oversight

Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its Mortgage-Backed Securities Program

Published by the Department of Housing and Urban Development, Office of Inspector General on 2008-09-22.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                                 Issue Date
                                                                      September 22, 2008

                                                                 Audit Report Number
                                                                      2008-AT-1014




TO:         Stephen L. Ledbetter, Acting Vice President - Mortgage-Backed Securities, TS



FROM:       James D. McKay, Regional Inspector General for Audit, 4AGA

SUBJECT: Doral Bank, San Juan, Puerto Rico, Needs to Improve Controls over Its
          Mortgage-Backed Securities Program


                                   HIGHLIGHTS

 What We Audited and Why

             We reviewed Doral Bank Puerto Rico (Doral), an approved issuer for the
             Government National Mortgage Association (Ginnie Mae). Our objective was to
             determine whether Doral complied with Ginnie Mae requirements associated with
             its mortgage-backed securities activities. The review was initiated in connection
             with the 2007 Ginnie Mae financial statement audit.

 What We Found


             Doral did not fully comply with Ginnie Mae requirements, because it maintained
             seven noninsured loans in Ginnie Mae pools. It also failed to ensure that data on
             its pooled loans were accurate. As a result, Doral retained defective loans with
             unpaid principal totaling $448,167 in its Ginnie Mae pools and reported
             inaccurate information to Ginnie Mae and the U.S. Department of Housing and
             Urban Development (HUD).
What We Recommend


           We recommend that the Vice President of Mortgage-Backed Securities require
           Doral to take corrective measures to ensure that the defective loans identified
           during the review are reinsured or removed from the Ginnie Mae pools and that
           the loans reflect complete and accurate mortgage information. We also
           recommend that the Vice President of Mortgage-Backed Securities ensure that
           Doral establishes and implements adequate controls and procedures to
           periodically verify that all of its Ginnie Mae pooled loans are insured in
           accordance with Ginnie Mae requirements.

           For each recommendation in the body of the report without a management
           decision, please respond and provide status reports in accordance with HUD
           Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or
           directives issued because of the audit.


Auditee’s Response


           We discussed the finding with Doral and Ginnie Mae officials during the audit.
           We provided a copy of the draft report to Doral on August 26, 2008, for its
           comments and discussed the report with Doral officials at the exit conference on
           August 29, 2008. Doral provided written comments on September 12, 2008 and
           generally agreed with our findings. Doral’s response, along with our evaluation
           of that response, can be found in appendix B of this report. Attachments to
           Doral’s comments were not included in the report, but are available for review
           upon request.




                                           2
                           TABLE OF CONTENTS

Background and Objectives                                                4

Results of Audit
      Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements   5

Scope and Methodology                                                    8

Internal Controls                                                        10

Appendixes
   A. Schedule of Questioned Costs                                       11
   B. Auditee Comments and OIG’s Evaluation                              12




                                          3
                     BACKGROUND AND OBJECTIVES


Doral Bank Puerto Rico (Doral) is a subsidiary of Doral Financial Corporation, organized in
1972 under the laws of the Commonwealth of Puerto Rico. It is an approved issuer for the
Government National Mortgage Association (Ginnie Mae) and an approved servicer under the
Mortgage-Backed Securities (Securities) program. Doral provides a full range of financial
services, including mortgage banking, with 41 branches throughout Puerto Rico. As of
December 2007, Doral was servicing more than 26,000 Federal Housing Administration (FHA)-
insured loans that are in Ginnie Mae pools, with original mortgage amounts totaling more than
$2 billion. Doral’s mortgage records are maintained at its main office in San Juan, Puerto Rico.

The objective of the review was to determine whether Doral complied with Ginnie Mae’s
Securities program requirements. The compliance requirements encompass the inclusion of only
insured loans in Ginnie Mae pools, the remittance of loan claims and/or payments to investors,
and the accuracy of pooled loans data.




                                               4
                                  RESULTS OF AUDIT

Finding: Doral Did Not Fully Comply with Ginnie Mae Requirements
Doral did not follow Ginnie Mae requirements because it maintained seven noninsured loans in
Ginnie Mae pools. It also failed to ensure that data on its pooled loans were accurate. This
noncompliance occurred because Doral’s management did not implement effective controls to
make certain that mortgage information was complete and accurate. As a result, Doral retained
defective loans with unpaid principal totaling $448,167 in its Ginnie Mae pools and reported
incorrect and/or incomplete information to Ginnie Mae and the U.S. Department of Housing and
Urban Development (HUD).




 Noninsured Loans in Ginnie
 Mae Pools


                 The Securities program requires that each loan in Ginnie Mae pools be and
                 remain at all times insured or guaranteed by an agency of the federal government.
                 Loans that do not meet the requirement are defective and must be removed from
                 the Ginnie Mae pool. Of the more than 26,000 FHA loans that Doral has in
                 Ginnie Mae pools, seven had the insurance or guaranty withdrawn. The seven
                 loans were active in Ginnie Mae pools, but information in HUD’s system showed
                 that the loans were paid in full or refinanced.

                  Case        Original        Unpaid          Insurance       Termination
                 number     loan amount      principal     termination date     reason
                XXXX680         $42,000        $31,474      Nov. 30, 1993*    Paid in full
                XXXX053          80,150         51,787      Dec. 1, 1997*     Paid in full
                XXXX539          69,750         58,889      Aug. 1, 1998*     Paid in full
                XXXX058          80,950         64,220      Jan. 20, 2000*    Paid in full
                XXXX950          99,900         84,724      Feb. 9, 2000*     Paid in full
                XXXX483         107,500         94,480      Apr. 8, 2004**    Paid in full
                XXXX341          67,294         62,593      June 25, 2004**   Refinanced
                  Total       $547,544        $448,167
            *
                 Doral removed these loans from Ginnie Mae pools in August 2008.
            **
                 HUD reinstated insurance in February 2008.




                                                 5
                 We examined Doral and custodian files, interviewed borrowers, and determined
                 that the information in HUD’s system was incorrect. The seven loans were active
                 and were not paid in full or refinanced. However, HUD’s system showed that the
                 FHA insurance for these loans was withdrawn between November 1993 and June
                 2004. As a result, Doral had defective loans in its Ginnie Mae pools.

                 Doral officials did not explain why the deficiencies occurred, other than that they
                 were associated with data entry errors. During the audit, Doral requested that
                 HUD reinstate FHA insurance on two of the loans and initiated procedures to
                 repurchase from Ginnie Mae pools the remaining five loans.1

    Inaccurate Loan Information



                 We reviewed 60 sampled loans to verify the accuracy of the data on the loans.
                 We compared the information in Doral’s loan servicing files with data recorded in
                 HUD and Ginnie Mae systems. There were inconsistencies in 35 of the 60 loans.
                 These 35 loans contained the following inconsistencies:

                                                                            Number of        Percentage of
                             Type of inconsistency/error                      loans             sample
                    Incorrect FHA case number                                   17                28
                    Incorrect borrower name                                      9                15
                    Incorrect loan status                                        7                12
                    Incorrect or missing Social Security number                  4                 7
                    Incorrect or incomplete address                              4                 7
                    Other (incorrect lender name, missing co-                    4                 7
                    borrower information, etc.)

                 Doral officials did not explain why the deficiencies occurred, other than that they
                 were associated with data entry errors. As a result, incorrect mortgage
                 information was reported to Ginnie Mae and HUD.


    Conclusion


                 Doral maintained noninsured loans in its Ginnie Mae pools and reported
                 inaccurate information because it did not have effective controls in place. As a
                 result, Ginnie Mae does not have assurance that all pooled loans comply with
                 program requirements. Management must emphasize the importance of its
                 mortgage-backed securities activities and implement policies and procedures to

1
  In February 2008, HUD reinstated the FHA insurance on the two loans and in August 2008, Doral removed the
remaining five loans from Ginnie Mae pools.

                                                      6
                 ensure that it complies with Ginnie Mae requirements and prevents future
                 instances of noncompliance.

    Recommendations

                 We recommend that the Vice President of Mortgage-Backed Securities require
                 Doral to

                 1A. Take appropriate corrective measures to make certain that the remaining
                     five defective loans, with unpaid principal totalling $291,094, are reinsured
                     or removed from the Ginnie Mae pools.2

                 1B. Take appropriate corrective measures to ensure that loans in Ginnie Mae
                     pools reflect complete and accurate mortgage information.

                 1C. Establish and implement adequate management controls and procedures to
                     periodically verify that all of its Ginnie Mae pooled loans are insured in
                     accordance with Ginnie Mae requirements.




2
  Of the seven defective loans, HUD reinstated the FHA insurance on two loans in February 2008 and Doral
removed five loans from the Ginnie Mae pools in August 2008.

                                                       7
                              SCOPE AND METHODOLOGY

To accomplish our objectives, we did the following:

             Reviewed applicable laws, regulations, and other Ginnie Mae requirements.

             Obtained an understanding of Doral’s management controls and procedures as they
             related to our objectives.

             Reviewed Doral’s latest audited financial statements and HUD and Ginnie Mae
             monitoring reviews.

             Interviewed Doral officials, a foreclosure attorney, and borrowers.

             Reviewed Doral and custodian files and records.

             Performed 29 site inspections of mortgaged properties to verify addresses and other
             information on the borrowers.

We performed computer matching analyses between HUD and Ginnie Mae systems. From the
more than 26,000 FHA loans in Doral’s Ginnie Mae pools, we identified 22 loans that were
apparently terminated (i.e., potentially no longer HUD insured). However, these loans were
identified as active loans in Ginnie Mae pools. We reviewed all 22 loans to determine whether
there were non-insured loans in Ginnie Mae pools. We reviewed another 18 loans that reflected
inconsistencies with the mortgage information in HUD systems.3

HUD’s Single Family Data Warehouse system showed 608 loans serviced by Doral that were
terminated between January 2004 and May 2007 and were identified as active in Ginnie Mae
pools. We reviewed 20 of the 608 terminated loans4 to determine whether there were additional
non-insured loans in Ginnie Mae pools and whether payments were properly made to investors.
We determined that all 20 loans were terminated and that payments were made to investors.

We also verified the accuracy of the mortgage information for the 60 sampled loans. We
compared the information in Doral’s loan servicing files with data recorded in HUD and Ginnie
Mae systems.

We relied on computer-processed data contained in HUD’s Single Family Data Warehouse and
Neighborhood Watch as well as Ginnie Mae systems only to obtain loan information. Although
we did not perform a detailed assessment of the reliability of the data, we performed a minimal
level of testing and found the data to be adequate for our purposes. The results of the audit apply
only to the items selected and cannot be projected to the universe or population.

3
  This included inconsistencies associated with the loan insurance status, borrower social security number, original
loan amount, and FHA case number.
4
  We examined loans with a termination date between March 15 and May 31, 2007.

                                                          8
We conducted our fieldwork from July 2007 through June 2008 at Doral’s offices in San Juan,
Puerto Rico. Our audit period was from July 1, 2006 through June 30, 2007, but we expanded
our audit period as needed to accomplish our objectives. We performed our review in
accordance with generally accepted government auditing standards.




                                              9
                             INTERNAL CONTROLS

Internal control is an integral component of an organization’s management that provides
reasonable assurance that the following objectives are being achieved:

       Effectiveness and efficiency of operations,
       Reliability of financial reporting, and
       Compliance with applicable laws and regulations.

Internal controls relate to management’s plans, methods, and procedures used to meet its
mission, goals, and objectives. Internal controls include the processes and procedures for
planning, organizing, directing, and controlling program operations. They include the systems
for measuring, reporting, and monitoring program performance.



 Relevant Internal Controls
              We determined the following internal controls were relevant to our audit objectives:

                  Compliance with laws and regulations - Policies and procedures that
                  management has implemented to reasonably ensure that resource use is
                  consistent with laws and regulations.

                  Validity and reliability of data - Policies and procedures that management has
                  implemented to reasonably ensure that valid and reliable data are obtained,
                  maintained, and fairly disclosed in reports.

              We assessed the relevant controls identified above.

              A significant weakness exists if management controls do not provide reasonable
              assurance that the process for planning, organizing, directing, and controlling
              program operations will meet the organization’s objectives.


 Significant Weaknesses


              Based on our review, we believe the following item is a significant weakness:

                  Doral did not ensure that each loan in Ginnie Mae pools was insured or
                  guaranteed by an agency of the federal government and that data on its pooled
                  loans were accurate.



                                               10
                                  APPENDIXES

Appendix A

                SCHEDULE OF QUESTIONED COSTS

                          Recommendation
                              number             Ineligible 1/

                                 1A                  $291,094
                                                      _______

                                Total                $291,094


1/   Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity
     that the auditor believes are not allowable by law; contract; or federal, state, or local
     policies or regulations.




                                            11
Appendix B

        AUDITEE COMMENTS AND OIG’S EVALUATION


Ref to OIG Evaluation   Auditee Comments




Comment 1




                         12
Comment 2




Comment 3




            13
14
                         OIG Evaluation of Auditee Comments

Comment 1   Doral provided evidence that all five defective loans were removed from Ginnie Mae
            pools in August 2008. We consider recommendation 1A resolved.

Comment 2   Doral stated that it corrected all the inconsistencies found. GNMA will need to
            assure that all discrepancies found were corrected.

Comment 3   Doral indicated it had implemented certain management controls and procedures.
            GNMA will need to assure the controls and procedures are adequate to verify that
            all Ginnie Mae pooled loans are insured in accordance with Ginnie Mae
            requirements.




                                            15