oversight

Status of the Development of the Common Securitization Platform

Published by the Federal Housing Finance Agency, Office of Inspector General on 2014-05-21.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          Federal Housing Finance Agency
              Office of Inspector General




Status of the Development of the
Common Securitization Platform




Evaluation Report  EVL–2014–008  May 21, 2014
               Status of the Development of the Common
               Securitization Platform

               Why OIG Did This Report
               The Federal National Mortgage Association (Fannie Mae) and the Federal
               Home Loan Mortgage Corporation (Freddie Mac) (collectively, the
               Enterprises) support housing finance primarily by purchasing qualifying
 At A          mortgages from lenders, packaging them into mortgage-backed securities
Glance         (MBS), and selling the securities to investors. The process of packaging
               mortgages into MBS is commonly referred to as securitization.
  ———
               In 2012, the Federal Housing Finance Agency (FHFA or Agency) concluded
May 21, 2014   that the back office systems by which the Enterprises securitize mortgages
               were outmoded and in need of being immediately upgraded and maintained.
               Subsequently, FHFA, as conservator, directed the Enterprises to build the
               Common Securitization Platform (CSP or Platform) to replace some parts of
               the Enterprises’ back office systems.

               FHFA assumed, but did not verify, that developing the CSP would be more
               cost-effective than each Enterprise separately pursuing expensive upgrades to
               their back office systems. In addition, FHFA envisioned the CSP as a potential
               market utility and a way to maintain liquidity in the mortgage market that
               could outlive the Enterprises’ current structures. In this respect, the Agency
               viewed the CSP as a means to support congressional and executive branch
               efforts to reform the nation’s housing finance system.

               As of December 31, 2013, the Enterprises had spent approximately $65 million
               on the CSP’s development.

               We initiated this evaluation given the CSP’s importance to the future
               operations of the housing finance system. The report provides a primer on the
               CSP, updates the project’s status, and identifies certain challenges to its
               development and implementation. It also contains recommendations to FHFA
               – specifically, that it develop timelines for the project’s completion as well as
               estimates of its total cost.

               What OIG Found
               FHFA and the Enterprises Have Made Some Progress in Developing the CSP
               Under FHFA’s oversight, the Enterprises have made some progress in
               developing the CSP. An FHFA official told us that, as of March 2014, roughly
               half of the necessary software development had been completed. According to
               FHFA, a consultant hired by the Enterprises found the CSP is well-designed.
               However, other critical technology-related functions, such as disaster recovery,
               have only recently been initiated.

               FHFA has also established an independent corporate entity, Common
               Securitization Solutions, LLC (CSS), that will develop, build, own, and
               operate the CSP. However, CSS, which is jointly owned by the Enterprises,
               does not yet have a chair for its Board of Managers or a chief executive officer.
               FHFA recently appointed two senior executives for CSS.
 At A
               CSP’s Development and Implementation Face Considerable Challenges
Glance         While some progress has been made in developing the CSP, the project faces
  ———          considerable challenges that could undermine its prospects for success,
               including:
May 21, 2014
                     The difficulties inherent in developing a large-scale information
                      technology (IT) system. These difficulties are compounded by several
                      factors including: the number of parties involved in the development of
                      the CSP – FHFA, Fannie Mae, Freddie Mac, and CSS; the Enterprises’
                      records of overseeing unsuccessful large-scale IT projects that neither
                      satisfied requirements, achieved stated goals in a timely manner, nor
                      stayed on budget; and the fact that FHFA is a small regulator with
                      multiple responsibilities and no prior experience overseeing the
                      development and implementation of a large-scale IT project.

                     The risks involved with preparing the Enterprises to integrate with the
                      CSP. The Enterprises must modify their internal financial and
                      information systems to enable the Enterprises to communicate with the
                      CSP. FHFA and Enterprise officials described the technical challenges
                      associated with integration as significant and potentially costly. In
                      2013, FHFA required the Enterprises to submit integration plans. To
                      date, however, FHFA has not approved either Enterprise’s plan.

               Finding: FHFA Has Not Yet Fully Employed Essential Project Management
               Tools in the Development of the CSP
               To date FHFA has not fully employed two basic project management tools in
               its effort to develop the CSP: a comprehensive timeline and total cost estimate
               for the project. Both the Office of Management and Budget (OMB) and the
               Government Accountability Office (GAO) have stated that timelines and cost
               estimates are essential to the successful development and implementation of
               large IT projects.

               FHFA, Fannie Mae, Freddie Mac, and CSS have all proposed interim
               schedules and budgets. However, an FHFA official told us that a number of
               significant challenges have prevented them from developing a comprehensive
               and final timeline and cost estimate for the CSP. In particular, they cited as
               obstacles the complexities and uncertainties surrounding the Enterprises’
               integration plans, especially the modification of the Enterprises’ internal
               systems to communicate with the CSP.

               We recognize the challenges that FHFA faces; but we also note that it is now
               better-positioned to develop timelines and cost estimates for the CSP than it
 At A          was at the outset. Specifically, the Agency can predicate timelines and cost
Glance         estimates on the work that has already been completed, such as the software
               that has been developed. Further, if FHFA approves the Enterprises’ revised
  ———          integration plans, then developing timeframes and cost estimates for that
               critical aspect of the project would be within reach. On the other hand, moving
May 21, 2014   forward without employing these critical project management tools would, in
               our estimate, increase the risks inherent in the development and
               implementation of the CSP. Moreover, Congress and outside parties would
               lack assurance that the CSP should be developed.

               What OIG Recommends
               To strengthen its management of the CSP, we recommend that FHFA:

                  1. Establish schedules and timeframes for the completion of key
                     components of the project, as well as an overall completion date; and

                  2. Establish cost estimates for varying stages of the initiative, as well as
                     an overall cost estimate.

               FHFA agreed with these recommendations.
TABLE OF CONTENTS ................................................................

AT A GLANCE ...............................................................................................................................2

ABBREVIATIONS .........................................................................................................................7

PREFACE ........................................................................................................................................8

CONTEXT .....................................................................................................................................10
      How the Mortgage Securitization Process Works ..................................................................10
      The Enterprises’ Back Office Securitization Processes Are the Focus of the CSP ................11
      In FHFA’s View, the Enterprises’ Back Office Securitization Systems Are Flawed ............13
              Fannie Mae .....................................................................................................................13
              Freddie Mac ....................................................................................................................14
      Fannie Mae Sought to Replace its Back Office Systems in 2010 and 2011...........................14
      FHFA Directed the Enterprises to Build the CSP ..................................................................16
             FHFA Did Not Conduct a Cost Analysis When It Initiated the CSP Project in
             2012.................................................................................................................................17
      The CSP Will Not Fully Replace the Enterprises’ Back Office Securitization
      Systems ...................................................................................................................................17
      The Enterprises Must Modify their Existing Financial and Information Systems to
      Integrate with the CSP ............................................................................................................18
      Current Status of the CSP Building Process ...........................................................................20
              CSP Software Development ...........................................................................................21
              CSP Non-Functional Components ..................................................................................21
              CSP Management ...........................................................................................................21
      Challenges to the Development and Implementation of the CSP...........................................22
              The Technological Challenge of Large-Scale IT Development .....................................22
              Integration Is Complicated, Costly, and Potentially Risky.............................................23
              It Is Uncertain that Private-Market Participants Will Use the CSP ................................24

FINDING .......................................................................................................................................26




                                             OIG  EVL–2014–008  May 21, 2014                                                                    5
      1. FHFA has not yet fully employed essential project management tools in the
      development of the CSP .........................................................................................................26
             FHFA and the Enterprises Have Not Established a Schedule for Completing the
             CSP .................................................................................................................................26
             FHFA and the Enterprises Have Not Established a Total Cost Estimate for the
             CSP .................................................................................................................................27

CONCLUSIONS............................................................................................................................30

RECOMMENDATIONS ...............................................................................................................30

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................31

APPENDIX A ................................................................................................................................33
      FHFA’s Comments on FHFA-OIG’s Findings and Recommendation ..................................33

ADDITIONAL INFORMATION AND COPIES .........................................................................35




                                             OIG  EVL–2014–008  May 21, 2014                                                                    6
ABBREVIATIONS .......................................................................

CEO                Chief Executive Officer

CSP or Platform    Common Securitization Platform

CSS                Common Securitization Solutions, LLC

DER                Division of Enterprise Regulation

Enterprises        Fannie Mae and Freddie Mac, collectively

Fannie Mae         Federal National Mortgage Association

FHFA or Agency     Federal Housing Finance Agency

Freddie Mac        Federal Home Loan Mortgage Corporation

GAO                Government Accountability Office

HERA               Housing and Economic Recovery Act of 2008

IT                 Information Technology

MBS                Mortgage-Backed Securities

OIG                Federal Housing Finance Agency Office of Inspector General

OMB                Office of Management and Budget

PLMBS              Private-Label Mortgage-Backed Securities

SEC                Securities and Exchange Commission




                          OIG  EVL–2014–008  May 21, 2014                         7
PREFACE ...................................................................................

The Enterprises support the secondary mortgage market by purchasing mortgages that meet
their underwriting standards from lenders such as banks and thrifts. Typically, the Enterprises
package the mortgages into MBS which investors may purchase. The process of converting
mortgages into MBS is referred to as securitization.

Although the Enterprises have successfully issued MBS for many years, FHFA has publicly
raised concerns about some of the critical back office systems upon which the Enterprises rely
to securitize mortgages. In the past two years, FHFA has described the Enterprises’ systems
as “outmoded,” “in immediate need of being upgraded and maintained,” and “not effective at
adapting to market changes.”

In 2012, FHFA, acting under its conservatorship authority, directed the Enterprises to develop
a shared securitization platform: the CSP. FHFA believed that developing the CSP would be
both more efficient and less costly than each Enterprise separately pursuing upgrades to their
proprietary back office systems. Further, FHFA envisioned the CSP as a way to maintain
liquidity in the mortgage market that would outlive the Enterprises’ current structures. In this
respect, the Agency viewed the CSP as a means to support congressional and executive
branch efforts to reform the nation’s housing finance system.1

We conducted this evaluation because of the CSP’s importance to the Enterprises’ operations
and its potential impact on the housing finance system. This report provides a primer on the
CSP, updates the project’s status, and identifies certain challenges to its development and
implementation. It also sets forth our finding: FHFA has not fully implemented essential
project management tools – timelines and cost estimates for the development of the CSP –
and recommends that the Agency do so in order to enhance its potential for success.


1
  Federal legislators introduced two major reform bills in 2013: Protecting American Taxpayers and
Homeowners Act of 2013 (PATH Act), H.R. 2767, 113th Cong. (2013); and Housing Reform and Taxpayer
Protection Act of 2013, S. 1217, 113th Cong. (2013). Both bills anticipate the successful development of the
CSP. The PATH Act also incorporates the CSP as part of a national mortgage market utility. On March 16,
2014, the Senate Committee on Banking, Housing, and Urban Affairs (Senate Banking Committee) released
the legislative text of a bipartisan housing finance reform agreement that includes a securitization platform.
See Johnson-Crapo Discussion Draft of March 16, 2014 (online at:
http://banking.senate.gov/public/index.cfm?FuseAction=Files.View&FileStore_id=512757b1-e595-4b85-
8321-30d91e368849). On March 27, 2014, Congresswoman Maxine Waters, Ranking Member of the House
Financial Services Committee, released a legislative proposal to reform the housing finance market that
includes the CSP. See Housing Opportunities Move the Economy Forward Act of 2014 Discussion Draft of
March 27, 2014 (online at:
http://democrats.financialservices.house.gov/FinancialSvcsDemMedia/file/003%20Maxine%20Waters%20Leg
islation/GSE%20Bill/WATERS_046_xml.pdf).




                                    OIG  EVL–2014–008  May 21, 2014                                            8
This report was prepared by David P. Bloch, Director, Division of Mortgage, Investments,
and Risk Analysis; Charlie Divine, Investigative Counsel; Alexa Strear, Investigative
Counsel; Beth Preiss, Program Analyst; and Ezra Bronstein, Investigative Counsel.

We appreciate the assistance of FHFA and the Enterprises in completing this report. It has
been distributed to Congress, the Office of Management and Budget, and others and will be
posted on OIG’s website, www.fhfaoig.gov.




Richard Parker
Deputy Inspector General for Evaluations




                              OIG  EVL–2014–008  May 21, 2014                              9
CONTEXT ..................................................................................

How the Mortgage Securitization Process Works

Lenders, such as banks and thrifts, must ensure that single-family mortgages they plan to sell
to the Enterprises meet their standards. For example, the underwriting associated with such
mortgage loans must meet the Enterprises’ guidelines on matters such as a borrower’s credit
score and debt-to-income ratio. Moreover, the maximum principal balance of a mortgage
offered for sale to an Enterprise may not exceed the Enterprises’ conforming loan limit,
which, in most locations, is now $417,000.2

A lender that has originated mortgages consistent with
these standards may sell them to an Enterprise in two         In a swap, the lender exchanges
ways. First, as depicted in Figure 1, the lender can          mortgages for Enterprise MBS
swap the loans for Enterprise MBS, which the lender           backed by those same mortgages.
can then sell to investors. Second, as depicted in
Figure 2, the lender can sell the mortgages to an Enterprise for cash and the Enterprise can
securitize the mortgages and sell MBS to investors. In both cases, the mortgages end up as
part of an Enterprise MBS, and lenders obtain cash they can use to make further loans,
thereby creating liquidity for the housing finance market.3

                         FIGURE 1. LENDER SWAPS MORTGAGES FOR ENTERPRISE MBS

                                   Mortgages                             Mortgages

              Homeowners                               Lenders

                                        Cash                                  MBS
                                                 MBS
                                                                  Cash



                                                      Investors




2
 For more information, see OIG, FHFA’s Oversight of Fannie Mae’s Single-Family Underwriting Standards,
at 2 (Mar. 22, 2012) (AUD-2012-003) (online at: www.fhfaoig.gov/Content/Files/AUD-2012-003_0.pdf).
3
    Alternatively, each Enterprise may also purchase loans and hold them in its retained mortgage portfolio.




                                       OIG  EVL–2014–008  May 21, 2014                                       10
                   FIGURE 2. LENDER SELLS MORTGAGES TO AN ENTERPRISE FOR CASH

                    Mortgages                      Mortgages                        MBS
     Home-                          Lenders
     owners                                                                                      Investors

                       Cash                           Cash                          Cash


In exchange for a fee, the Enterprises guarantee that investors will continue to receive the
timely payment of principal and interest on their MBS regardless of the credit performance of
the underlying mortgages.4

The Enterprises are the largest issuers                  FIGURE 3. ENTERPRISE SINGLE-FAMILY MBS
of MBS. As shown in Figure 3, the                            ISSUANCES, 2008-2013 ($BILLIONS)
Enterprises’ MBS issuances fluctuated
from 2008 through 2013, ranging                 $1,400
from a low of slightly more than                $1,200
$850 billion in 2011 to more than               $1,000
$1.2 trillion in both 2009 and 2012.              $800

Fannie Mae issues substantially more              $600
                                                  $400
MBS than Freddie Mac. For example,
                                                  $200
in 2013, Fannie Mae’s MBS issuances
                                                    $0
of approximately $733 billion
                                                             2008   2009     2010     2011     2012    2013
accounted for more than 60% of the
Enterprises’ total issuances of more                                Freddie Mac     Fannie Mae

than $1.16 trillion during the year.             Source: Fannie Mae and Freddie Mac.

The Enterprises’ Back Office Securitization Processes Are the Focus of the CSP

Each Enterprise has its own set of proprietary internal
systems that perform the critical back office functions              Back office functions are those
to produce, issue, and service MBS. The five                         related to the inner working of
functions discussed below are currently performed                    a business or institution.
by the Enterprises’ back office systems and largely
the focus of the CSP:5



4
 For more information about the Enterprises’ guarantees and the fees associated with them, see OIG, FHFA’s
Initiative to Reduce the Enterprises’ Dominant Position in the Housing Finance System by Raising Gradually
Their Guarantee Fees (July 16, 2013) (EVL-2013-005) (online at: www.fhfaoig.gov/Content/Files/EVL-2013-
005_4.pdf).




                                   OIG  EVL–2014–008  May 21, 2014                                          11
        Data Acceptance – Data acceptance is the process by which the Enterprises validate 6
         loan level data associated with mortgages they pool and plan to securitize. For
         example, the Enterprises confirm that zip codes of the mortgaged properties are
         expressed in the correct format, i.e., in nine numbers. The Enterprises also confirm
         that the underlying mortgages conform to certain of the Enterprises’ MBS rules.7 For
         example, with a 30-year fixed-rate security, the Enterprise will verify that all of the
         loans in the underlying pool contain the appropriate characteristics.
        Issuance Support – Issuance is the process of offering MBS to investors. To initiate
         this process, the Enterprises transmit to the Federal Reserve Bank of New York basic
         facts about the security, the prospectus, and their initial disclosures. The Enterprises
         publish initial disclosure information simultaneous to the security issuance.
        Disclosures – Disclosure is the process by
         which the Enterprises publish statements                    Servicers are intermediaries
         for their MBS investors that describe the                   between mortgage borrowers and
         securities issued and the characteristics of                mortgage owners. Servicers collect
                                                                     monthly payments from borrowers,
         the underlying mortgage pools. The
                                                                     remit payments to owners, maintain
         Enterprises publish disclosures using                       records, and handle delinquencies.
         monthly data provided by servicers.
        Master Servicing Operations – The Enterprises serve as master servicers for the MBS
         they issue. Master servicing functions include the collection and reconciliation of loan
         data reported by the servicers. For example, the Enterprises compare their own
         calculations of expected monthly principal and interest payments with the amounts
         reported to them by servicers each month.
        Bond Administration – Bond administration is the process by which the Enterprises
         ensure that payments associated with their MBS are calculated and distributed
         appropriately. Bond administration includes calculating the monthly principal and
         interest payments for MBS. As part of this function, the Enterprises generate MBS
         performance metrics that are included in their monthly MBS disclosures.

5
 The CSP’s five functions are a subset of the back office systems the Enterprises use to produce, issue, and
service MBS. For further discussion of the five back office functions that are the focus of the CSP see FHFA,
Building a New Infrastructure for the Secondary Mortgage Market (White Paper) (Oct. 4, 2012) (online at:
www.fhfa.gov/PolicyProgramsResearch/Research/PaperDocuments/FHFA_Securitization_White_Paper_N508
L.pdf); FHFA, A Progress Report on the Common Securitization Infrastructure (Progress Report) (Apr. 30,
2013) (online at: www.fhfa.gov/Media/PublicAffairs/Documents/WhitePaperProgressReport43013.pdf).
6
 In validating data submitted, the Enterprises do not attempt to confirm that all data are accurate. Instead, the
Enterprises confirm that data were entered in the appropriate format.
7
 The Enterprises’ MBS rules set the standards for the pooling and delivery of mortgages to the Enterprises.
These rules are based on the Securities Industry and Finance Markets Association guidelines for the To-Be-
Announced market.




                                     OIG  EVL–2014–008  May 21, 2014                                              12
In FHFA’s View, the Enterprises’ Back Office Securitization Systems Are Flawed

The Enterprises rely on their back offices to issue a high volume of MBS. Over the last two
years, however, FHFA has described the Enterprises’ systems as “outmoded,” 8 “in immediate
need of being upgraded and maintained,” 9 and “[in]effective at adapting to market changes,
issuing securities that attract private capital, aggregating data, or lowering barriers to market
entry.” 10 Moreover, FHFA has stated that the Enterprises’ systems are insufficient to serve as
a market utility11 – a cornerstone of FHFA’s Strategic Plan – without substantial investment
of both human capital and information technology resources.

     Fannie Mae

FHFA and Fannie Mae agree that Fannie Mae’s
infrastructure is of particular concern. Fannie Mae                         Modular refers to a feature of an
executives have characterized the Enterprise’s systems                      IT system’s design that allows
as aging and costly. The Enterprise’s systems are also                      one or more components to be
inflexible and difficult to fix because they are not                        modified or replaced without
modular. The lack of modularity and interdependence                         affecting the other components.
of Fannie Mae’s systems means that Fannie Mae cannot
modify one system without affecting others.

The relative inflexibility of Fannie Mae’s current systems makes it challenging for Fannie
Mae’s systems to accommodate some FHFA policy initiatives. Specifically, Fannie Mae may
8
 FHFA, Annual Report to Congress – 2012, at 13 (June 13, 2013) (online at:
www.fhfa.gov/AboutUs/Reports/ReportDocuments/2012_AnnualReportToCongress_508.pdf).
9
 FHFA, Responses to Written Questions of Senator Crapo from Edward J. DeMarco, at 47 (May 17, 2013)
(online at: www.gpo.gov/fdsys/pkg/CHRG-113shrg80775/pdf/CHRG-113shrg80775.pdf).
10
  FHFA, Statement of Edward J. DeMarco, Acting Director Federal Housing Finance Agency, Before the U.S.
Senate Committee on Banking, Housing and Urban Affairs (Apr. 18, 2013) (online at:
www.fhfa.gov/Media/PublicAffairs/Pages/Statement-of-Edward-J-DeMarco-Acting-Director-FHFA-Before-
the-US-Senate-Committee-on-Banking-Housing-and-Urban-Affa359.aspx).
11
   FHFA has described the CSP as a potential “market utility” or “public utility.” FHFA explained the CSP’s
role as a utility in its Strategic Plan: “[f]or the [CSP] to have long-term value, it should have an open
architecture that will permit multiple future issuers of mortgage-backed securities to access [it] and it should be
flexible enough to permit a wide array of securities and mortgage structures.” FHFA, A Strategic Plan for
Enterprise Conservatorships: The Next Chapter in a Story that Needs an Ending (Strategic Plan), at 13 (Feb.
21, 2012) (online at:
www.fhfa.gov/AboutUs/Reports/ReportDocuments/20120221_StrategicPlanConservatorships_508.pdf). In
remarks prepared for a November 2012 speech, the then Acting Director further explained that, “this new
infrastructure must be operable across many platforms, so that it can be used by any issuer, servicer, agent, or
other party who decides to participate.” FHFA, Recent Accomplishments and a Look Ahead at the Future of
Housing Finance, Remarks as Prepared for Delivery, Edward J. DeMarco, Acting Director Federal Housing
Finance Agency (Nov. 28, 2012) (online at: www.fhfa.gov/Media/PublicAffairs/Pages/Remarks-as-Prepared-
for-Delivery-Edward-J-DeMarco-Acting-Director-FHFA-The-Exchequer-Club.aspx).




                                     OIG  EVL–2014–008  May 21, 2014                                                13
find it difficult to execute certain risk-sharing transactions12 and improve its MBS disclosures.
Fannie Mae, however, contends that its systems are well-calibrated to the Enterprise’s current
MBS business, and the limitations of its systems relate to its ability to process MBS in a
hypothetical future state of the MBS market.

     Freddie Mac

Freddie Mac’s systems are also of concern to FHFA, although not to the same degree as
Fannie Mae’s systems. This is due, in large part, to the fact that Freddie Mac’s systems are
more modular and, therefore, more flexible, than Fannie Mae’s. Consequently, the older
elements of Freddie Mac’s systems are more conducive to being upgraded.

Freddie Mac itself disclosed in its 2010, 2011, and 2012 annual reports to the Securities
Exchange Commission (SEC) that the Enterprise’s “core systems and technical architecture
include many legacy systems and applications that lack scalability and flexibility, which
increases the risk of system failure.”13 According to Freddie Mac, the same language was
not included in its 2013 annual report, published in 2014, because the Enterprise completed a
three-year remediation program that addressed these risks for most of its systems. Notably, in
the 2013 report, for the first time Freddie Mac disclosed that the Enterprise’s efforts to assist
in the building of a new housing finance system increases the Enterprise’s operational risk.14

Fannie Mae Sought to Replace its Back Office Systems in 2010 and 2011

Fannie Mae initiated a project to replace its back office securitization systems in 2010. As
part of that effort, Fannie Mae undertook a comprehensive review of its securitization

12
   FHFA mandated risk-sharing transactions to transfer risk from the Enterprises to private investors. FHFA’s
stated goal in directing the Enterprises to engage in risk-sharing transactions is to reduce their market footprint
and, ultimately, protect taxpayers. See FHFA, Statement of FHFA Acting Director Edward J. DeMarco on
Freddie Mac Insurance Risk Sharing Transaction (Nov. 12, 2013) (online at:
www.fhfa.gov/Media/PublicAffairs/Pages/Statement-of-FHFA-Acting-Director-Edward-J-DeMarco-on-
Freddie-Mac-Insurance-Risk-Sharing-Transaction.aspx). To date, the Enterprises have issued over $2.5 billion
(combined) in risk-sharing securities from their proprietary infrastructures.
13
  Freddie Mac, Form 10-K for the Fiscal Year Ended December 31, 2012, at 76 (Feb. 28, 2013) (online at:
www.freddiemac.com/investors/er/pdf/10k_022813.pdf); Freddie Mac, Form 10-K for the Fiscal Year Ended
December 31, 2011, at 72 (Mar. 9, 2012) (online at: www.freddiemac.com/investors/er/pdf/10k_030912.pdf);
Freddie Mac, Form 10-K for the Fiscal Year Ended December 31, 2010, at 59 (Feb. 24, 2011) (online at:
www.freddiemac.com/investors/er/pdf/10k_022411.pdf).
14
  Freddie Mac’s 2013 annual report states: “We also face increased operational risk due to the magnitude and
complexity of the new initiatives we are undertaking, including our effort to help build a new housing finance
system. Some of these initiatives require significant changes to our operational systems. In some cases, the
changes must be implemented within a short period of time. Our legacy systems may also create increased
operational risk for these new initiatives.” Freddie Mac, Form 10-K for the Fiscal Year Ended December 31,
2013, at 52 (Feb. 27, 2014) (online at: www.freddiemac.com/investors/er/pdf/10k_022714.pdf).




                                     OIG  EVL–2014–008  May 21, 2014                                                14
infrastructure and considered outsourcing back office functions to a vendor. Ultimately,
Fannie Mae determined that the solicited vendors lacked the required capabilities.

In mid-2011, Fannie Mae launched a new initiative to consider upgrades to its securitization
systems. The team developed a concept for a revised system that would:

        Move existing back office functions to a new platform that would use standard
         interfaces;
        Require modifying surrounding legacy systems to use the platform’s standard services
         and interfaces;
        Allow for incremental testing of development versions to mitigate integration and
         execution risk;
        Consist of five modules that comprise the back office functions described above; and
        Survive regardless of the Enterprise’s future as determined through the housing
         finance reform process initiated by Congress.

In the fourth quarter of 2011, a working group of Fannie Mae’s Board of Directors permitted
the Enterprise to develop a prototype of a five-module infrastructure. However, that effort
ended as a Fannie Mae standalone project after FHFA announced its plans for a common
platform for the Enterprises.15 As described below, Fannie Mae’s prototype was adopted for
the CSP.




15
  In contrast, Freddie Mac’s Board of Directors did not approve the build of the CSP because the Enterprise
was not directly engaged in the early development of the prototype. As a consequence, the CSP build was not
subject to the normal vetting at Freddie Mac typical of a project of its size and scope. For example, the
Enterprise did not develop a business case for the CSP build.




                                   OIG  EVL–2014–008  May 21, 2014                                          15
FHFA Directed the Enterprises to Build the CSP

FHFA announced its intent to build a common securitization platform in its February 2012
Strategic Plan.16 As envisioned by FHFA, the CSP could serve as a market utility for the
future,17 supporting the back office securitization operations of the Enterprises as well as
other market participants.18 The CSP superseded Fannie Mae’s ongoing project to upgrade its
back office systems, and FHFA directed the Enterprises to develop a common system.

Over time, FHFA has articulated a number of goals for the CSP, including:

        Replacing elements of the Enterprises’ outmoded back office systems;
        Conserving taxpayer dollars by investing once (CSP) and using twice (by both
         Enterprises);
        Providing a common and flexible platform capable of accommodating various
         securitization structures, including risk-sharing structures that may not be compatible
         with the Enterprises’ infrastructures;
        Supporting other market participants, for example, issuers of private-label MBS
         (PLMBS)19;
        Facilitating policy changes, emerging standards, new technologies, and regulatory
         reforms;


16
   See FHFA, A Strategic Plan for Enterprise Conservatorships: The Next Chapter in a Story that Needs an
Ending (Feb. 21, 2012) (online at:
www.fhfa.gov/AboutUs/Reports/ReportDocuments/20120221_StrategicPlanConservatorships_508.pdf)
(hereinafter “FHFA Strategic Plan”). FHFA identified priorities in the Strategic Plan in light of its
interpretation of its mandates under the Housing and Economic Recovery Act of 2008 (HERA). These
mandates include FHFA’s authority as conservator to take necessary actions to put the Enterprises in a safe and
sound condition and to preserve and conserve their assets. Additionally, FHFA states that its Strategic Plan is
in accordance with the conservator’s statutory purpose of “reorganizing, rehabilitating, or winding up the
affairs” of the Enterprises.
17
  The CSP will not be designed primarily for other market participants to use in the near term. However, the
CSP will be designed with standard interfaces and technology so that it will be adaptable for other market
participants to use in the future. See FHFA, Managing the Present: The 2014 Strategic Plan for the
Conservatorships of Fannie Mae and Freddie Mac, Prepared Remarks of Melvin L. Watt, Director, Federal
Housing Finance Agency (May 13, 2014) (online at: www.fhfa.gov/Media/PublicAffairs/Pages/Watt-
Brookings-Keynote-5132014.aspx).
18
  The Government National Mortgage Association (Ginnie Mae) launched the first phase of a securitization
platform modernization initiative in December 2013. The FHFA official responsible for the CSP project spoke
with counterparts at Ginnie Mae, but discussions were suspended before FHFA could conclude whether Ginnie
Mae’s platform would satisfy the Enterprises’ requirements.
19
 PLMBS are MBS that are issued or guaranteed by market participants other than the Enterprises, Ginnie
Mae, or other government entities.




                                    OIG  EVL–2014–008  May 21, 2014                                             16
          Allowing for a single-mortgage backed security for the two Enterprises; and
          Serving as a market utility that could be used even if the Enterprises were terminated.

Further, FHFA expects the CSP to yield a net benefit to taxpayers. Specifically, FHFA
anticipates that the development of the CSP, and the potential replacement of elements of the
Enterprises’ proprietary infrastructures, will conserve taxpayer funds. Indeed, FHFA stated
that the CSP “will be one way American taxpayers realize a return on their substantial
investment in the Enterprises while also making it possible to retire the Enterprises’
proprietary systems….”20

       FHFA Did Not Conduct a Cost Analysis When It Initiated the CSP Project in 2012

FHFA initiated the CSP project without detailed analyses of the cost or estimated time to
complete the project. FHFA said it considered factors such as the Enterprises’ costs to
maintain their current securitization infrastructures; the problems with those infrastructures;21
and the future needs of the housing finance system. An FHFA official told us that FHFA
assumed that building one infrastructure for two Enterprises would save resources. As
detailed in our finding below, however, the Agency did not confirm its assumption with any
analysis.22

The CSP Will Not Fully Replace the Enterprises’ Back Office Securitization Systems

According to FHFA, when it is built, the CSP will be a separate IT system composed of five
modules that will perform some of the Enterprises’ back office securitization functions
described above more flexibly and efficiently.23 That is, the CSP will enable the Enterprises
to add functionality without having to rely on expensive manual changes, particularly at
Fannie Mae. If executed as intended, the CSP could permit the Enterprises to reduce
alteration and maintenance costs, test a specific module without affecting other modules,
accommodate new products, and create accessibility for other market participants.


20
     FHFA Strategic Plan, supra note 16, at 14.
21
     See above for a discussion of the perceived problems in the Enterprises’ current infrastructures.
22
   Approximately eight months after FHFA announced its Strategic Plan, the Agency released a White Paper
on the CSP and requested public comment. The White Paper was descriptive in nature but did not discuss the
cost of the CSP initiative or set forth a schedule for the project. It did note, however, that the endeavor would
likely be a multi-year effort. FHFA expects, but has not confirmed, that the CSP will represent a cost savings
to the Enterprises and, thus, a net return for taxpayers. See FHFA, White Paper (Oct. 4, 2012) (online at:
www.fhfa.gov/PolicyProgramsResearch/Research/PaperDocuments/FHFA_Securitization_White_Paper_N508
L.pdf).
23
  The five modules are: (1) data acceptance, (2) issuance support, (3) disclosures, (4) master servicing
operations, and (5) bond administration.




                                        OIG  EVL–2014–008  May 21, 2014                                           17
According to the team developing the CSP,
it will be built in a modular fashion utilizing     An interface is a point of
standardized securitization services and            interconnection between two
                                                    independent systems or parts of a
interfaces. FHFA anticipates that these
                                                    system at which all the physical,
design features, among others, will allow the
                                                    electrical, and logical parameters are
CSP to adapt to policy changes and emerging         in accordance with predetermined
standards and technologies. For example, if         values common in an industry.
FHFA or the Enterprises decide to provide
additional disclosures to MBS investors, the issuance support, disclosure, master servicing
operations, and bond administration modules should support that change without substantial
additional programming.24

While the CSP is intended to produce these benefits, it will not replace the Enterprises’
current back office systems entirely. The Enterprises will have to continue to maintain and
use some of their existing systems for the following three reasons:

        First, it appears that certain existing single-family securitizations may not be
         transferred to the CSP because of the complexity of designing a system capable of
         servicing both past and future products.
        Second, the CSP will only support single-family securitization. The Enterprises will
         continue to use their existing systems for multifamily mortgage securitizations. There
         are no plans for the CSP to accommodate multifamily mortgage securitizations.
        Third, the Enterprises have some back office systems that will not be part of the CSP.
         For example, the CSP will not support master servicing functions for non-performing
         loans. Those duties will remain with the Enterprises.

The Enterprises Must Modify their Existing Financial and Information Systems to
Integrate with the CSP

Transferring responsibility for some of the Enterprises’ back office securitization systems
to the CSP is not simply a matter of building the five modules. Once the CSP is built, the
Platform must be able to communicate with the Enterprises. For example, Fannie Mae’s Loan
Accounting System will use data generated by the CSP, such as the total unpaid principal
balance of securitized mortgages, in the Enterprise’s financial statements.



24
  Other enhancements include the flexibility for the data acceptance module to add or change business rules.
For example, if FHFA or the Enterprises make a policy decision to limit securitization to loans with certain
maturities, the CSP can accommodate the change.




                                    OIG  EVL–2014–008  May 21, 2014                                          18
The process of enabling the Enterprises to use the
CSP is known as “integration.” As depicted in              Industry standard interface is an
Figure 4 below, the CSP is being designed with an          interface that is not customized
industry standard interface, which can be thought          for or dependent on customers’
of as the CSP’s “front door.” To communicate with          systems.
the CSP, each Enterprise is developing what is
known as a communication gateway.25 In some cases, the Enterprises must modify their
financial and information systems to interface with their communication gateways and,
ultimately, communicate with the CSP.




25
  Both the CSP’s “front door” and the Enterprises’ communication gateways are software components that
rely on industry standard interfaces to facilitate communication.




                                  OIG  EVL–2014–008  May 21, 2014                                      19
                         FIGURE 4. ENTERPRISE INTEGRATION WITH THE CSP


          Fannie Mae Financial & Information
                       Systems                                                                   CSP Five
                                                                                                 Modules




                                                 Communication Gateway
                                                                                                  Data
                                                                                               Acceptance


                                                                                                Issuance
                                                                                                Support




                                                                         Standard Interface
         Freddie Mac Financial & Information
                                                                                               Disclosures
                      Systems


                                                                                                 Master
                                                 Communication Gateway




                                                                                                Servicing
                                                                                               Operations


                                                                                                 Bond
                                                                                              Administration




Current Status of the CSP Building Process

The CSP building process consists of three segments: (1) software development, which
includes the five modules; (2) non-functional components, such as disaster recovery; and
(3) establishment of CSS, a corporate infrastructure to own and operate the CSP. The
software development segment is the most advanced, while the other two are still in the early
stages.




                                OIG  EVL–2014–008  May 21, 2014                                              20
     CSP Software Development

According to FHFA and the team building the CSP, there has been considerable progress in
the development of the software for the CSP. Specifically, a five-module CSP prototype has
been completed, planned testing milestones have been accomplished, and the project has
moved into the software development phase. 26 By one FHFA official’s rough estimate, the
work completed as of March 2014 accounts for more than half of the software development
necessary to build the five modules of the CSP.

In 2013, the Enterprises retained an independent consultant to assess the CSP’s architecture
and the Enterprises’ integration and implementation plans. FHFA officials said they took
comfort from the independent consultant’s review of the CSP’s architecture. According to
FHFA, the independent consultant concluded that the CSP technology is well-designed.
However, the independent consultant also noted that the implementation of the CSP is not
complete and, accordingly, the consultant could not reach any conclusions regarding the final
product.

     CSP Non-Functional Components

In addition to software development, efforts are underway to develop other critical
components of the CSP. These include what are known as non-functional requirements, such
as operational readiness, disaster recovery, and business continuity plans.27 FHFA officials
said retaining a vendor for these items will be a priority in 2014. Further, as discussed below,
FHFA and the Enterprises are also involved in modifying the Enterprises’ current financial
and information systems as needed for the Enterprises to integrate with the CSP through
communication gateways.

     CSP Management

In October 2013, at FHFA’s instruction, the Enterprises established a joint venture known
as Common Securitization Solutions, LLC. CSS is an equally owned subsidiary of each
Enterprise that will develop, build, own, and operate the CSP.28 FHFA established CSS, in

26
  According to FHFA and the Enterprises, the software for the CSP is being developed according to the Agile
method; that is in small, short increments. For more information about the Agile method, see GAO, Software
Development: Effective Practices and Federal Challenges in Applying Agile Methods (July 2012) (GAO-12-
681) (online at: www.gao.gov/assets/600/593091.pdf).
27
  In essence, these are a combination of hardware, software, and services that ensure the capability to recover
computer systems, prevent data loss, and operate without interruption in the event of a disaster.
28
  According to FHFA, the Agency will have regulatory and management authority over CSS. FHFA’s
assertion of authority is based upon CSS’s status as an asset and affiliate of the Enterprises, which are under
FHFA’s conservatorship and subject to FHFA’s regulatory regimen. As a result, FHFA will have considerable
discretion in defining the new entity’s role and directing its actions. The Board of Managers that will manage



                                     OIG  EVL–2014–008  May 21, 2014                                            21
part, to create consensus between the Enterprises regarding the development and operation of
the CSP. 29 FHFA has also expressed the intention for CSS to be able to operate the CSP
independently so that it is usable by any issuer, servicer, agent, or other market participant.

In June 2013, months before CSS was created, FHFA and the Enterprises retained a search
firm to identify candidates for two CSS offices: the Chair of the Board of Managers, and the
CEO. In November 2013, FHFA reported that the identification and interviewing of
candidates for both positions was well underway. However, FHFA has not made a public
statement updating the status of these recruitment efforts since its Director was sworn in on
January 6, 2014. In fact, an FHFA official told us that the new Director and his staff are
reviewing the CSP, considering such foundational elements as the scope of the project, as
well as their options for reducing its risks.

Challenges to the Development and Implementation of the CSP

FHFA and the Enterprises face several challenges in developing and implementing the CSP.
Some of these challenges are discussed below.

     The Technological Challenge of Large-Scale IT Development

The development of large-scale IT projects, such as the CSP, is complex, challenging, and
often risky. The challenges inherent in developing the CSP are compounded by the number
of parties involved – FHFA, Fannie Mae, Freddie Mac, and CSS. The inherent challenges are
also compounded by the scope of the project – developing the CSP’s five modules, as well as
modifying the Enterprises’ existing infrastructures to allow integration with the CSP.30

The Enterprises have not always been successful in controlling costs and delivering IT
projects successfully or on time. We believe that this raises questions about their capacity to




CSS will be subject to FHFA’s conservatorship and supervisory authorities to the same extent as the
Enterprises’ Boards of Directors. The Board of Managers initially will consist of a CEO, a Chair, and two
Managers. FHFA will designate the CEO and Chair of the Board, and each Enterprise will designate one
Manager. The Board of Managers is not yet operational. CSS’s current management consists of an FHFA-
appointed Head of Technology and Clients Services and a Head of Operations.
29
  As an independent entity, CSS will have to replicate a number of corporate functions performed by the
Enterprises, such as human resources and accounting. CSS will either perform these functions directly or will
retain third-party vendors. In the interim, the Enterprises will provide these services under agreements with
CSS.
30
  According to CSS’s leadership, they have employed a risk mitigation approach to develop the CSP that
includes: the use of industry standard software packages; the transfer of long-term maintenance to CSS staff;
and the employment of testing milestones for compliance with the CSP’s architecture and quality standards.




                                    OIG  EVL–2014–008  May 21, 2014                                           22
successfully develop and implement the CSP.31 For example, Fannie Mae’s post-
conservatorship attempt to update its master servicing system was unsuccessful because it
went well over budget, took longer than planned, and did not satisfy its initial requirements.
A senior FHFA official observed that Fannie Mae has taken on some IT projects that have
been harder and more expensive than anticipated. Moreover, Freddie Mac invested tens of
millions of dollars in an IT project that was ultimately cancelled in 2011 as it proved to be
unworkable.32

We also note that FHFA does not have experience in overseeing the development and
implementation of a large and complex IT project similar to the CSP. Moreover, FHFA is a
relatively small federal financial regulator tasked with multiple responsibilities. These factors
make it less than certain that the Agency currently possesses the technical expertise necessary
to effectively oversee the development and implementation of the CSP. Consequently, the
endeavor is not without risks.

     Integration Is Complicated, Costly, and Potentially Risky

A critical IT challenge facing FHFA and the Enterprises is modifying the Enterprises’ legacy
systems so that they can communicate with the CSP. FHFA officials and Enterprise
executives said that the process will be complex and challenging. Moreover, it may take
longer to complete – and be more expensive – than building the five modules that will carry
out the back office securitization functions.

According to an FHFA official, integration is more difficult than building the CSP because
the CSP can be built fresh with current, industry standard building blocks and technology. In
contrast, integration, which involves modifying the Enterprises’ existing systems to permit the
Enterprises to use the CSP, is complex and risky because some of the Enterprises’ systems are
outmoded and are currently being upgraded. Fundamentally, if integration is not managed
well, then the CSP may not function as planned.

The Chief Executive Officers (CEO) of both Enterprises voiced their concerns about
integration in an August 2013 meeting with the Agency. They told FHFA that integration
would require too many internal changes to be made too quickly. Fannie Mae’s CEO, in
particular, was concerned about the significant operational risks associated with the changes


31
  In its 2012 annual examinations of the Enterprises, FHFA rated each Enterprise’s operational risk as a matter
of “significant concern,” in part, because of the reliance on outdated IT systems.
32
  In the wake of this large-scale IT failure, Freddie Mac implemented a new approach to IT development
focused on smaller more incremental projects. Freddie Mac considers its new approach to be successful in
resolving past concerns about the Enterprise’s IT development.




                                    OIG  EVL–2014–008  May 21, 2014                                             23
that would have to be made to his company’s internal systems.33 According to an FHFA
official, the CEOs’ concerns were not a surprise to the Agency.

Consistent with its 2013 Scorecard goals, FHFA directed the Enterprises to submit integration
plans to the Agency by September 30, 2013.34 The Enterprises submitted their plans by the
deadline. However, as FHFA expected, the plans were high-level and the Agency instructed
the Enterprises to resubmit more detailed plans. According to FHFA, for example, Fannie
Mae’s September 30, 2013, plan did not adequately detail how the Enterprise would transition
from integrating a small segment to the entire portfolio. 35

Subsequently, FHFA required the Enterprises to revise their integration plans to include
realistic goals and timelines that are achievable without excessive risk. The Enterprises
completed their revised integration plans and submitted them to the Agency by January 2014.
FHFA is currently reviewing the revised plans.

     It Is Uncertain that Private-Market Participants Will Use the CSP

We believe there are uncertainties about whether the CSP will be used for private-market
securitizations. First, it is difficult to gauge private-market participants’ interest in using the
CSP. According to one FHFA official, thus far, the few private institutions that securitize
mortgages have not shown significant interest in using the CSP.36 Second, the current market
for PLMBS is weak. The PLMBS market collapsed in 2008 with the onset of the financial
crisis, and some market observers suggest that the return of a robust PLMBS market is




33
  The CSS team developing the CSP considers simultaneous integration of the CSP with both Enterprises as
an unacceptable risk, and therefore has required that a stabilization period occur between all major events. The
timing and manner in which each Enterprise will integrate with the CSP remain an open question.
34
   FHFA uses Scorecard goals to align the Enterprises’ business objectives with the Strategic Plan. A
significant percentage of FHFA’s 2013 Scorecard goals for the Enterprises was dedicated to building the CSP
and planning for the Enterprises’ integrations. FHFA established five CSP-specific goals: (1) establish an
ownership and governance structure; (2) develop design, scope, and functional requirements for the CSP; (3)
develop multiyear plans, including integration; (4) develop and begin testing the CSP; and (5) support FHFA’s
progress reports to the public. See FHFA, Conservatorship Strategic Plan: Performance Goals for 2013 (Mar.
4, 2013) (online at: www.fhfa.gov/AboutUs/Reports/ReportDocuments/2013EnterpriseScorecard_508.pdf).
35
  According to Freddie Mac, the Enterprise understood that it needed to resubmit its integration plan because
the scope of the CSP project changed. Specifically, FHFA determined that servicers would transmit data and
cash to the Enterprises rather than directly to the Platform.
36
  Other FHFA officials explained that, for now, FHFA is keeping the market at bay; and if PLMBS
participants decide to use the CSP, it will only be after the Enterprises.




                                    OIG  EVL–2014–008  May 21, 2014                                              24
unlikely to occur soon.37 An FHFA official observed that private-market interest in the CSP
may increase once it becomes operational and there is a rebound in the PLMBS market.

In public remarks delivered after the conclusion of the fieldwork for this report, Director Watt
announced that “the [Agency’s] top objective for the Common Securitization Platform is to
make sure that it works for the benefit of Fannie Mae and Freddie Mac” and defined a
successful outcome for the CSP as a “seamless transition from the current in-house systems
that issue new securities at each Enterprise to a future joint venture owned by Fannie Mae and
Freddie Mac that operates one system with updated technology.” FHFA is requiring the CSP
to use “the systems, software and standards used in the private sector wherever possible.”
According to Director Watt, “this will ensure that the CSP will be adaptable for use by other
secondary market actors – including private label securities issuers – when the future state is
more defined.”38




37
 See. e.g., “Seven Reasons Private-Label MBS Are Not Coming Back Any Time Soon,” National Mortgage
News, March 20, 2014 (online at: www.nationalmortgagenews.com/blogs/hearing/seven-reasons-private-label-
mbs-are-not-coming-back-any-time-soon-1041389-1.html).
38
  FHFA, Managing the Present: The 2014 Strategic Plan for the Conservatorships of Fannie Mae and
Freddie Mac, Prepared Remarks of Melvin L. Watt, Director, Federal Housing Finance Agency (May 13,
2014) (online at: www.fhfa.gov/Media/PublicAffairs/Pages/Watt-Brookings-Keynote-5132014.aspx).




                                  OIG  EVL–2014–008  May 21, 2014                                        25
FINDING ...................................................................................

1. FHFA has not yet fully employed essential project management tools in the
   development of the CSP

As shown above, FHFA, the Enterprises, and CSS face several challenges in the development
and implementation of the CSP. To date, FHFA has not fully applied two basic project
management tools that could assist in meeting these challenges: a schedule (timeline) and
a cost estimate. FHFA, the Enterprises, and CSS have prepared and developed various
estimates, but have not settled on a comprehensive schedule or budget. As a result, we
believe the risks inherent to the project have been heightened. Further, Congress, financial
market participants, and taxpayers have been left without certainty that the project should
proceed or that, if it does, it will achieve its stated objectives in an efficient and effective
manner.39

       FHFA and the Enterprises Have Not Established a Schedule for Completing the CSP

Both OMB and GAO have established guidance on the planning and acquisition of IT
systems.40 According to OMB’s and GAO’s guidance, the establishment of schedules is a
sound planning practice for projects such as the CSP.

GAO’s guidance states that “a well-planned schedule is a fundamental management
tool…specifying when work will be performed…and measuring program performance against
an approved plan.”41 GAO identifies the benefits of a well-constructed schedule. It notes that
such a schedule “[shows] when major events are expected, as well as the completion dates for
all activities leading up to them, which can help determine if the program’s parameters are
realistic and achievable.”42 GAO’s guidance also reflects sound governance principles
consistent with industry standards.43


39
  We did not analyze FHFA’s decision to develop the CSP. Our recommendations should not be interpreted
as either an endorsement or condemnation of the CSP project.
40
  See OMB, Improving Information Technology (IT) Project Planning and Execution (Aug. 4, 2005) (M-05-
23) (online at: www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-23.pdf); GAO, GAO
Schedule Assessment Guide: Best Practices for Project Schedules (May 2012) (GAO-12-12OG) (online at:
www.gao.gov/assets/600/591240.pdf).
41
     GAO, GAO Schedule Assessment Guide, at 1.
42
     Id.
43
  See GAO, GAO Schedule Assessment Guide, at 1. For information on cost estimates and schedules as
industry standard project management tools, see Project Management Institute, A Guide to the Project
Management Body of Knowledge, at 141-226 (5th ed. 2013) (hereinafter “PMBOK Guide”). The Enterprises



                                   OIG  EVL–2014–008  May 21, 2014                                     26
After approximately two years of work, FHFA and the Enterprises have not yet finalized
detailed schedules for completion of the CSP. One FHFA official explained that doing so has
been difficult, in part, because of the CSP’s shifting scope. We note that there are a number
of things that FHFA and the Enterprises can look to now to help them develop a schedule to
complete the CSP project.

First, FHFA has on hand the Enterprises’ revised integration plans. FHFA told us that it
is currently reviewing these plans, as well as the Enterprises’ proposed implementation
schedules. It is likely that the Enterprises’ schedules provide a good place for FHFA to start a
timeline. Second, in a recent examination of an Enterprise’s project management capabilities,
FHFA’s Division of Enterprise Regulation (DER) identified a number of steps that the
Enterprise could take to establish goals and timelines for integration without engaging in
excessive risk taking.44

With the establishment of timelines for the crucial integration tasks, FHFA and the
Enterprises may be positioned to develop comprehensive schedules for the CSP’s overall
completion. Such schedules would allow the Agency to better assess whether the CSP should
proceed and is on track to meet its objectives. The failure to meet scheduled milestones could
help determine whether revisions to the CSP project are necessary. Further, if FHFA
published the schedules, then Congress and other outside parties could also better assess the
overall project and its progress.

     FHFA and the Enterprises Have Not Established a Total Cost Estimate for the CSP

OMB and GAO have also established detailed guidance on developing cost estimates for IT
projects such as the CSP.45 GAO identifies several reasons for developing cost estimates,
evaluating resource requirements at key decision points, and developing performance


collaborated on the CSP at the direction of their conservator, FHFA. We note that, outside of conservatorship,
the Enterprises have policies and procedures in place to authorize and guide projects of the significance and
scope of the CSP. Fannie Mae’s and Freddie Mac’s policies and procedures require the Enterprises to justify
IT development with business cases, cost-benefit analyses, identified requirements, schedules, and budgets.
44
  DER examined the Enterprises’ project management in 2013. DER launched its examination due to concern
about the challenges associated with integrating the Enterprises’ legacy systems into the CSP. DER identified
areas that generally needed improvement, such as prioritizing projects, sequencing the implementation of
projects, identifying project interdependencies, and allocating resources. DER concluded that improvement in
these areas could help the Enterprises establish realistic goals and timelines that could be achieved without
excessive risk taking. FHFA stated that it would consider the results of these examinations in making future
decisions concerning the Enterprises’ integration plans.
45
  See OMB, Improving Information Technology (IT) Project Planning and Execution (Aug. 4, 2005) (M-05-
23) (online at: www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-23.pdf); GAO, GAO Cost
Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs (Mar.
2009) (GAO-09-3SP) (online at: www.gao.gov/assets/80/77175.pdf).




                                    OIG  EVL–2014–008  May 21, 2014                                            27
measurement baselines. In addition, GAO states that realistic estimates of projected costs
enable effective resource allocation and increase the chances that a given program will
succeed. GAO’s guidance is consistent with governance principles commonly applied to
project management.46

As of December 31, 2013, the Enterprises spent a combined total of approximately $65
million to build the CSP. This year the Enterprises are spending between $5 million and $7
million per month to continue that effort. In addition, Fannie Mae budgeted $42 million for
integration-related projects47 for the first three months of 2014; and Freddie Mac budgeted
$14 million for integration for the period January 1, 2014 to May 31, 2014. According to
Fannie Mae documents, in 2013 FHFA told Fannie Mae that it should not feel constrained by
a budget.

In fact, FHFA and the Enterprises have yet to develop a total estimated cost for the CSP. One
FHFA official explained that they have been challenged in developing cost estimates because
certain costs are difficult to predict at this time, such as the cost of modifying the Enterprises’
existing systems to permit integration with the CSP. The Enterprises and the team developing
the CSP have submitted draft budgets for FHFA’s review, but no budget has been finalized or
endorsed by the Agency.

We recognize that developing cost estimates for the various components of the CSP may
be challenging. However, both OMB and GAO guidance provide structured processes for
addressing such challenges.48 FHFA and the Enterprises may be positioned better today to
implement this guidance and develop cost estimates than they were at the outset.49

46
  See PMBOK Guide, supra note 43, at 193-226. For example, without an estimate one cannot analyze the
cost versus the benefit to determine whether a project should be started or continued.
47
  Fannie Mae’s budget of $42 million includes $20 million for CSP integration and another $22 million for
related projects, including updating the Enterprise’s Loan Accounting and Loan Sourcing systems, among
others. According to Fannie Mae, the Enterprise envisioned updating its Loan Accounting and Loan Sourcing
systems regardless of FHFA’s mandates to build the CSP. Fannie Mae’s Loan Sourcing System takes data
about loans the Enterprise purchases and formats the data for Fannie Mae’s other internal systems.
48
  For example, GAO suggests, “[t]he management of a cost estimate involves continually updating the
estimate with actual data as they become available, revising the estimate to reflect changes, and analyzing
differences between estimated and actual costs… .” GAO, GAO Cost Estimating and Assessment Guide: Best
Practices for Developing and Managing Capital Program Costs (Mar. 2009) (GAO-09-3SP), at i (online at:
www.gao.gov/assets/80/77175.pdf). See also PMBOK Guide, supra note 43, at 217-25. Fannie Mae’s Internal
Audit group and FHFA’s DER have each suggested that FHFA and the Enterprises apply this baselining
approach to the CSP project.
49
  For example, an FHFA official estimated that roughly half of the software development for the five modules
of the CSP has been completed. Thus, FHFA and the Enterprises may need to estimate only the cost of
completing the remaining work. Further, FHFA and the Enterprises have initiated work on the non-functional
requirements of the CSP, such as disaster recovery and build-out of CSS as a corporate entity. Consequently,
they now have some basis upon which to estimate the cost to complete these requirements. Likewise, the



                                   OIG  EVL–2014–008  May 21, 2014                                           28
In 2012, when FHFA announced the CSP project, the Agency assumed that developing the
CSP for both Enterprises would be less costly than each Enterprise updating its proprietary
systems. However, Freddie Mac has concluded that the CSP will add to the cost of the
Enterprise’s securitization process because it costs additional money to build the CSP.
Accordingly, launching the CSP project without any clear idea of what it would cost or,
indeed, what it could cost, seems an inauspicious beginning. Absent a realistic budget or cost
estimate, the Agency, Congress, and the public may encounter significant challenges in
measuring the progress of the project, as well as in conducting any cost-benefit projections as
the CSP project moves forward and evolves.




Agency is presently reviewing the Enterprises’ revised integration plans. If FHFA approves one or both of
them, then it would likely have an informed basis upon which to estimate the cost for completing the
Enterprises’ integration and, perhaps, the balance of the CSP project.




                                    OIG  EVL–2014–008  May 21, 2014                                       29
CONCLUSIONS ..........................................................................

FHFA’s CSP initiative represents an ambitious effort to improve the existing securitization
processes of the Enterprises. According to FHFA, the CSP offers significant benefits,
including economies of scale, as well as a potential market utility, that could outlast reforms
to the current structure of the Enterprises. However, the CSP project faces significant
challenges, such as integration. If they are not mitigated sufficiently, then the risks associated
with these challenges will continue to threaten the development and implementation of the
CSP. While FHFA and the Enterprises have taken a number of steps to develop the CSP, the
Agency has not yet fully applied essential project management tools. By doing so, FHFA
could enhance the potential for the CSP’s success.




RECOMMENDATIONS ...............................................................

To strengthen the management of the CSP, we recommend that FHFA:

   1. Establish schedules and timeframes for completing key components of the project, as
      well as an overall completion date as appropriate; and

   2. Establish cost estimates for varying stages of the initiative, as well as an overall cost
      estimate.




                               OIG  EVL–2014–008  May 21, 2014                                     30
OBJECTIVE, SCOPE, AND METHODOLOGY .................................

The objective of this evaluation was to assess FHFA’s oversight of the Enterprises’
development of the CSP.

To address this objective, we:

      Reviewed HERA, the Government Performance and Results Modernization Act of
       2010, the Clinger-Cohen Act, the Dodd-Frank Wall Street Reform and Consumer
       Protection Act of 2010, SEC regulations, and OMB memoranda;
      Reviewed GAO reports;
      Reviewed PMBOK Guide (5th ed. 2013).
      Reviewed FHFA documents including its public statements, Strategic Plan, White
       Paper, internal communications, presentations, directives, and examination reports;
      Reviewed Enterprise, CSP, and CSS documents including public statements, internal
       communications, presentations, reports by the Enterprises’ independent consultant,
       Fannie Mae’s Internal Audit reports, CSS’s Limited Liability Company Agreement,
       and the Enterprises’ financial disclosures;
      Reviewed industry comments to FHFA’s White Paper and industry publications;
      Reviewed documents provided to us by the Enterprises’ outside consultant;
      Interviewed senior FHFA officials;
      Interviewed current and former senior Enterprise employees; and
      Interviewed senior members of the team building the CSP.

We did not independently test the reliability of the data provided by FHFA or the Enterprises.
Estimating the cost of the build of the CSP or the cost of integration is beyond the scope of
this evaluation.

This evaluation was conducted under the authority of the Inspector General Act and is in
accordance with the Quality Standards for Inspection and Evaluation (January 2012), which
were promulgated by the Council of the Inspectors General on Integrity and Efficiency.
These standards require OIG to plan and perform an evaluation that obtains sufficient
evidence to provide a reasonable basis to support the findings and recommendations made
herein. We believe that the finding and recommendations discussed in this report meet these
standards.




                                 OIG  EVL–2014–008  May 21, 2014                               31
A draft of this report was sent to FHFA for comment. FHFA agreed to both of OIG’s
recommendations. FHFA’s comments are attached hereto as Appendix A.

The performance period for this evaluation was November 2012 to March 2014.




                            OIG  EVL–2014–008  May 21, 2014                       32
APPENDIX A .............................................................................

FHFA’s Comments on FHFA-OIG’s Findings and Recommendation




                           OIG  EVL–2014–008  May 21, 2014                           33
OIG  EVL–2014–008  May 21, 2014   34
ADDITIONAL INFORMATION AND COPIES .................................

For additional copies of this report:

      Call: 202-730-0880
      Fax: 202-318-0239
      Visit: www.fhfaoig.gov



To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

      Call: 1-800-793-7724
      Fax: 202-318-0358
      Visit: www.fhfaoig.gov/ReportFraud
      Write:
                FHFA Office of Inspector General
                Attn: Office of Investigation – Hotline
                400 Seventh Street, S.W.
                Washington, DC 20024




                                OIG  EVL–2014–008  May 21, 2014                          35