Issue Date
September 22, 2008
Audit Report Number
2008-AT-1014
TO: Stephen L. Ledbetter, Acting Vice President - Mortgage-Backed Securities, TS
FROM: James D. McKay, Regional Inspector General for Audit, 4AGA
SUBJECT: Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its
Mortgage-Backed Securities Program
HIGHLIGHTS
What We Audited and Why
We reviewed Doral Bank Puerto Rico (Doral), an approved issuer for the
Government National Mortgage Association (Ginnie Mae). Our objective was to
determine whether Doral complied with Ginnie Mae requirements associated with
its mortgage-backed securities activities. The review was initiated in connection
with the 2007 Ginnie Mae financial statement audit.
What We Found
Doral did not fully comply with Ginnie Mae requirements, because it maintained
seven noninsured loans in Ginnie Mae pools. It also failed to ensure that data on
its pooled loans were accurate. As a result, Doral retained defective loans with
unpaid principal totaling $448,167 in its Ginnie Mae pools and reported
inaccurate information to Ginnie Mae and the U.S. Department of Housing and
Urban Development (HUD).
What We Recommend
We recommend that the Vice President of Mortgage-Backed Securities require
Doral to take corrective measures to ensure that the defective loans identified
during the review are reinsured or removed from the Ginnie Mae pools and that
the loans reflect complete and accurate mortgage information. We also
recommend that the Vice President of Mortgage-Backed Securities ensure that
Doral establishes and implements adequate controls and procedures to
periodically verify that all of its Ginnie Mae pooled loans are insured in
accordance with Ginnie Mae requirements.
For each recommendation in the body of the report without a management
decision, please respond and provide status reports in accordance with HUD
Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or
directives issued because of the audit.
Auditee’s Response
We discussed the finding with Doral and Ginnie Mae officials during the audit.
We provided a copy of the draft report to Doral on August 26, 2008, for its
comments and discussed the report with Doral officials at the exit conference on
August 29, 2008. Doral provided written comments on September 12, 2008 and
generally agreed with our findings. Doral’s response, along with our evaluation
of that response, can be found in appendix B of this report. Attachments to
Doral’s comments were not included in the report, but are available for review
upon request.
2
TABLE OF CONTENTS
Background and Objectives 4
Results of Audit
Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements 5
Scope and Methodology 8
Internal Controls 10
Appendixes
A. Schedule of Questioned Costs 11
B. Auditee Comments and OIG’s Evaluation 12
3
BACKGROUND AND OBJECTIVES
Doral Bank Puerto Rico (Doral) is a subsidiary of Doral Financial Corporation, organized in
1972 under the laws of the Commonwealth of Puerto Rico. It is an approved issuer for the
Government National Mortgage Association (Ginnie Mae) and an approved servicer under the
Mortgage-Backed Securities (Securities) program. Doral provides a full range of financial
services, including mortgage banking, with 41 branches throughout Puerto Rico. As of
December 2007, Doral was servicing more than 26,000 Federal Housing Administration (FHA)-
insured loans that are in Ginnie Mae pools, with original mortgage amounts totaling more than
$2 billion. Doral’s mortgage records are maintained at its main office in San Juan, Puerto Rico.
The objective of the review was to determine whether Doral complied with Ginnie Mae’s
Securities program requirements. The compliance requirements encompass the inclusion of only
insured loans in Ginnie Mae pools, the remittance of loan claims and/or payments to investors,
and the accuracy of pooled loans data.
4
RESULTS OF AUDIT
Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements
Doral did not follow Ginnie Mae requirements because it maintained seven noninsured loans in
Ginnie Mae pools. It also failed to ensure that data on its pooled loans were accurate. This
noncompliance occurred because Doral’s management did not implement effective controls to
make certain that mortgage information was complete and accurate. As a result, Doral retained
defective loans with unpaid principal totaling $448,167 in its Ginnie Mae pools and reported
incorrect and/or incomplete information to Ginnie Mae and the U.S. Department of Housing and
Urban Development (HUD).
Noninsured Loans in Ginnie
Mae Pools
The Securities program requires that each loan in Ginnie Mae pools be and
remain at all times insured or guaranteed by an agency of the federal government.
Loans that do not meet the requirement are defective and must be removed from
the Ginnie Mae pool. Of the more than 26,000 FHA loans that Doral has in
Ginnie Mae pools, seven had the insurance or guaranty withdrawn. The seven
loans were active in Ginnie Mae pools, but information in HUD’s system showed
that the loans were paid in full or refinanced.
Case Original Unpaid Insurance Termination
number loan amount principal termination date reason
XXXX680 $42,000 $31,474 Nov. 30, 1993* Paid in full
XXXX053 80,150 51,787 Dec. 1, 1997* Paid in full
XXXX539 69,750 58,889 Aug. 1, 1998* Paid in full
XXXX058 80,950 64,220 Jan. 20, 2000* Paid in full
XXXX950 99,900 84,724 Feb. 9, 2000* Paid in full
XXXX483 107,500 94,480 Apr. 8, 2004** Paid in full
XXXX341 67,294 62,593 June 25, 2004** Refinanced
Total $547,544 $448,167
*
Doral removed these loans from Ginnie Mae pools in August 2008.
**
HUD reinstated insurance in February 2008.
5
We examined Doral and custodian files, interviewed borrowers, and determined
that the information in HUD’s system was incorrect. The seven loans were active
and were not paid in full or refinanced. However, HUD’s system showed that the
FHA insurance for these loans was withdrawn between November 1993 and June
2004. As a result, Doral had defective loans in its Ginnie Mae pools.
Doral officials did not explain why the deficiencies occurred, other than that they
were associated with data entry errors. During the audit, Doral requested that
HUD reinstate FHA insurance on two of the loans and initiated procedures to
repurchase from Ginnie Mae pools the remaining five loans.1
Inaccurate Loan Information
We reviewed 60 sampled loans to verify the accuracy of the data on the loans.
We compared the information in Doral’s loan servicing files with data recorded in
HUD and Ginnie Mae systems. There were inconsistencies in 35 of the 60 loans.
These 35 loans contained the following inconsistencies:
Number of Percentage of
Type of inconsistency/error loans sample
Incorrect FHA case number 17 28
Incorrect borrower name 9 15
Incorrect loan status 7 12
Incorrect or missing Social Security number 4 7
Incorrect or incomplete address 4 7
Other (incorrect lender name, missing co- 4 7
borrower information, etc.)
Doral officials did not explain why the deficiencies occurred, other than that they
were associated with data entry errors. As a result, incorrect mortgage
information was reported to Ginnie Mae and HUD.
Conclusion
Doral maintained noninsured loans in its Ginnie Mae pools and reported
inaccurate information because it did not have effective controls in place. As a
result, Ginnie Mae does not have assurance that all pooled loans comply with
program requirements. Management must emphasize the importance of its
mortgage-backed securities activities and implement policies and procedures to
1
In February 2008, HUD reinstated the FHA insurance on the two loans and in August 2008, Doral removed the
remaining five loans from Ginnie Mae pools.
6
ensure that it complies with Ginnie Mae requirements and prevents future
instances of noncompliance.
Recommendations
We recommend that the Vice President of Mortgage-Backed Securities require
Doral to
1A. Take appropriate corrective measures to make certain that the remaining
five defective loans, with unpaid principal totalling $291,094, are reinsured
or removed from the Ginnie Mae pools.2
1B. Take appropriate corrective measures to ensure that loans in Ginnie Mae
pools reflect complete and accurate mortgage information.
1C. Establish and implement adequate management controls and procedures to
periodically verify that all of its Ginnie Mae pooled loans are insured in
accordance with Ginnie Mae requirements.
2
Of the seven defective loans, HUD reinstated the FHA insurance on two loans in February 2008 and Doral
removed five loans from the Ginnie Mae pools in August 2008.
7
SCOPE AND METHODOLOGY
To accomplish our objectives, we did the following:
Reviewed applicable laws, regulations, and other Ginnie Mae requirements.
Obtained an understanding of Doral’s management controls and procedures as they
related to our objectives.
Reviewed Doral’s latest audited financial statements and HUD and Ginnie Mae
monitoring reviews.
Interviewed Doral officials, a foreclosure attorney, and borrowers.
Reviewed Doral and custodian files and records.
Performed 29 site inspections of mortgaged properties to verify addresses and other
information on the borrowers.
We performed computer matching analyses between HUD and Ginnie Mae systems. From the
more than 26,000 FHA loans in Doral’s Ginnie Mae pools, we identified 22 loans that were
apparently terminated (i.e., potentially no longer HUD insured). However, these loans were
identified as active loans in Ginnie Mae pools. We reviewed all 22 loans to determine whether
there were non-insured loans in Ginnie Mae pools. We reviewed another 18 loans that reflected
inconsistencies with the mortgage information in HUD systems.3
HUD’s Single Family Data Warehouse system showed 608 loans serviced by Doral that were
terminated between January 2004 and May 2007 and were identified as active in Ginnie Mae
pools. We reviewed 20 of the 608 terminated loans4 to determine whether there were additional
non-insured loans in Ginnie Mae pools and whether payments were properly made to investors.
We determined that all 20 loans were terminated and that payments were made to investors.
We also verified the accuracy of the mortgage information for the 60 sampled loans. We
compared the information in Doral’s loan servicing files with data recorded in HUD and Ginnie
Mae systems.
We relied on computer-processed data contained in HUD’s Single Family Data Warehouse and
Neighborhood Watch as well as Ginnie Mae systems only to obtain loan information. Although
we did not perform a detailed assessment of the reliability of the data, we performed a minimal
level of testing and found the data to be adequate for our purposes. The results of the audit apply
only to the items selected and cannot be projected to the universe or population.
3
This included inconsistencies associated with the loan insurance status, borrower social security number, original
loan amount, and FHA case number.
4
We examined loans with a termination date between March 15 and May 31, 2007.
8
We conducted our fieldwork from July 2007 through June 2008 at Doral’s offices in San Juan,
Puerto Rico. Our audit period was from July 1, 2006 through June 30, 2007, but we expanded
our audit period as needed to accomplish our objectives. We performed our review in
accordance with generally accepted government auditing standards.
9
INTERNAL CONTROLS
Internal control is an integral component of an organization’s management that provides
reasonable assurance that the following objectives are being achieved:
Effectiveness and efficiency of operations,
Reliability of financial reporting, and
Compliance with applicable laws and regulations.
Internal controls relate to management’s plans, methods, and procedures used to meet its
mission, goals, and objectives. Internal controls include the processes and procedures for
planning, organizing, directing, and controlling program operations. They include the systems
for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined the following internal controls were relevant to our audit objectives:
Compliance with laws and regulations - Policies and procedures that
management has implemented to reasonably ensure that resource use is
consistent with laws and regulations.
Validity and reliability of data - Policies and procedures that management has
implemented to reasonably ensure that valid and reliable data are obtained,
maintained, and fairly disclosed in reports.
We assessed the relevant controls identified above.
A significant weakness exists if management controls do not provide reasonable
assurance that the process for planning, organizing, directing, and controlling
program operations will meet the organization’s objectives.
Significant Weaknesses
Based on our review, we believe the following item is a significant weakness:
Doral did not ensure that each loan in Ginnie Mae pools was insured or
guaranteed by an agency of the federal government and that data on its pooled
loans were accurate.
10
APPENDIXES
Appendix A
SCHEDULE OF QUESTIONED COSTS
Recommendation
number Ineligible 1/
1A $291,094
_______
Total $291,094
1/ Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity
that the auditor believes are not allowable by law; contract; or federal, state, or local
policies or regulations.
11
Appendix B
AUDITEE COMMENTS AND OIG’S EVALUATION
Ref to OIG Evaluation Auditee Comments
Comment 1
12
Comment 2
Comment 3
13
14
OIG Evaluation of Auditee Comments
Comment 1 Doral provided evidence that all five defective loans were removed from Ginnie Mae
pools in August 2008. We consider recommendation 1A resolved.
Comment 2 Doral stated that it corrected all the inconsistencies found. GNMA will need to
assure that all discrepancies found were corrected.
Comment 3 Doral indicated it had implemented certain management controls and procedures.
GNMA will need to assure the controls and procedures are adequate to verify that
all Ginnie Mae pooled loans are insured in accordance with Ginnie Mae
requirements.
15
Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its Mortgage-Backed Securities Program
Published by the Department of Housing and Urban Development, Office of Inspector General on 2008-09-22.
Below is a raw (and likely hideous) rendition of the original report. (PDF)