceptable
                                                                     Nonetheless, in a 2011 preliminary report FHFA concluded that Fannie
steps to establish an operational risk management program.
                                                                     Mae still had not acted on the recommendations to improve its attorney
FHFA’s Office of Inspector General (FHFA-OIG) initiated
                                                                     oversight contained in the 2006 report.
this evaluation to assess FHFA’s oversight of Fannie Mae’s
efforts to establish an acceptable operational risk management       According to FHFA, Fannie Mae has recently made improvements in
program.                                                             its operational risk program, and the Agency expects that the
                                                                     Enterprise will have an acceptable program in place no later than the
What FHFA-OIG Recommends                                             first quarter of 2012. Given Fannie Mae’s history of non-compliance,
FHFA-OIG recommends that FHFA closely monitor Fannie                 FHFA-OIG believes that the Agency must exercise maximum
Mae’s implementation of its operational risk management              diligence and take forceful action to ensure that Fannie Mae meets the
program; exercise its broad conservatorship or enforcement           Agency’s expectations in this regard. Otherwise, FHFA’s safety and
authority to compel Fannie Mae to establish an operational           soundness examination program, as well as its delegated approach to
risk program, if the Enterprise fails to do so by the end of first   conservatorship management, may be adversely affected.
quarter 2012; and ensure that Fannie Mae has qualified
personnel to implement its plan.

Evaluation Report: EVL-2011-004                                                                      Dated: September 23, 2011
TABLE OF CONTENTS

TABLE OF CONTENTS ................................................................................................................ 3

ABBREVIATIONS ........................................................................................................................ 5

PREFACE ....................................................................................................................................... 6

BACKGROUND .......................................................................................................................... 10
           Overview of the Enterprises and FHFA............................................................................ 10
           FHFA’s Examination Program is the Primary Means by Which the Agency
           Monitors the Enterprises’ Financial Safety and Soundness .............................................. 11
           Definition of Operational Risk and the Key Components of an Effective
           Enterprise Risk Management Program ............................................................................. 12
           Operational Risk Management Program Requirements Offer Important Benefits
           for FHFA’s Examination Program and Its Delegated Approach to Managing the
           Conservatorships ............................................................................................................... 14
           FHFA Repeatedly Found that Fannie Mae Did Not Establish an Acceptable and
           Effective Operational Risk Management Program ........................................................... 14

FINDINGS .................................................................................................................................... 19
           1. FHFA Repeatedly Found that Fannie Mae Had Not Developed an Acceptable
           and Effective Operational Risk Management Program, but FHFA Did Not Take
           Decisive Steps to Ensure Compliance by the Enterprise .................................................. 19
           2. Foreclosure Processing Abuses in Florida and Elsewhere Illustrate the
           Potential Negative Consequences of Fannie Mae’s Failure to Establish an
           Effective Operational Risk Management Program ........................................................... 20
           3. FHFA Must Ensure that Fannie Mae Fully Implements Its Operational Risk
           Management Program ....................................................................................................... 22

CONCLUSION ............................................................................................................................. 23

RECOMMENDATIONS .............................................................................................................. 23

SCOPE AND METHODOLOGY ................................................................................................ 24

APPENDIX A ............................................................................................................................... 25

          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                                       3
          FHFA’S Comments on Findings and Recommendation .................................................. 25

APPENDIX B ............................................................................................................................... 28
          FHFA-OIG’S Response to FHFA’S Comments ............................................................... 28

ADDITIONAL INFORMATION AND COPIES ........................................................................ 30




          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                                     4
ABBREVIATIONS
CRO ..................................................................................................................... Chief Risk Officer
Fannie Mae......................................................................... Federal National Mortgage Association
FHFA ........................................................................................... Federal Housing Finance Agency
FHFA-OIG ...................................... Federal Housing Finance Agency Office of Inspector General
Freddie Mac .................................................................. Federal Home Loan Mortgage Corporation
HERA.......................................................................Housing and Economic Recovery Act of 2008
MBS ..................................................................................................... Mortgage-Backed Securities
MRA ...................................................................................................... Matter Requiring Attention
OFHEO ................................................................. Office of Federal Housing Enterprise Oversight
Treasury ........................................................................................ U.S. Department of the Treasury




          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                                     5
                                     Federal Housing Finance Agency

                                        Office of Inspector General

                                               Washington, DC




                                             PREFACE
FHFA-OIG was established by the Housing and Economic Recovery Act of 2008 (HERA),
which amended the Inspector General Act of 1978. FHFA-OIG is authorized to conduct audits,
investigations, and other studies of the programs and operations of FHFA; to recommend
policies that promote economy and efficiency in the administration of such programs and
operations; and to prevent and detect fraud and abuse in them. This evaluation is one in a series
of audits, evaluations, and special reports published as part of FHFA-OIG’s oversight
responsibilities. It is intended to assess FHFA’s oversight of Fannie Mae’s development and
implementation of an operational risk management program.

Fannie Mae and Freddie Mac are government-sponsored enterprises that support the nation’s
housing finance system. They do so by purchasing mortgages from loan sellers; in turn, the sales
proceeds may be used to originate additional mortgages.

FHFA is required to oversee the prudential operations of the Enterprises and – through
examinations – determine whether they operate in a safe and sound manner; maintain adequate
capital and internal controls; foster liquid, efficient, competitive, and resilient housing finance
markets; and operate in a manner consistent with the public interest. Additionally, in September
2008, FHFA placed the Enterprises into conservatorships to preserve and conserve their assets
and minimize taxpayer losses.

According to an FHFA official, operational risk presents a considerable financial safety and
soundness concern for the Enterprises. FHFA defines operational risk as “…exposure to loss
from inadequate or failed internal processes, people, and systems, or from external events
(including legal events).”1 For example, an operational risk would include allegations reported
in the summer of 2010 that: (1) Fannie Mae and Freddie Mac had failed to oversee adequately




1
    Enterprise Guidance on Operational Risk Management, September 2008.

          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                        6
their networks of law firms that process foreclosures on their behalf; and (2) some of those firms
filed false documents in judicial foreclosure proceedings.2

The failure to effectively manage this operational risk has come at a cost to FHFA and the
Enterprises. FHFA initiated targeted examinations of the Enterprises’ oversight of their attorney
networks, and the Enterprises have incurred legal costs associated with their alleged failure to
manage the risks associated with them.

FHFA policy requires the Enterprises to develop programs to manage operational risks by
identifying them, reporting them to their respective boards of directors and FHFA, and
mitigating them. Moreover, FHFA safety and soundness examiners may use Enterprise
operational risk reports and other materials to identify trends in operational risks and focus their
examinations accordingly. The importance that FHFA places upon Enterprise operational risk
management programs is highlighted by the fact that the Agency warned the Enterprises that
their failure to establish such programs could subject them and their officers to supervisory
enforcement actions, including civil monetary penalties and removal.

In its 2009 report to Congress, FHFA stated that Fannie Mae’s
program represented a “Critical Concern;”3 this is the most           Levels of Concern
serious regulatory classification of financial, non-financial,            (in ascending order)
operational, and compliance weaknesses. FHFA further noted               None or Minimal
that Fannie Mae was not in compliance with a 2006 Consent                       Limited
Order – issued by FHFA’s predecessor, the Office of Federal                   Significant
Housing Enterprise Oversight (OFHEO) – under which it was                       Critical
required to establish an operational risk management program
by 2009. Specifically, FHFA stated that, “[w]eaknesses continued in the overall effectiveness of
governance and oversight, risk reporting, program design, and program implementation, as
evidenced by significant, high-profile operational events during the year.”4

Given the importance of Enterprise operational risk management to FHFA’s examination
program and to its delegated approach to managing the conservatorships,5 FHFA-OIG initiated
2
  Fannie and Freddie’s Foreclosure Barons, Mother Jones, August 4, 2010. FHFA officials said that the issues
raised in the article and subsequent Agency examinations constitute operational risks.
3
 According to FHFA’s Division of Enterprise Regulation Handbook dated June 16, 2009, “Enterprises with critical
safety and soundness concerns exhibit severe financial, non-financial, operational, or compliance weaknesses.”
4
  FHFA, Report to Congress 2009, May 25, 2010. See www.fhfa.gov/webfiles/15784/FHFA-
RepToCongress52510.pdf. FHFA’s 2008 report to Congress similarly stated that Fannie Mae had significant work
to do to develop and implement a robust operational risk function.
5
  FHFA’s philosophy is to delegate day-to-day operations to the Enterprises. On November 24, 2008, FHFA
clarified its role as conservator by identifying Enterprise activities that require its approval in advance. These
include, among others, reasonably foreseeable material increases in operational risk, actions deemed likely to cause
significant reputational risk, and legal settlements with a value of $50 million or more. FHFA’s Acting Director has
        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                         7
this evaluation to assess the Agency’s oversight of Fannie Mae’s efforts to develop an acceptable
operational risk program.6 FHFA-OIG found that:

             For the five-year period from 2006 until early 2011, FHFA repeatedly found that
              Fannie Mae had missed regulator-established deadlines for it to create and implement
              an acceptable and effective operational risk management program. Despite these
              repeated findings, FHFA has not taken decisive action to compel Fannie Mae to
              implement an acceptable and effective operational risk management program.

             Fannie Mae’s lack of an acceptable and effective operational risk management
              program may have resulted in missed opportunities to correct weaknesses in the
              Enterprise’s oversight of law firms that process foreclosures on its behalf. Some of
              those law firms allegedly engaged in fraudulent practices, such as filing false
              documents in foreclosure proceedings.

             FHFA officials claimed that, due to the Agency’s oversight efforts, Fannie Mae has
              made recent improvements to its operational risk management program, and FHFA
              expects the Enterprise to have an approved program established by the end of the first
              quarter of 2012. However, given Fannie Mae’s poor track record in developing and
              implementing such a program since at least 2006, FHFA-OIG believes that the
              Agency must exercise its broad conservatorship or enforcement authority to compel
              Fannie Mae to establish an acceptable and effective operational risk program if the
              Enterprise fails to do so by the end of first quarter 2012.

FHFA-OIG believes that the recommendations in this report will result in more economical,
effective, and efficient operations. FHFA-OIG appreciates the assistance of all those who
contributed to the preparation of this report.

This evaluation was led by Investigative Counsel Joseph Capone and Senior Policy Advisor
Wesley Phillips.




stated that, beyond these specified activities, the Enterprises are generally responsible for their daily operations and
business activities despite their having been placed into conservatorships. Thus, FHFA will not use its sweeping
powers under HERA to manage every aspect of the Enterprises’ operations.
6
 This evaluation began as a survey of FHFA’s oversight of the Enterprises’ internal controls of their mortgage loan
servicers’ foreclosure prevention and loss mitigation efforts. Facts developed during the survey resulted in a more
specific evaluation of FHFA’s oversight of Fannie Mae’s management of operational risk.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                            8
This evaluation report has been distributed to Congress, the Office of Management and Budget,
and others and will be posted on FHFA-OIG’s website, www.fhfaoig.gov.




Richard Parker
Acting Deputy Inspector General for Evaluations




      Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                    9
BACKGROUND
Overview of the Enterprises and FHFA

Fannie Mae and Freddie Mac developed and support what is commonly known as the secondary
mortgage market to fulfill their charter and legislative obligations to provide liquidity to, and
support for, the national mortgage finance system. In the secondary mortgage market the
Enterprises purchase mortgages that meet their underwriting criteria from loan sellers, such as
banks and other mortgage originators. The loan sellers can then use the proceeds from these
sales to originate additional mortgages. The Enterprises may hold the mortgages they purchase
in their investment portfolios or securitize and sell them to investors as Mortgage-Backed
Securities (MBS). In exchange for a fee, the Enterprises guarantee that the MBS investors will
receive timely payment of principal and interest on their investments.

The Federal Housing Enterprises Financial Safety and Soundness Act of 1992 established risk-
based and minimum capital standards for Fannie Mae and Freddie Mac. It also established
housing goals for financing affordable housing in underserved areas. Additionally, it created
OFHEO as a new regulator of the Enterprises with the responsibility to conduct examinations of
them and to determine their capital levels.7

OFHEO required the Enterprises to develop operational risk management programs.8 As
envisioned by OFHEO, the Enterprises’ operational risk management programs would feed data
to its examiners who, in turn, would use the data to identify the level of – and trends in –
operational risk at the Enterprises. OFHEO expected that both Enterprises would develop
standardized programs to supply OFHEO with comparable information from which it could
determine, for example, the relative effectiveness of each Enterprise’s risk management and
internal controls. Further, OFHEO planned to use Enterprise-generated operational risk data “in
its continuous supervision program, to scope targeted exams, and as input for quarterly risk
assessments and the determination of overall capital adequacy.”9

On July 30, 2008, HERA abolished OFHEO10 and established FHFA11 in its place. Pursuant to
HERA, FHFA is required to oversee the prudential operations of the Enterprises and – through
7
    See Public Law No. 102-550 § 1313.
8
 “These requirements [to collect operational event data and report it to OFHEO] are consistent with the safety and
soundness responsibilities of OFHEO under the Federal Housing Enterprises Financial Safety and Soundness Act of
1992.” Letter to Richard F. Syron from Director, OFHEO, dated August 10, 2007.
9
    Id.
10
 See Public Law No. 110-343 § 1301. The completion of OFHEO’s abolishment was envisioned to take 12
months, beginning with the enactment of HERA.
11
     See id. at § 1101.
           Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                        10
examinations – to determine whether they operate in a safe and sound manner; maintain adequate
capital and internal controls; foster liquid, efficient, competitive, and resilient housing finance
markets; and operate consistent with the public interest.

On September 6, 2008, due to the Enterprises’ mounting mortgage-related losses, FHFA
determined that they were “critically undercapitalized” and, as provided for under HERA, placed
them into conservatorships. As the Enterprises’ conservator, FHFA assumed responsibility for
preserving and conserving their assets. To fulfill its responsibility, HERA provides FHFA with
all the powers of the Enterprises’ shareholders, directors, and officers.12

On September 23, 2008, OFHEO/FHFA issued its Enterprise Guidance on Operational Risk
Management (Guidance), noting that “the effective management of operational risk is required to
support Enterprise safety and soundness.”13 The Guidance is based on special examinations of
Fannie Mae and Freddie Mac initiated in 2003 and 2004, respectively. Those examinations
revealed serious deficiencies in the way that the Enterprises managed their operational risk and
categorized them as a “critical supervisory concern.” Additionally, the Guidance formally
requires the Enterprises to develop and implement operational risk programs.

FHFA’s Examination Program is the Primary Means by Which the Agency
Monitors the Enterprises’ Financial Safety and Soundness

FHFA’s safety and soundness examination program is the primary means by which the Agency
monitors the Enterprises’ financial conditions and operations. Pursuant to this program, FHFA
conducts periodic examinations of the Enterprises to assess, among other things, their credit,
market, and operational risk management programs and practices.14 FHFA can take a variety of
steps based on its examination findings to ensure that the Enterprises correct deficiencies noted
by the examiners. Among them is the designation of a risk as a Matter Requiring Attention
(MRA).

MRAs are used to identify issues of supervisory concern that warrant special attention by the
Enterprise to ensure that corrective action is appropriately planned and executed. FHFA policy
is to follow-up on MRAs to ensure that the Enterprise’s response is appropriate, timely, and
effective. Further, FHFA has regulatory authority to initiate formal enforcement actions, such as

12
     See id. at § 1145.
13
     Enterprise Guidance on Operational Risk Management (PG-08-002) at pp. 1-4.
14
   Credit risk is the risk that borrowers will default on their obligations such as mortgage loans. Market risk, which
includes interest rate risk, arises from the adverse effects of changes in interest rates or foreign exchange rates.
FHFA guidance states that market risk can also cause liquidity risk which arises when an Enterprise is unable to: (1)
liquidate assets or obtain adequate funding in order to meet obligations when they come due; or (2) easily unwind or
offset specific exposures without significantly lowering market prices because of inadequate market depth or large
market disruptions.

           Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                         11
the issuance of cease and desist orders and the imposition of civil monetary penalties, to compel
the Enterprises to correct deficiencies identified in examinations or through other means. FHFA
also has conservatorship authority to control and direct the Enterprises’ operations, including the
power to remove or replace personnel.

Definition of Operational Risk and the Key Components of an Effective
Enterprise Risk Management Program

FHFA’s definition of operational risk is broad and applies to the full range of the Enterprises’
business activities. Operational risk is defined as, “…exposure to loss resulting from inadequate
or failed internal processes, people, and systems, or from external events (including legal
events).”15

Specific examples of Enterprise operational risk include:16

              Outdated information technology systems. Related deficiencies include system
               complexity, poor system integration, inadequate data management, and multiple
               interfaces that create the need for manual workarounds and multiple data
               reconciliation efforts. Inflexible, proprietary technology often necessitates the use of
               inefficient and poorly controlled end-user computers for long periods. FHFA has
               stated that such deficiencies have impeded the Enterprises’ ability to close monthly
               financial statements, as well as convert certain mortgages into MBS.

              Inadequate internal controls. This deficiency involves the failure to manage and
               control a variety of operations and processes. For example, FHFA has stated that the
               Enterprises have not been able to consistently demonstrate robust and effective
               mortgage servicer performance management. Such oversight is essential because
               mortgage servicers perform a variety of functions on behalf of the Enterprises,
               including modifying delinquent mortgages and conducting foreclosures. Recently,
               the Enterprises have been subject to intense Congressional, public, and regulatory
               criticism for failing to oversee adequately the law firms they retained to conduct
               foreclosures, which is also an operational risk. As discussed later in this evaluation
               report, FHFA-OIG believes that Fannie Mae’s failure to establish an acceptable and
               effective operational risk management program represents a potential missed
               opportunity to identify and correct abusive foreclosure practices at an earlier point in
               time.


15
     Enterprise Guidance on Operational Risk Management (PG-008-002), September 23, 2008.
16
  The examples in this section are derived from FHFA’s Report to Congress 2010 (June 13, 2011). See
http://www.fhfa.gov/webfiles/21570/FHFA2010RepToCongress61311.pdf.

          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                       12
The Guidance issued by OFHEO/FHFA on September 30, 2008, specified OFHEO/FHFA’s
expectations for the Enterprises’ operational risk management programs and identified four key
features for such programs:

           a. Operational risk identification and assessment: Each Enterprise’s board of directors
              should review and approve a definition of operational risk, and management is
              responsible for communicating it throughout the organization. Each Enterprise
              should also develop processes and mechanisms for identifying operational risks.
              These processes and mechanisms should include an operational event reporting
              system that is closely tied to a system by which to assess promptly the causes of such
              events. The Enterprises should also collect meaningful data to support cause and
              effect analyses and routinely validate and test its processes.

           b. Measurement and modeling: Each Enterprise should develop models to provide
              management with accurate assessments of the magnitude and direction of identified
              operational risks. The models should be: (1) consistently applied throughout each
              Enterprise; (2) derived from valid data from adequate data systems; (3) tested for
              sensitivity to changes in data or assumptions; and (4) periodically validated by an
              independent party. The system should also be able to assess the potential financial
              losses associated with operational risks and events.

           c. Reporting: Each Enterprise should develop a system under which operational risks
              are reported to management and the boards of directors to inform their assessments of
              the operational risks and permit them to identify corrective actions. Separate
              regulatory guidance dating from 2007, which remains in effect, requires the
              Enterprises to report operational events to FHFA.17

           d. Risk management decision-making: Each Enterprise should select strategies by
              which to manage its operational risks including, among others, avoidance, transfer,
              mitigation, and monitoring. The selection of risk management strategies should be
              informed by the employment of one or more decision frameworks, such as cost
              benefit analysis. Further, the Enterprises should apply the decision frameworks
              consistently across their organizations.




17
     OFHEO established this policy in August 2007.

          Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                       13
Operational Risk Management Program Requirements Offer Important
Benefits for FHFA’s Examination Program and Its Delegated Approach to
Managing the Conservatorships

The requirement that the Enterprises establish effective operational risk management programs is
intended, in part, to assist safety and soundness examiners to carry out their responsibilities. For
example, an effective operational risk management program should enable FHFA examiners to
identify the highest operational risks within an Enterprise; assess its internal controls in those
areas; and evaluate its plans to mitigate identified risks. The effective management of
operational risk is integral to support Enterprise safety and soundness.

FHFA-OIG also observes that the establishment of effective Enterprise operational risk
management programs is critical given FHFA’s limited examination resources. As stated in a
previous FHFA-OIG report, FHFA faces significant examination staffing and capacity
shortfalls.18 These shortfalls, which tend to limit FHFA’s capacity to carry out its safety and
soundness regulatory responsibilities, may be mitigated by the Enterprises’ ability to self-
identify, report, and correct key operational risks.

Further, FHFA-OIG believes that the establishment of effective operational risk management
programs is important to the success of FHFA’s delegated approach to managing the Enterprises’
conservatorships. As their conservator, FHFA largely relies on the Enterprises to effectively
manage their own day-to-day operations and normal business activities.19

FHFA Repeatedly Found that Fannie Mae Did Not Establish an Acceptable
and Effective Operational Risk Management Program
FHFA repeatedly concluded from 2006 through early 2011 that Fannie Mae did not establish an
acceptable and effective operational risk management program. Despite the importance of such
a program, FHFA did not take adequate steps to compel Fannie Mae to establish an acceptable
and effective program during that period.

FHFA’s predecessor agency, OFHEO, completed a special examination of Fannie Mae in 2006.
It identified significant concerns about Fannie Mae’s risk management, financial reporting,
internal controls, and corporate governance. OFHEO found that Fannie Mae management placed
a higher priority on meeting specific earnings goals than it did on ensuring proper accounting,
risk management, internal controls, and complete and accurate financial reporting. Further,

18
  See FHFA-OIG, Federal Housing Finance Agency’s Exit Strategy and Planning Process for Enterprises’
Structural Reform (EVL-2011-001, March 31, 2011).
19
 The scope of this evaluation does not include assessing merits or results of FHFA’s delegated approach to
managing the Enterprises’ conservatorships, and FHFA-OIG makes no conclusions on such approach in this report.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                      14
OFHEO concluded that Fannie Mae avoided making the investments needed to develop systems
and policies by which to ensure compliance with applicable accounting standards.

To address Fannie Mae’s operational weaknesses and other
deficiencies noted in the special examination report, OFHEO                    Consent Order
and the Enterprise entered into a Consent Order in May 2006.             is a type of formal agreement
With respect to operational risk management, the Consent                     intended to ensure that
                                                                         appropriate corrective action
Order required that:
                                                                                     is taken
          Fannie Mae shall maintain a Chief Risk Officer
           (CRO). The CRO shall direct a risk management organization with responsibility for
           overseeing risk management for financial and operational risk throughout Fannie
           Mae. The CRO shall report directly to the Chief Financial Officer and independently
           to the Risk Policy and Capital Committee of the Board; and

          Fannie Mae shall provide to OFHEO within 180 days of the Consent Order a plan for
           the build out of the Enterprise’s operational risk oversight function over the
           succeeding three years. Fannie Mae shall move expeditiously to implement the plan.

Fannie Mae submitted to OFHEO an operational risk management program in November 2006,
but the Enterprise did not implement the plan.

On May 6, 2008, OFHEO terminated the 2006 Consent Order; however, Fannie Mae’s obligation
to establish and implement an operational risk management plan remained in place and was
unaffected by the termination. Specifically, OFHEO’s letter stated that it would continue to
assess the implementation of Fannie Mae’s operational risk management program over the
succeeding two years in accordance with the requirements set forth in the Consent Order.
OFHEO added that Fannie Mae’s operational risk management program would receive
heightened focus via the examination process. In response, Fannie Mae acknowledged its
continuing obligation to create and administer such a plan.

Nonetheless, throughout the years that followed Fannie Mae did not create an acceptable and
effective plan and neither OFHEO nor FHFA used their considerable enforcement powers (nor
did FHFA use its broad conservatorship authority) to compel Fannie Mae to do so. FHFA
documented Fannie Mae’s non-compliance, as follows:

   (a) FHFA’s September 2008 Letter to Fannie Mae Identifying Deficiencies in Its
       Operational Risk Management Program

On September 4, 2008, two days before placing Fannie Mae into conservatorship, FHFA sent
Fannie Mae a letter criticizing many aspects of its operations. FHFA stated that Fannie Mae’s

      Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                   15
infrastructure, including its information technology systems, were inadequate, and that the
Enterprise lacked the controls necessary to manage new products and their associated risks.
FHFA also noted that Fannie Mae’s operational risk management framework was not fully
established.

     (b) FHFA’s 2008 Examination of Fannie Mae – Operational Risk Management
         Findings

In its 2008 Report of Examination, FHFA rated Fannie Mae’s operational risk management
oversight as a “significant concern.” According to FHFA guidance, a “significant concern”
means that Fannie Mae’s operational risk management program exhibited “more than moderate
… weaknesses.” FHFA also found that it would take Fannie Mae a “significant” amount of
work to create an acceptable program. Finally, FHFA cited changes in Fannie Mae’s operational
risk management leadership as a factor contributing to delays in improving compliance in this
area.

     (c) FHFA’s May 2009 Review of Fannie Mae and the Opening of Three MRAs
         Pertaining to Operational Risk Management Deficiencies

In a May 2009 letter to Fannie Mae, FHFA again rated Fannie Mae’s operational risk
management program a “significant concern” and noted a number of weaknesses in it that
undermined the Enterprise’s capacity to identify and correct operational risks. FHFA further
noted that the board of directors and Enterprise senior management did not exercise effective
oversight of the program, the establishment of which was well behind the three-year schedule set
forth in the 2006 Consent Order.

On the basis of the 2009 review, FHFA opened three MRAs concerning Fannie Mae’s
operational risk management program. The first MRA required Fannie Mae to strengthen its
operational risk management governance and oversight, the second required it to develop an
operational risk management program, and the third required it to implement the program.20

FHFA also opened a fourth MRA pertaining to the frequency of operational reporting in a July
2009 letter to Fannie Mae. FHFA officials said that they closed this MRA in December 2010
because Fannie Mae was “technically” in compliance with it. Specifically, FHFA said that
Fannie Mae had increased the reporting of operational risks to its board of directors, but that the
quality of its reporting required improvement.



20
  FHFA policy states that MRAs are issues of supervisory concern that warrant special attention by the Enterprise
to ensure that corrective action is appropriately planned and executed. FHFA policy also states that the Agency will
follow-up on MRAs to ensure that the Enterprises’ responses are appropriate, timely, and effective.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                        16
     (d) FHFA’s Fourth Quarter 2009 Analysis of Fannie Mae’s Operational Risk Oversight
         Deficiencies

On December 15, 2009, FHFA issued its fourth quarter 2009 analysis of Fannie Mae’s
operational risk oversight, which resulted in the Agency increasing its level of concern from
“significant” to “critical” – the most severe rating. FHFA concluded that Fannie Mae had failed
to develop an operational risk management program within three years as required by the 2006
Consent Order. The Agency also identified a number of weaknesses in Fannie Mae’s operational
risk governance and design, and it noted that Fannie Mae’s management had been slow to
recognize these weaknesses. Consequently, FHFA determined that Fannie Mae was not in
compliance with the three MRAs pertaining to operational risk deficiencies.

     (e) FHFA’s 2009 Report of Examination of Fannie Mae Identifying Ongoing
         Operational Risk Management Deficiencies

In its 2009 Report of Examination, FHFA again rated Fannie Mae’s operational risk oversight as
a “Critical Concern.” The examiners determined that Fannie Mae still had not established an
acceptable and effective operational risk management program. Specifically, the examiners
found that the Enterprise’s efforts to improve its operational risk management were only in the
early stages of development.21

     (f) FHFA’s September 8, 2010, Non-Compliance Letter Regarding the Three 2009
         MRAs Pertaining to Operational Risk

On September 8, 2010, FHFA issued a non-compliance letter to Fannie Mae advising that the
three operational risk MRAs issued after the Agency’s May 2009 review remained open.
Further, FHFA concluded that the third MRA (Operational Risk Management Program
Implementation) “will remain open until Fannie Mae effectively demonstrates that the
operational risk management tools are influencing and affecting the behavior of Fannie Mae
managers and employees.”

     (g) FHFA’s 2010 Report of Examination of Fannie Mae Again Rating Operational Risk
         as a “Critical Concern” and Noting the Enterprise’s Non-Compliance with
         OFHEO’s 2006 Consent Order

FHFA’s 2010 Report of Examination issued on April 1, 2011, again rated Fannie Mae’s
operational risk oversight as a “Critical Concern.” The report found, among other things, that
Fannie Mae had not developed an acceptable operational risk management program as required
by the 2006 Consent Order and the three MRAs. FHFA concluded that Fannie Mae had not
21
  Fannie Mae responded to the examiners that it expected to have its operational risk management program in place
by the end of 2010, but it ultimately failed to meet this deadline.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                       17
demonstrated the ability to comply with Agency guidance on developing an operational risk
management program.

     (h) FHFA Stating that Fannie Mae Has Made Recent Improvements in Developing an
         Operational Risk Management Program, but the Program’s Full Implementation Is
         Not Expected Until the End of the First Quarter of 2012

Although a first quarter 2011 FHFA analysis continued to rate Fannie Mae’s operational risk
management program as a “Critical Concern,” 22 Agency officials stated that the Enterprise has
recently taken steps toward developing an acceptable program. These steps involve developing a
basic framework that includes executive leadership, an operational risk reporting framework, and
dedicated resources. FHFA officials also stated that Fannie Mae reports operational incidents on
a quarterly basis pursuant to established requirements.23

FHFA officials also said that the Agency has taken steps to ensure that Fannie Mae has improved
its development and implementation of an operational risk management program. In particular,
FHFA officials said that they have kept open the three MRAs pertaining to Fannie Mae’s
operational risk management program as a means to persuade Fannie Mae’s board of directors
and senior managers to develop and implement an acceptable and effective operational risk
management program. FHFA officials added that they have held meetings with Fannie Mae to
stress the importance of an acceptable and effective operational risk management program.
FHFA-OIG, however, does not believe that FHFA’s supervisory strategy of maintaining open
MRAs, which have been unresolved for years, has been demonstrated to be an effective means to
ensure Fannie Mae’s implementation of an acceptable and effective operational risk program.

FHFA officials added that they will continue to monitor closely Fannie Mae’s implementation of
its risk management program and expect it to be completed no later than the first quarter of 2012.
FHFA officials also said that, given the importance of Enterprise operational risk management
programs, the Agency and Fannie Mae will act decisively if the Enterprise fails to implement its
program on schedule.




22
  FHFA officials also said that Fannie Mae “had not developed all the fundamentals of a successful, mature
operational risk program” and, as a result, the Enterprise did not “provide senior management and the Board of
Directors with actionable information on the operational risks facing [it].” See Division of Enterprise Regulation
Memorandum to File, dated March 31, 2011.
23
  Moreover, FHFA officials said that Fannie Mae had made significant improvements with respect to mitigating
operational risks associated with information security, data management, information technology infrastructure, and
related operational incidents.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                         18
FINDINGS
FHFA-OIG finds that:

       1. FHFA Repeatedly Found that Fannie Mae Had Not Developed an
          Acceptable and Effective Operational Risk Management Program,
          but FHFA Did Not Take Decisive Steps to Ensure Compliance by the
          Enterprise

From 2006 through early 2011, FHFA – and its predecessor, OFHEO – repeatedly found that
Fannie Mae had not established an acceptable and effective operational risk management
program, despite outstanding requirements to do so as reflected in the timeline contained in
Figure 1, below.

Figure 1: Timeline Regarding FHFA’s Identification of Operational Risk Management
Deficiencies at Fannie Mae




      Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                   19
Despite these ongoing findings over a five year period, neither FHFA nor OFHEO took decisive
steps to ensure compliance. For instance, as the Enterprises’ conservator, FHFA has broad
authority to control and direct the Enterprises’ operations, including removing and replacing
personnel. As regulator, FHFA may issue cease and desist orders and levy fines to ensure
compliance with Agency mandates. To date, however, the Agency has not exercised any of
these authorities.24 Rather, FHFA relied upon less forceful supervisory measures, such as issuing
MRAs, which have not proven to be effective.

         2. Foreclosure Processing Abuses in Florida and Elsewhere Illustrate
            the Potential Negative Consequences of Fannie Mae’s Failure to
            Establish an Effective Operational Risk Management Program

Fannie Mae’s lack of an acceptable and effective operational risk management program may
have resulted in missed opportunities to identify and correct timely weaknesses in the
Enterprise’s oversight of law firms in its Retained Attorney Network. Some of these law firms
allegedly filed false documents and engaged in other foreclosure processing abuses in Florida
and elsewhere. For example, in 2005, Fannie Mae hired an outside law firm to investigate a
variety of allegations referred by one of its investors regarding purported foreclosure processing
abuses and other matters. In May 2006, the law firm issued a report of investigation in which it
found that certain law firms that represented Fannie Mae in foreclosures filed false documents in
foreclosure proceedings in Florida and elsewhere. The report referred to such practices as
“unlawful” and stated that they were unauthorized by Fannie Mae and should be stopped.

Further, the report observed that Fannie Mae did not take steps to ensure the quality of its
foreclosure attorneys’ conduct, the legal positions taken in the attorneys’ pleadings, or the
manner in which the attorneys processed foreclosures on the Enterprise’s behalf.

The report noted that Fannie Mae was developing a computer
system to improve communication within its attorney network                          Operational Risk
and more effectively monitor the conduct of its counsel.25                             is exposure to loss
                                                                                   resulting from inadequate
But the report also noted that the development and                                or failed internal processes,
implementation of the computer system was not expected                                people, and systems,
to be completed in the near-term.                                                   or from external events
                                                                                    (including legal events)



24
  FHFA officials advised FHFA-OIG that FHFA is not inclined to issue cease and desist orders and levy fines when
the Enterprises are in conservatorship.
25
  Fannie Mae officials told FHFA-OIG that they had initiated other corrective actions in response to the internal
report’s conclusions, including initiating teleconferences with law firm officials on appropriate foreclosure
processing steps and conducting relevant training at mortgage industry trade shows.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                         20
In late 2010, FHFA initiated a special review of Fannie Mae’s oversight of its attorney network;
and in early 2011 preliminarily concluded that the Enterprise’s controls over the network were
inadequate. FHFA specifically noted that Fannie Mae was alerted in May 2006 by the internal
report that some of its foreclosure attorneys were sacrificing accuracy for speed, i.e., filing false
documents in foreclosure proceedings. FHFA also stated that it had found no evidence that
Fannie Mae’s receipt of this information caused the Enterprise to make any improvements in its
oversight of its law firms. Further, FHFA found that Fannie Mae never developed and
implemented the computer system that was identified in the 2006 internal report as a potential
means to improve its oversight of the law firms. Consequently, this evidence from FHFA’s
review suggests that Fannie Mae did not take sufficient steps in response to the 2006 report to
mitigate the operational risks associated with its foreclosure processing attorney network.

FHFA-OIG cannot establish whether Fannie Mac complied with another key requirement of an
operational risk management program: notifying its regulator of the 2006 report or submitting it
to the regulator. Fannie Mae officials claim that they informed an OFHEO senior official of the
report during a telephone conversation in 2006, but they have no record of the communication.
The OFHEO official, who now works for FHFA, has no records or recollection of the
conversation. In any event, neither Fannie Mae nor its regulator acted on the 2006 report, and
FHFA examination officials informed FHFA-OIG that they did not learn of the 2006 report until
after it was disclosed in a March 2011 newspaper article.

In summary, FHFA-OIG views the circumstances surrounding Fannie Mae’s 2006 report on
foreclosure processing abuses as a missed opportunity to address an important operational risk at
an early stage. Per FHFA’s guidance, one of the essential elements of an operational risk
program is the Enterprise’s development of strategies to correct identified operational risks.
FHFA’s preliminary 2011 examination findings indicate that, after learning of its attorneys’
misconduct in 2006, Fannie Mae did not develop and implement a strategy to improve its
oversight of this portion of its operation. FHFA further concluded that Fannie Mae did not
deploy the computer system that was intended to enhance its attorney oversight. Moreover, if
OFHEO or FHFA had received Fannie Mae’s 2006 report, as would be consistent with
operational risk guidance, then the regulators might have been in a position to assess the risks
involved, determine whether Freddie Mac’s attorneys engaged in similar practices (as turned out
to be the case), and ensured that the Enterprises took actions to better oversee their attorneys and
possibly prevent foreclosure processing abuses.




       Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                    21
        3. FHFA Must Ensure that Fannie Mae Fully Implements Its
           Operational Risk Management Program

A first quarter 2011 FHFA review of Fannie Mae’s operational risk management program
continued to classify it as a “critical concern.” However, FHFA officials told FHFA-OIG that
Fannie Mae has taken positive steps in 2011 to implement an acceptable program. The FHFA
officials said that Fannie Mae has new senior officers responsible for operational risk
management and that they have developed a new management program. FHFA officials also
said that FHFA has closely monitored Fannie Mae’s progress and that under Fannie Mae’s
schedule its program should be in place no later than the end of the first quarter of 2012.

Further, FHFA officials also said that, given the importance of Enterprise operational risk
management programs, the Agency will act in a decisive fashion if Fannie Mae fails to
implement its program on schedule.26 FHFA-OIG believes that, as Fannie Mae’s conservator
and regulator, FHFA must closely monitor Fannie Mae’s progress and take decisive action if
necessary. Given Fannie Mae’s five-year history of noncompliance, there is good reason to
question whether Fannie Mae will meet its first quarter 2012 deadline. If it fails to do so, FHFA
should penalize Fannie Mae and its officers for their nonfeasance.




26
  FHFA’s General Counsel said that if Fannie Mae does not implement its program, the Agency could employ its
conservatorship authorities under HERA to control and direct Fannie Mae’s operations, as opposed to its formal
regulatory enforcement authorities, such as civil money penalties. The General Counsel noted that as Fannie Mae’s
conservator FHFA could remove and replace culpable risk officials, or more likely direct Fannie Mae’s board of
directors to do so.

        Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                       22
CONCLUSION
FHFA and its predecessor have tolerated five years of delay by Fannie Mae, which has been
under directives to establish and implement an acceptable and effective operational risk
management program. FHFA possesses the authority through a variety of mechanisms to
enforce its directives. However, to date, FHFA has not taken decisive action to compel the
Enterprise’s compliance. Fannie Mae’s lack of such a program creates potentially significant
risks for Fannie Mae and FHFA.




RECOMMENDATIONS
FHFA-OIG recommends that FHFA:

          Closely monitor Fannie Mae’s implementation of its operational risk management
           program;

          Take decisive and timely actions to ensure the implementation of the program if
           Fannie Mae fails to establish an acceptable and effective operational risk program by
           the end of the first quarter 2012; and

          Ensure that Fannie Mae has qualified personnel in place to ensure continuing
           compliance with its operational risk management program.




      Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                   23
SCOPE AND METHODOLOGY
The objective of this evaluation was to assess FHFA’s oversight of Fannie Mae’s efforts to
develop an acceptable operational risk management program.

To address these objectives, FHFA-OIG staff reviewed FHFA and OFHEO Guidance pertaining
to the development of operational risk management programs as well as a May 2006 Consent
Order between Fannie Mae and OFHEO. Further, FHFA-OIG reviewed FHFA examination
reports and other related documentation for the period covered in the evaluation.

Additionally, FHFA-OIG staff interviewed senior officials within FHFA responsible for
monitoring and examining Fannie Mae’s operational risk program. FHFA-OIG officials also
spoke with senior Fannie Mae officials regarding a 2006 report prepared for the Enterprise on its
oversight of attorneys who conduct foreclosures on its behalf and foreclosure processing
practices in Florida and elsewhere. FHFA-OIG staff analyzed the extent to which Fannie Mae’s
failure to establish an operational risk management program was illustrated by the circumstances
surrounding the Enterprise’s 2006 internal report.

This evaluation was conducted under the authority of the Inspector General Act and in
accordance with the Quality Standards for Inspection and Evaluation (January 2011), which was
promulgated by the Council of Inspectors General on Integrity and Efficiency. These standards
require FHFA-OIG to plan and perform an evaluation that obtains evidence sufficient to provide
reasonable bases to support the findings and recommendations made herein. FHFA-OIG trusts
that the findings and recommendations discussed in this report meet these standards.

The performance period for this evaluation was from February 2011 to September 2011.

FHFA-OIG provided FHFA staff with briefings and presentations concerning the results of its
fieldwork and provided FHFA an opportunity to respond to a draft report of this evaluation.
FHFA’s comments on FHFA-OIG’s draft report are reprinted in their entirety at Appendix A.

FHFA-OIG appreciates the efforts of FHFA and Fannie Mae management and staff in providing
information and access to necessary documents to accomplish this evaluation.




       Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                    24
APPENDIX A
FHFA’S Comments on Findings and Recommendation




     Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                  25
Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                             26
Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                             27
APPENDIX B
FHFA-OIG’S Response to FHFA’S Comments

FHFA-OIG is pleased that FHFA generally agrees with the report’s recommendations to:

          Closely monitor Fannie Mae’s implementation of its operational risk management
           program;

          Take decisive and timely actions to ensure the implementation of the program if
           Fannie Mae fails to establish an acceptable and effective operational risk management
           program by the end of the first quarter of 2012; and

          Ensure that Fannie Mae has qualified personnel in place to ensure continuing
           compliance with its operational risk management program.

But FHFA states that the draft report’s characterization of the Agency’s oversight efforts and
Fannie Mae’s operational risk management program do not fully reflect all the facts and the
context.

   1. FHFA disputes FHFA-OIG’s finding that FHFA did not take decisive steps to ensure that
      Fannie Mae established an acceptable and effective operational risk management
      program. Further, FHFA states that it has extensive conservatorship authorities and that
      it does not believe that cease and desist orders or fines, as suggested in the report, would
      produce better results.

       FHFA-OIG revised the draft report to reflect some of FHFA’s concerns, but stands
       behind its assertions that the Agency did not take decisive action to compel Fannie Mae
       to establish an acceptable and effective operations risk program. By May 2009, Fannie
       Mae was in substantial non-compliance with the May 2006 OFHEO Consent Order under
       which it was required to establish an operational risk management program within three
       years. Rather than use its extensive conservatorship or regulatory powers at that point
       (for example, FHFA could have directed Fannie Mae to discipline or remove employees
       for non-compliance), FHFA chose a less forceful supervisory approach, which included
       opening MRAs and using them as a means to “compel” Fannie Mae to develop an
       acceptable and effective program. Nevertheless, more than two years later, Fannie Mae
       has yet to comply. Further, it remains to be seen whether Fannie Mae will meet FHFA’s
       expectations of having an acceptable and effective operational risk management program
       in place by the end of the first quarter of 2012 – six years after FHFA’s predecessor
       commenced efforts to gain Fannie Mae’s compliance.

       Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                    28
2. FHFA disagrees with FHFA-OIG’s finding that foreclosure abuses in Florida and
   elsewhere illustrate the potential negative consequences of Fannie Mae’s failure to
   establish an acceptable and effective operational risk management program.

   FHFA-OIG revised the draft report text to state that Fannie Mae’s lack of an acceptable
   and effective operational risk management program may have resulted in missed
   opportunities to correct the Enterprise’s weak oversight of its Retained Attorney
   Network. In this regard, FHFA-OIG reiterates that FHFA’s special review of Fannie
   Mae’s oversight of the attorney network concluded that Fannie Mae did not act on
   information contained in its 2006 internal report, which found that law firms in Florida
   and elsewhere were sacrificing accuracy for speed (i.e., filing false documents in
   foreclosure proceedings) and that its oversight of the firms’ litigation practices were
   weak. FHFA-OIG contends that strengthened law firm oversight by Fannie Mae could
   have detected – if not prevented – these abuses by attorneys.

3. FHFA disputes FHFA-OIG’s finding that it must ensure that Fannie Mae implement an
   operational risk management program. FHFA states the draft report could lead readers to
   conclude that Fannie Mae did not have an operational risk program in place for years
   when, in fact, executive leadership, extensive reporting, and dedicated resources were in
   place.

   FHFA-OIG added the phrase “acceptable and effective” before “operational risk
   program” throughout the report, as appropriate.




   Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                29
ADDITIONAL INFORMATION AND COPIES


For additional copies of this report:

          Call the Office of Inspector General (OIG) at: 202-408-2544

          Fax your request to: 202-445-2075

          Visit the OIG website at: www.fhfaoig.gov



To report alleged fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

          Call our Hotline at: 1-800-793-7724

          Fax us the complaint directly to: 202-445-2075

          E-mail us at: oighotline@fhfa.gov

          Write to us at:    FHFA Office of Inspector General
                              Attn: Office of Investigation – Hotline
                              1625 Eye Street, NW
                              Washington, DC 20006-4001




       Federal Housing Finance Agency Office of Inspector General • EVL-2011-004 • September 23, 2011
                                                    30