Issue Date September 22, 2008 Audit Report Number 2008-AT-1014 TO: Stephen L. Ledbetter, Acting Vice President - Mortgage-Backed Securities, TS FROM: James D. McKay, Regional Inspector General for Audit, 4AGA SUBJECT: Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its Mortgage-Backed Securities Program HIGHLIGHTS What We Audited and Why We reviewed Doral Bank Puerto Rico (Doral), an approved issuer for the Government National Mortgage Association (Ginnie Mae). Our objective was to determine whether Doral complied with Ginnie Mae requirements associated with its mortgage-backed securities activities. The review was initiated in connection with the 2007 Ginnie Mae financial statement audit. What We Found Doral did not fully comply with Ginnie Mae requirements, because it maintained seven noninsured loans in Ginnie Mae pools. It also failed to ensure that data on its pooled loans were accurate. As a result, Doral retained defective loans with unpaid principal totaling $448,167 in its Ginnie Mae pools and reported inaccurate information to Ginnie Mae and the U.S. Department of Housing and Urban Development (HUD). What We Recommend We recommend that the Vice President of Mortgage-Backed Securities require Doral to take corrective measures to ensure that the defective loans identified during the review are reinsured or removed from the Ginnie Mae pools and that the loans reflect complete and accurate mortgage information. We also recommend that the Vice President of Mortgage-Backed Securities ensure that Doral establishes and implements adequate controls and procedures to periodically verify that all of its Ginnie Mae pooled loans are insured in accordance with Ginnie Mae requirements. For each recommendation in the body of the report without a management decision, please respond and provide status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or directives issued because of the audit. Auditee’s Response We discussed the finding with Doral and Ginnie Mae officials during the audit. We provided a copy of the draft report to Doral on August 26, 2008, for its comments and discussed the report with Doral officials at the exit conference on August 29, 2008. Doral provided written comments on September 12, 2008 and generally agreed with our findings. Doral’s response, along with our evaluation of that response, can be found in appendix B of this report. Attachments to Doral’s comments were not included in the report, but are available for review upon request. 2 TABLE OF CONTENTS Background and Objectives 4 Results of Audit Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements 5 Scope and Methodology 8 Internal Controls 10 Appendixes A. Schedule of Questioned Costs 11 B. Auditee Comments and OIG’s Evaluation 12 3 BACKGROUND AND OBJECTIVES Doral Bank Puerto Rico (Doral) is a subsidiary of Doral Financial Corporation, organized in 1972 under the laws of the Commonwealth of Puerto Rico. It is an approved issuer for the Government National Mortgage Association (Ginnie Mae) and an approved servicer under the Mortgage-Backed Securities (Securities) program. Doral provides a full range of financial services, including mortgage banking, with 41 branches throughout Puerto Rico. As of December 2007, Doral was servicing more than 26,000 Federal Housing Administration (FHA)- insured loans that are in Ginnie Mae pools, with original mortgage amounts totaling more than $2 billion. Doral’s mortgage records are maintained at its main office in San Juan, Puerto Rico. The objective of the review was to determine whether Doral complied with Ginnie Mae’s Securities program requirements. The compliance requirements encompass the inclusion of only insured loans in Ginnie Mae pools, the remittance of loan claims and/or payments to investors, and the accuracy of pooled loans data. 4 RESULTS OF AUDIT Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements Doral did not follow Ginnie Mae requirements because it maintained seven noninsured loans in Ginnie Mae pools. It also failed to ensure that data on its pooled loans were accurate. This noncompliance occurred because Doral’s management did not implement effective controls to make certain that mortgage information was complete and accurate. As a result, Doral retained defective loans with unpaid principal totaling $448,167 in its Ginnie Mae pools and reported incorrect and/or incomplete information to Ginnie Mae and the U.S. Department of Housing and Urban Development (HUD). Noninsured Loans in Ginnie Mae Pools The Securities program requires that each loan in Ginnie Mae pools be and remain at all times insured or guaranteed by an agency of the federal government. Loans that do not meet the requirement are defective and must be removed from the Ginnie Mae pool. Of the more than 26,000 FHA loans that Doral has in Ginnie Mae pools, seven had the insurance or guaranty withdrawn. The seven loans were active in Ginnie Mae pools, but information in HUD’s system showed that the loans were paid in full or refinanced. Case Original Unpaid Insurance Termination number loan amount principal termination date reason XXXX680 $42,000 $31,474 Nov. 30, 1993* Paid in full XXXX053 80,150 51,787 Dec. 1, 1997* Paid in full XXXX539 69,750 58,889 Aug. 1, 1998* Paid in full XXXX058 80,950 64,220 Jan. 20, 2000* Paid in full XXXX950 99,900 84,724 Feb. 9, 2000* Paid in full XXXX483 107,500 94,480 Apr. 8, 2004** Paid in full XXXX341 67,294 62,593 June 25, 2004** Refinanced Total $547,544 $448,167 * Doral removed these loans from Ginnie Mae pools in August 2008. ** HUD reinstated insurance in February 2008. 5 We examined Doral and custodian files, interviewed borrowers, and determined that the information in HUD’s system was incorrect. The seven loans were active and were not paid in full or refinanced. However, HUD’s system showed that the FHA insurance for these loans was withdrawn between November 1993 and June 2004. As a result, Doral had defective loans in its Ginnie Mae pools. Doral officials did not explain why the deficiencies occurred, other than that they were associated with data entry errors. During the audit, Doral requested that HUD reinstate FHA insurance on two of the loans and initiated procedures to repurchase from Ginnie Mae pools the remaining five loans.1 Inaccurate Loan Information We reviewed 60 sampled loans to verify the accuracy of the data on the loans. We compared the information in Doral’s loan servicing files with data recorded in HUD and Ginnie Mae systems. There were inconsistencies in 35 of the 60 loans. These 35 loans contained the following inconsistencies: Number of Percentage of Type of inconsistency/error loans sample Incorrect FHA case number 17 28 Incorrect borrower name 9 15 Incorrect loan status 7 12 Incorrect or missing Social Security number 4 7 Incorrect or incomplete address 4 7 Other (incorrect lender name, missing co- 4 7 borrower information, etc.) Doral officials did not explain why the deficiencies occurred, other than that they were associated with data entry errors. As a result, incorrect mortgage information was reported to Ginnie Mae and HUD. Conclusion Doral maintained noninsured loans in its Ginnie Mae pools and reported inaccurate information because it did not have effective controls in place. As a result, Ginnie Mae does not have assurance that all pooled loans comply with program requirements. Management must emphasize the importance of its mortgage-backed securities activities and implement policies and procedures to 1 In February 2008, HUD reinstated the FHA insurance on the two loans and in August 2008, Doral removed the remaining five loans from Ginnie Mae pools. 6 ensure that it complies with Ginnie Mae requirements and prevents future instances of noncompliance. Recommendations We recommend that the Vice President of Mortgage-Backed Securities require Doral to 1A. Take appropriate corrective measures to make certain that the remaining five defective loans, with unpaid principal totalling $291,094, are reinsured or removed from the Ginnie Mae pools.2 1B. Take appropriate corrective measures to ensure that loans in Ginnie Mae pools reflect complete and accurate mortgage information. 1C. Establish and implement adequate management controls and procedures to periodically verify that all of its Ginnie Mae pooled loans are insured in accordance with Ginnie Mae requirements. 2 Of the seven defective loans, HUD reinstated the FHA insurance on two loans in February 2008 and Doral removed five loans from the Ginnie Mae pools in August 2008. 7 SCOPE AND METHODOLOGY To accomplish our objectives, we did the following: Reviewed applicable laws, regulations, and other Ginnie Mae requirements. Obtained an understanding of Doral’s management controls and procedures as they related to our objectives. Reviewed Doral’s latest audited financial statements and HUD and Ginnie Mae monitoring reviews. Interviewed Doral officials, a foreclosure attorney, and borrowers. Reviewed Doral and custodian files and records. Performed 29 site inspections of mortgaged properties to verify addresses and other information on the borrowers. We performed computer matching analyses between HUD and Ginnie Mae systems. From the more than 26,000 FHA loans in Doral’s Ginnie Mae pools, we identified 22 loans that were apparently terminated (i.e., potentially no longer HUD insured). However, these loans were identified as active loans in Ginnie Mae pools. We reviewed all 22 loans to determine whether there were non-insured loans in Ginnie Mae pools. We reviewed another 18 loans that reflected inconsistencies with the mortgage information in HUD systems.3 HUD’s Single Family Data Warehouse system showed 608 loans serviced by Doral that were terminated between January 2004 and May 2007 and were identified as active in Ginnie Mae pools. We reviewed 20 of the 608 terminated loans4 to determine whether there were additional non-insured loans in Ginnie Mae pools and whether payments were properly made to investors. We determined that all 20 loans were terminated and that payments were made to investors. We also verified the accuracy of the mortgage information for the 60 sampled loans. We compared the information in Doral’s loan servicing files with data recorded in HUD and Ginnie Mae systems. We relied on computer-processed data contained in HUD’s Single Family Data Warehouse and Neighborhood Watch as well as Ginnie Mae systems only to obtain loan information. Although we did not perform a detailed assessment of the reliability of the data, we performed a minimal level of testing and found the data to be adequate for our purposes. The results of the audit apply only to the items selected and cannot be projected to the universe or population. 3 This included inconsistencies associated with the loan insurance status, borrower social security number, original loan amount, and FHA case number. 4 We examined loans with a termination date between March 15 and May 31, 2007. 8 We conducted our fieldwork from July 2007 through June 2008 at Doral’s offices in San Juan, Puerto Rico. Our audit period was from July 1, 2006 through June 30, 2007, but we expanded our audit period as needed to accomplish our objectives. We performed our review in accordance with generally accepted government auditing standards. 9 INTERNAL CONTROLS Internal control is an integral component of an organization’s management that provides reasonable assurance that the following objectives are being achieved: Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls relate to management’s plans, methods, and procedures used to meet its mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined the following internal controls were relevant to our audit objectives: Compliance with laws and regulations - Policies and procedures that management has implemented to reasonably ensure that resource use is consistent with laws and regulations. Validity and reliability of data - Policies and procedures that management has implemented to reasonably ensure that valid and reliable data are obtained, maintained, and fairly disclosed in reports. We assessed the relevant controls identified above. A significant weakness exists if management controls do not provide reasonable assurance that the process for planning, organizing, directing, and controlling program operations will meet the organization’s objectives. Significant Weaknesses Based on our review, we believe the following item is a significant weakness: Doral did not ensure that each loan in Ginnie Mae pools was insured or guaranteed by an agency of the federal government and that data on its pooled loans were accurate. 10 APPENDIXES Appendix A SCHEDULE OF QUESTIONED COSTS Recommendation number Ineligible 1/ 1A $291,094 _______ Total $291,094 1/ Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity that the auditor believes are not allowable by law; contract; or federal, state, or local policies or regulations. 11 Appendix B AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 12 Comment 2 Comment 3 13 14 OIG Evaluation of Auditee Comments Comment 1 Doral provided evidence that all five defective loans were removed from Ginnie Mae pools in August 2008. We consider recommendation 1A resolved. Comment 2 Doral stated that it corrected all the inconsistencies found. GNMA will need to assure that all discrepancies found were corrected. Comment 3 Doral indicated it had implemented certain management controls and procedures. GNMA will need to assure the controls and procedures are adequate to verify that all Ginnie Mae pooled loans are insured in accordance with Ginnie Mae requirements. 15
Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its Mortgage-Backed Securities Program
Published by the Department of Housing and Urban Development, Office of Inspector General on 2008-09-22.
Below is a raw (and likely hideous) rendition of the original report. (PDF)