Issue Date September 30, 2009 Audit Report Number 2009-SE-0004 TO: Phillip A. Murray, Deputy Assistant Secretary for Single Family Housing, HU FROM: Joan S. Hobbs, Regional Inspector General for Audit, Region X, 0AGA SUBJECT: Controls over FHA‟s Single-Family Lender Approval Process Need Improvement HIGHLIGHTS What We Audited and Why In response to a congressional request, we audited the Federal Housing Administration (FHA) Title II single-family lender approval process. We wanted to know whether the application process provided effective controls and procedures to ensure approval of only those lenders that complied with U.S. Department of Housing and Urban Development (HUD) requirements. We also determined whether FHA collected application fees, accounted for files that were electronically imaged, and planned to include new information becoming available under the Secure and Fair Enforcement (S.A.F.E.) Mortgage Licensing Act in the approval process. What We Found FHA‟s lender approval process did not have sufficient controls and procedures to ensure that lenders met all applicable requirements for approval to participate in the FHA single- family program. In addition, FHA did not obtain or consider negative information on lenders from other HUD offices, ensure that application fees were collected, ensure that all supporting documents were obtained, or include adequate certifications on the lender application form. Further, FHA‟s controls over the contractor tasked with imaging lender approval files did not ensure the proper disposition of those files, which contained personally identifiable information. In fiscal year 2008, the number of Title II lender applications approved by FHA totaled 3,297, more than triple the number of applications approved in 2007. FHA officials told us that staffing levels had been near constant since 2005 and that the large increase in applications strained FHA‟s ability to review the applications. FHA believed that additional resources for staff and systems would enhance their ability to review lender applications. FHA officials also stated that they would review available information to ensure that lender principals complied with the S.A.F.E Mortgage Licensing Act of 2008. What We Recommend We recommend that FHA ensure that lender principals and staff are free of indictment, conviction, debarment, suspension, limited denials of participation, and unpaid federal debt before applications are approved. FHA should also consult with other HUD offices to determine whether applicants are subject to unresolved findings and ensure that application fees received are reconciled with the related applications. We also recommend that FHA include a stronger lender fraud certification on the application, and improve controls over the maintenance and disposition of electronic lender files. For each recommendation without a management decision, please respond and provide status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or directives issued because of the audit. Auditee’s Response We issued the draft report to the Deputy Assistant Secretary for Single Family Housing on September 9, 2009, and held an exit conference on September 16, 2009. The Deputy Assistant Secretary generally agreed with most of the content of the report and the recommendations. The complete text of the auditee‟s response, along with our evaluation of that response, can be found in appendix A of this report. 2 TABLE OF CONTENTS Background and Objective 4 Results of Audit Finding 1: FHA‟s Lender Approval Process Did Not Ensure That Only Eligible 6 Applicants Were Approved Finding 2: FHA‟s Lender Application Did Not Contain Adequate Certifications 12 Finding 3: FHA Did Not Ensure the Proper Handling and Storage of Approved 16 Lender Files Scope and Methodology 19 Internal Controls 21 Appendices A. Auditee Comments and OIG‟s Evaluation 23 3 BACKGROUND AND OBJECTIVE The Federal Housing Administration‟s (FHA) mortgage insurance programs help low- and moderate-income families become homeowners by lowering some of the costs of their mortgage loans. FHA mortgage insurance also encourages lenders to make loans to otherwise creditworthy borrowers that might not be able to meet conventional underwriting requirements by protecting the lender against default. Title II of the National Housing Act, Section 203(b) is the centerpiece of FHA‟s single-family mortgage insurance programs—the successor of the program that helped save homeowners from default in the 1930s, that helped open the suburbs for returning veterans in the 1940s and 1950s, and that helped shape the modern mortgage finance system. Today, FHA‟s One- to Four-Family Mortgage Insurance Program is still an important tool through which the federal government expands homeownership opportunities for first-time home buyers and other borrowers who would not otherwise qualify for conventional mortgages on affordable terms, as well as for those who live in underserved areas where mortgages may be harder to get. These obligations are protected by FHA‟s Mutual Mortgage Insurance Fund, which is sustained entirely by borrower insurance premiums. The Helping Families Save Their Homes Act of 2009 was enacted on May 20, 2009 and includes additional standards that an applicant for participation in the FHA single-family program must meet. The standards require that the lenders and their officers, partners, directors, principal managers, supervisors, loan processors, loan underwriters, and loan originators, have an acceptable background check. The Act‟s standards also make it clear that an applicant must comply with the Secure and Fair Enforcement (S.A.F.E.) Mortgage Licensing Act of 2008, which requires state licensing of loan originators and a nationwide database containing loan originator licensing and sanction information. The S.A.F.E. Mortgage Licensing Act of 2008 was a component of the Housing and Economic Recovery Act (HERA) of 2008 signed into law on July 30, 2008. The S.A.F.E. Mortgage Licensing Act component was designed to enhance consumer protection and reduce fraud by encouraging states to establish minimum standards for the licensing and registration of state- licensed mortgage loan originators and establishment and maintenance of a nationwide mortgage licensing system and registry. HUD is required to determine whether lenders are qualified before allowing them to participate in the FHA program. To that end, FHA established an application process administered by FHA‟s Office of Lender Approval and Recertification Division. That process requires the lender to submit a paper application form with supporting documentation. The application process is designed to allow FHA to approve lenders that meet a number of qualification requirements, possess experience in loan origination, and are responsible industry members. The number of lenders applying to participate in the FHA program has greatly increased in the last two years. This increase can be attributed to the turmoil in the financial industry and 4 reduced availability of conventional credit. The following chart shows the changes in the number of lender approvals for FHA participation between 2004 and 2009. Title II lender approvals 3,500 3,000 A p 2,500 p r 2,000 o v 1,500 a 1,000 l s 500 0 2004 2005 2006 2007 2008 First half of 2009 Fiscal year Congressional concerns brought about in part by media coverage has raised concerns that former subprime lenders and brokers are obtaining approval to participate in the FHA program and that they will be responsible for FHA insurance of loans to people unlikely to make their payments. Our audit objective was to determine whether the application process for Title II provided effective controls to ensure approval of only those lenders that complied with FHA requirements, applicants paid the application fee, and all files sent for imaging were accounted for and available. We also wanted to determine whether FHA planned to include new information becoming available under the S.A.F.E. Mortgage Licensing Act in the lender approval process. 5 RESULTS OF AUDIT Finding 1: FHA‟s Lender Approval Process Did Not Ensure That Only Eligible Applicants Were Approved FHA‟s lender application process was not adequate to ensure that all of its lender approval requirements were met. This condition occurred because FHA control procedures had not been enhanced and automated to handle the recent large increase in the number of lenders applying for the FHA program. As a result, FHA lacked assurance that lenders approved to participate in FHA‟s Title II single-family program met all of the requirements and were eligible. Office of Lender Approval and Recertification Division officials told us that they were working on automating the application process and obtaining needed information on lender official backgrounds. Lender Approval Process Did Not Fully Address Lender Eligibility Requirements The regulations for the program at 24 CFR (Code of Federal Regulations) 202.5(j) provide that a lender is ineligible if its principals or any staff members are (1) suspended, debarred, or otherwise restricted under HUD regulations or similar procedures of any other federal agency and (2) indicted for or have been convicted of any offense which reflects upon the responsibility, integrity, or ability of the lender to participate in the program. However, FHA‟s lender approval process did not fully address these requirements. The application requires the lender to use check boxes to answer the following questions: “Is the applicant or any of its principals, officers, individuals serving on its Board of Directors, individuals acting as authorized signatories, or employees currently involved in a proceeding or subject to an investigation that could result, or has resulted, in suspension, fine, or disbarment by a Federal, State, or local government agency, conviction in a criminal matter, bankruptcy or denial of fidelity insurance or mortgagee‟s errors and omissions insurance coverage?” “Has the applicant or any of its principals, officers, individuals serving on the Board of Directors, or individuals acting as authorized signatories, ever been, or are any presently suspended, terminated, debarred, sanctioned, fined, convicted, denied approval, or refused a license by any Federal, State, or local government agency, or a government-related entity, where the action is related to the responsibilities that are commensurate with those of the financial services industry?” 6 However, the completion of the checked boxes did not address lender staff as required because FHA‟s application process did not require lenders to clearly certify that principals and staff were not subject to one of the listed actions, nor did it include a check to ensure that none existed for staff. FHA does not have access to the Justice Department‟s National Crime Information Center to verify the criminal record of lender officials. FHA officials told us that the review of a lenders criminal background information is impractical unless a single source could be used. During later discussions, they told us that they were contracting for criminal background information from a private industry provider. They stated the information would be used to supplement the other background checks done. The lender application files show those checks include reviews for debarments, suspensions, limited denials of participation, and ChoicePoint reports1. Additionally, they told us that the requirement was considered to have been met by the application question on indictments and convictions and FHA certification of the application. In their comments on the draft report FHA officials told us that they had revised the certification on the application to include lender employees. In addition to the FHA‟s efforts to obtain criminal background information, FHA officials told us that they would use information from the nationwide loan originator licensing database established by the S.A.F.E Mortgage Licensing Act of 2008. That Act provides that a license cannot be issued to an applicant convicted of or who pled guilty or nolo contendere to a felony within the past seven years or at any time if it involved a felony related to fraud, dishonesty, breach of trust, or money laundering. It also provides for access to the needed criminal background information. For applicants licensed as loan originators, use of this information should complement any background check performed by FHA. Other HUD Offices Were Not Queried about Unresolved Findings The regulations for the program at 24 CFR 202.5(j)(3) provide that a lender is ineligible if it, its principals, or any staff members are subject to unresolved findings as a result of HUD or other governmental audits or investigations. Officials at FHA‟s Lender Approval and Recertification Division told us that they review information from the Homeownership Centers on unresolved findings but did not request such information from other HUD offices. We confirmed that information on unresolved findings was not requested from three other HUD offices with roles that included monitoring of lenders. Those offices were the Office of RESPA (Real Estate Settlement Procedures Act) and Interstate Land Sales, Office of Fair Housing and Equal Opportunity, and Office of 1 FHA uses the LexisNexis service ChoicePoint‟s Mortgage Asset Research Institute tools to check participant backgrounds. The service can verify licensing and discover adverse activity, public disciplinary and other derogatory information about professionals. 7 Inspector General. Our review of 22 approved lender applications disclosed no checks with the three other HUD offices to determine whether there were unresolved findings. We checked for unresolved findings by the three other HUD offices related to the lenders included in our review and noted that there were none. Nevertheless, FHA lacked assurance that lenders met all eligibility requirements in the absence of the results from checks with other HUD offices to determine whether there were unresolved findings. FHA officials told us that they interpreted the requirement to check for unresolved findings as applicable to FHA activities. They noted that there was no central HUD database containing information on unresolved findings. In the absence of such a database they considered making checks for unresolved findings unreasonable and incompatible with the timely review of lender applications. Documents Were Missing from Lender Application Files HUD Handbook 4060.1, REV-2, paragraph 3-2, specifies the contents of the application for lender approval. Our review of 22 approved lender applications showed that only one of the lender approval files contained all required supporting documentation. The remaining files were missing from one to five required documents. As a result, FHA lacked assurance that the lenders met all eligibility requirements. Our review of 22 approved lender application files showed that 14 applications were missing the photographs showing that the facilities met FHA requirements, Seven applications were missing the required documentation for the payment of the application fee, Six applications were missing the required FHA certification, Three applications were missing the required checks of principal background information, Three applications were missing the required audited schedule of net worth showing that FHA requirements were met, Three applications were missing the required resumes for principals, Two applications were missing the required certification that neither the lender, officers, directors, nor principals had been denied a license or were otherwise sanctioned, Two applications were missing required credit reports for principals and/or the lender, One application was missing the required current financial statements, and One application was missing required information on the business organization. FHA officials told us that the lack of resources to respond to the large increase in application volume impacted the quality of their lender application reviews. They also noted that the former imaging contractor was unacceptable. For the most frequent 8 missing item, photographs, we were told that initially photographs were not sent to the imaging contractor because it was not believed that the contractor would image photographs. Controls Did Not Ensure Receipt of Application Fees The regulations for the program at 24 CFR 202.5(i) provide that a lender must pay an application fee. Paragraph 2-7 of HUD Handbook 4060.1, REV-2, requires the lender to send the actual payment check and HUD form for application fee to the HUD lockbox with copies to be submitted with the application. FHA did not reconcile the applications received with the actual funds received at the HUD lockbox. Thus, FHA lacked assurance that all application fees were received at the HUD lockbox and deposited into HUD accounts. FHA officials told us that fees collected from lenders were reconciled to the applications received. They also stated that the Single Family Accounting Branch reconciled the fees collected with the transaction detail ledger. However, the director of the Single Family Accounting Branch told us that (1) it only reconciled the amount the lockbox electronically credited to HUD‟s account to the supporting documentation provided by the lockbox and (2) it did not reconcile collections to the applications received by FHA. Further, FHA officials told us that they would be changing the payment process. They told us the lockbox arrangement is ending, and the U.S. Treasury‟s Pay.Gov Web site will be used to collect lender application fees once an agreement is executed. Pay.Gov allows users to pay fees on line by way of credit card or bank account debit. FHA officials told us the conversion to Pay.Gov will ensure that collections are reconciled to applications. They also told us that FHA can receive daily electronic reports from Pay.Gov which will be used to reconcile the receipt of the application fee prior to approval of a lender. The Large Increase in Application Volume Strained FHA Resources FHA officials told us that the large increase in applications strained FHA‟s ability to review the applications and noted that additional resources for staff and systems would enhance their ability to review lender applications. In fiscal year 2008, the number of Title II lender applications approved by FHA totaled 3,297, more than triple the number of applications approved in 2007, and the average time to complete application reviews increased 17 percent. Further, the percentage of total applications receiving approval, including those that were incomplete, resubmitted, and appealed, went from 77 percent in 2007 to 71 percent in 2008. FHA officials advised that they hired additional staff, and are working to improve and modernize their information technology resources in response to the increase in 9 applications. This included having a contractor develop an online application process and getting it approved for installation. A review of the future online application process was not included within the scope in our review. Questionable Lenders Were Approved for the FHA Program On November 19, 2008, Business Week magazine reported that First Magnus, an FHA- approved lender, was cited by state and federal regulators for misleading borrowers, using unlicensed brokers, and other infractions. The article stated that First Magnus was “…shut down last summer [2007] and laid off its 5,500 employees. But in May [2008], the FHA issued a group of former First Magnus executives a new license to make taxpayer-insured home loans. They have opened a company called StoneWater Mortgage in the same office building that First Magnus had occupied.” Our prior audits2 of First Magnus disclosed a number of serious violations of the Real Estate Settlement Procedures Act (RESPA) such as paying marketing fees, non-competition fees and quality incentives to real estate companies in exchange for more than $157 million in FHA mortgage business. The lender also disregarded HUD requirements when it originated and processed FHA-insured loans, exposing FHA to unnecessary risks. We reviewed the application for StoneWater mortgage to determine whether FHA followed its rules in approving the application. Although the principals of StoneWater identified themselves as having prior employment with First Magnus, FHA had no records showing that these same individuals violated its requirements while employed at First Magnus. Further, our audits of First Magnus and two referrals to the Office of RESPA and Interstate Land Sales did not explicitly show that the StoneWater principals shown on the application had any involvement with the findings presented. FHA was bound by the rules in place at the time and concluded that it had no legal basis for denying the StoneWater application. In this regard, FHA lacked records of administrative actions or sanctions against these individuals. In processing the StoneWater application, the FHA Office of Lender Approval followed the control procedures for lender approval with the exception of documentation that the fee was paid, computation of adjusted net worth, and photographs of the facilities. In another situation, in July 2008, FHA denied the application of a mortgage company because the company‟s vice president was associated with a formerly approved mortgage company that was removed by the Mortgagee Review Board in 2005 for program violations. The denial letter stated that the formerly approved company still owed HUD about $237,440 for indemnification agreements3. Although the name of the new company was different, the new company‟s address was the same as the address of the formerly approved mortgage company. 2 Audit report 2006-LA-1018 issued July 26, 2006 and audit report 2007-LA-1002 issued December 12, 2006. 3 HUD Handbook 4155.2 paragraph 9.D.4.c describes single-family indemnification agreements as a lender and HUD‟s agreement that the lender will abstain from filing an insurance claim or reimburse FHA if a subsequent holder of the mortgage files and insurance claim and FHA suffers a financial loss. 10 The application was appealed by the former owner‟s son as president of the new company. In his appeal, the son stated that he understood HUD had problems with his father but he will not be involved in any aspect of the business and is not an officer or employee of the new company. The appeal also stated that his father had been removed as the broker of record for the new company. After further review, the new company‟s reapplication was approved after the normal review of the principals shown on the application did not disclose any records of administrative sanctions against these individuals. Conclusion The current economic crisis was due, in part, to the collapse of the mortgage industry. The mortgage industry failed because loose underwriting standards led to lenders making mortgage loans available to those that could not afford to make the monthly payments. With the collapse came a decreased availability of funds for uninsured mortgages and a substantial increase in the number of lenders applying for admission into the FHA single- family insurance program. Some of these applicants may have officers and staff that were involved with questionable loan origination and underwriting practices in the past. FHA needs to implement the Helping Families Save Their Homes Act of 2009 which was enacted on May 20, 2009 and includes additional standards that an applicant for participation in the FHA single-family program must meet. Recommendations We recommend that FHA‟s Lender Approval and Recertification Division ensure that: 1A. Lender principals and staff are free of indictment, conviction, debarment, suspension, limited denials of participation, and unpaid federal debt by (1) obtaining a clear certification from the lender, (2) performing background checks, or (3) obtaining a combination of certifications and background checks. 1B. The development of a database containing information on unresolved findings from other HUD offices is included in FHA information technology initiatives and that it is used when evaluating applicants. 1C. All documents required to support the application are received and reviewed before lender approval, and then maintained in the application file. 1D. Application fees received are reconciled with the applications received. 11 We further recommend that FHA‟s Office of Lender Activities and Program Compliance: 1E. Ensure the risk factors considered when developing the annual lender monitoring plan continue to include lenders with principals formerly associated with a sanctioned lender. 12 Finding 2: FHA‟s Lender Application Did Not Contain Adequate Certifications FHA‟s lender application process did not require the lender to certify that the information provided was complete and accurate or advise the lender of potential penalties for submitting false information. As a result, FHA had not established the lender certification as a reasonable deterrent to preclude unqualified lenders from improperly gaining approval to participate in the program. This condition occurred because FHA officials believed that the process provided adequate assurance that lenders were eligible to participate in the program. The Lender Application Did Not Address All Lender Approval Requirements The regulations at 24 CFR Part 202 and HUD Handbook 4060.1, REV-2, detail the requirements that lenders must meet for approval to participate in the program and provide that FHA will make a determination on eligibility based on the lender‟s application. However, the application and supporting documentation requiring certification did not require that the lender certify that the information was complete and accurate, nor did it address all requirements. Further, the FHA lender application process did not verify all of the information provided or include checking requirements that were not addressed in the application, such as the background of lender staff (see finding 1). The application required the applicant to complete the following certification: “I certify that I am authorized to execute this application on behalf of the applicant.” Additionally, the supporting documentation required for the application included requirements that: A state-licensed lender must also submit a letter certifying to HUD that it has not been refused a license or sanctioned. Unaudited financial statements required to update audited financial statements more than 6 but less that 12 months old must be certified by management. If applicable, a nonsupervised lender or loan correspondent must certify that its state does not require that mortgage lenders be licensed. The applicant must submit a certification, signed by a senior officer, that the facilities comply with FHA requirements. The applicant must certify that neither it nor any of its officers, directors, or principals have been denied an operating license or otherwise sanctioned by any licensing or regulatory body. 13 The Certifications Did Not Warn Applicants of Potential False Certification Penalties None of the lender application certifications stated that the information was complete and accurate, nor did they put the applicant on notice of potential penalties such as fines or imprisonment. The absence of these fraud elements weakened the certifications and was striking since Ginnie Mae uses the same form, which, in a different section, requires issuers of Ginnie Mae securities to make the following additional certification: “I certify that all of the information I have provided on this form and in any accompanying documentation is true and accurate to the best of my knowledge and belief. I understand that if I knowingly have made any false, fictitious, or fraudulent statement, representation, or certification on this form or on any accompanying documents, I may be subject to civil and criminal penalties, including fines and/or imprisonment, under applicable federal law, including but not limited to 18 U.S.C. [United States Code] §1001, 1010, and 1012, and 31 U.S.C. §3729 and 3802.” When asked about the differences in FHA and Ginnie Mae certification requirements, FHA officials told us that they required a sanction letter that was not required by Ginnie Mae. Additionally, they stated that they were developing a form that would not be shared with Ginnie Mae and a new online application process. Review of the new form submitted to the Office of Management and Budget for clearance showed that it had a certification similar to the existing form without certification that information is complete and accurate. Also, it did not include notice of potential penalties. In their comments on the draft report FHA officials told us that they had revised the the certification on the application. Also, during discussions they noted that they had not had problems with enforcement. Conclusion FHA should use all reasonable means to ensure that the information presented in a lender‟s application to the FHA program is true and accurate. Requiring a lender to certify to the truth and accuracy of the information on the application and informing the lender of the consequences of false certification would provide an additional safeguard against ineligible participants. 14 Recommendation We recommend that FHA‟s Lender Approval and Recertification Division: 2A. Include a certification on the application similar to Ginnie Mae‟s certification that makes it clear to the applicant that the information it provides is to be complete, accurate, and true with potential penalties for knowingly providing information not meeting those standards. 15 Finding 3: FHA Did Not Ensure the Proper Handling and Storage of Approved Lender Files FHA lacked sufficient oversight of the contractor tasked to scan, store electronic images of, and destroy lender applications. Its monitoring of the contractor‟s performance did not ensure the proper disposition of lender application files after they were scanned. Further, FHA did not ensure that the electronic images of the lender applications were retrievable. As a result, it could not fully account for lender application files containing personally identifiable information and was not always able to make the files available for review. According to FHA officials, this condition was due to a lack of sufficient resources to monitor contractor performance. FHA Contracted with an Outside Firm to Scan and Dispose of Lender Applications In 2006, FHA contracted with an outside firm to scan, electronically store, and shred approved lender application files. These files contained personally identifiable information, such as Social Security numbers of the officers and owners of the lenders applying for approval to originate FHA loans.4 According to 5 U.S.C. 552a, government agencies are responsible for establishing safeguards to ensure the security and confidentiality of records containing personally identifiable information. Therefore, the contract required the contractor to keep the files confidential and provide FHA with certificates of destruction for files destroyed after imaging. During the course of the contract, FHA sent approved lender applications to the contractor in numbered boxes. After scanning the lender applications, the contractor was required to shred them and provide FHA with certificates of destruction covering each lender file. However, FHA could not provide the certificates of destruction or other documentation regarding the disposition of 24 boxes of lender application files and other documents sent for imaging. Although the contractor had no original certificates of destruction for the 24 boxes, its project manager stated that the contents of 17 of the boxes were shredded and seven boxes that were not shredded were returned to FHA. The contractor was unable to provide a receipt for the return of the seven boxes, and FHA staff could not locate the boxes or recall the delivery of the boxes. The 24 boxes were not properly accounted for because FHA lacked sufficient control over the inventory of the approved lender applications. According to FHA, “…the 4 The term “personally identifiable information” refers to information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother‟s maiden name, etc. 16 Lender Approval and Recertification Division opted to maximize its limited resources by ensuring that the documents being transferred to the contractor to be imaged were logged and acknowledged by the contractor as being „accepted for imaging‟ versus using limited staff to reconcile such files to the contractors‟ requests for authorization to destroy files.” FHA Could Not Always Retrieve Electronic Lender Files The contract for imaging the lender application files required the contractor to make the scanned images accessible, retrievable, and printable via the Internet. After the contract ended on September 30, 2008, the two database servers, one primary and one backup, used by the contractor to store the application file images were returned to FHA, and FHA no longer had Internet access to the images. We asked FHA for 36 lender applications, but it was only able to retrieve 31 of the files. FHA officials stated that the missing files were unavailable in hard copy and could not be retrieved from the server. Conclusion Appendix 27 of HUD Handbook 2225.6 states that the lender files of those approved to make insured loans must be retained until approval is withdrawn or terminated. FHA did not have a process in place to ensure that lender application files were available when needed for review. FHA officials told us that they had limited resources and did not ensure that all lender files stored on the servers could be retrieved. Access to the lender application files is essential since these files contain information on lenders that is useful for audits and investigations of lender activities and for FHA‟s lender monitoring and annual lender recertification. Since these applications contain personally identifiable information, FHA must take precautions to ensure the confidentiality of the applications. Recommendations We recommend that FHA‟s Lender Approval and Recertification Division: 3A. Determine the disposition of all lender files provided to the imaging contractor. If lender file disposition is indeterminable, FHA should notify the applicable lenders of the loss of their information and obtain new files from those lenders. 3B. Develop a plan and request resources to automate the application process to retain a record of the application electronically, including supplemental information, and ensure accessibility. 17 3C. Implement monitoring controls over future imaging contracts to ensure that contract performance is adequate and ensures personally identifiable information is safeguarded. 18 SCOPE AND METHODOLOGY We performed an audit of the FHA single-family lender approval process in response to a congressional request. Our audit covered applications received during the period January 1, 2006, through March 27, 2009 with one exception for an application received on March 19, 2002 from a lender included in the congressional request. We conducted our fieldwork at FHA‟s Lender Approval and Recertification Division in Washington, D.C. between January and August 2009. To accomplish our objectives, we interviewed staff and obtained an understanding of the lender application review process and procedures, reviewed a sample of available lender applications and supporting documentation, analyzed data gathered from an imaging contractor and HUD staff, and considered the impact of new legislation addressing lender eligibility for FHA program participation. We randomly selected 20 of the 36 lender applications reviewed. The remaining 16 applications selected included five of nine from the congressional request, one from a media article similar to the basis for the congressional request, nine recent approvals with the highest default rates identified by HUD‟s Neighborhood Watch system5, and one included in a confidential complaint received by the Office of Inspector General‟s (OIG) Hotline. Four of the nine applications from the congressional request were not included because three were approved before 2002 and one lost its approval with no activity. The 20 lender applications randomly selected included nine applications that were denied and 11 applications that were approved. The nine applications denied were selected from the 1,056 applications shown in the Approval, Review & Recertification Tracking System as received January 1, 2006 through February 10, 2009 and denied. The 11 applications approved were selected from the 6,220 applications shown in the Approval, Review & Recertification Tracking System as received January 1, 2006 through February 10, 2009 and approved. The nine lender applications with recent approvals and high default rates identified by HUD‟s Neighborhood Watch system were selected from the 5,373 applications shown in the Approval, Review & Recertification Tracking System as received October 1, 2006 through March 27, 2009 and approved. The information from the Neighborhood Watch system was for lenders with at least 21 originations and 1 default within the first year. We used computer-processed data from HUD‟s Approval, Review & Recertification Tracking System and Neighborhood Watch system in conjunction with our selection of lender applications for review, and FHA retrieved imaged application files for our application review. The data used for selection of lender application files were considered sufficiently reliable for that purpose. The imaged application files available for review were not considered complete and are discussed in finding 3. Additionally, the accuracy of the imaged files from the standpoint of retention of all the supporting documents is discussed in finding 1. 5 Neighborhood Watch is a HUD system intended to aid HUD/FHA staff in monitoring lenders and our programs, and to aid lenders and the public in self-policing the industry. The system is designed to highlight exceptions, so that potential problems are readily identifiable. In addition, the system can be used to identify loan programs, geographic areas and lenders that are performing well. 19 Our review of the lender application files was to determine if FHA followed the control procedures for lender approval included in HUD Handbook 4060.1, REV-2, paragraph 3-6, including ensuring that the application has all the documents required by paragraph 3-2. Accordingly, we reviewed the lender application files to ensure they contained the applicable supporting documentation that it met HUD requirements, and that required FHA analysis were completed. Additionally, we reviewed the lender application file to determine if FHA‟s analysis included determining if: 1. Fees remitted were accurate, 2. Credit reports were reviewed in accordance with FHA underwriting guidelines, 3. Financial statements were reviewed to ascertain financial soundness, 4. Evidence of office facilities was reviewed to ascertain compliance with FHA requirements, and 5. Principals of the lender were checked against information sources to determine if they are free of derogatory information that would require a denial of the application. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 20 INTERNAL CONTROLS Internal control is an integral component of an organization‟s management that provides reasonable assurance that the following objectives are achieved: Program operations, Relevance and reliability of information, Compliance with applicable laws and regulations, and Safeguarding of assets and resources. Internal controls relate to management‟s plans, methods, and procedures used to meet its mission, goals, and objectives. They include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objectives: FHA policies and procedures for processing lender applications and approving those meeting FHA requirements, FHA procedures for reconciling application fees received with applications received, and FHA procedures for reconciling lender files provided to the imaging contractor with the lender files certified as having been destroyed or returned by the contractor. We assessed the relevant controls identified above. A significant weakness exists if internal controls do not provide reasonable assurance that the process for planning, organizing, directing, and controlling program operations will meet the organization‟s objectives. 21 Significant Weaknesses Based on our review, we believe that the following items are significant weaknesses: FHA approved lender applications without documentation showing that all requirements were met including the payment of the application fee (finding1). FHA‟s lender application process did not require the lender to certify that the information provided was complete and accurate or advise the lender of potential penalties for submitting false information (finding 2). FHA lacked control over lender files provided to a contractor for imaging (finding 3). 22 Appendix A AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 23 Comment 2 Comment 3 Comment 4 24 Comment 5 Comment 6 Comment 7 25 OIG Evaluation of Auditee Comments Comment 1 We revised the report to reflect their comments on changes made to the application certification to give recognition to the stated action taken. Comment 2 We agree that it is impractical to ask each office to identify on a case by case basis unresolved findings for each applicant, its principals and staff. We fully expected FHA to work with other HUD offices and develop information technology to address the recommendation. We have revised our recommendation to explicitly reflect this expectation. The need to check for unresolved HUD findings is emphasized by the Helping Families Save Their Homes Act of 2009 which became law on May 20, 2009. The Act states that to be eligible for approval an applicant mortgagee shall not be, and shall not have any officer, partner, director, principal, manager, supervisor, loan processor, loan underwriter, or loan originator of the applicant mortgagee who is „„(C) subject to unresolved findings contained in a Department of Housing and Urban Development or other governmental audit, investigation, or review”. Accordingly, it is reasonable to expect that FHA, a part of HUD, will not approve a lender that is subject to unresolved HUD findings. Comment 3 We revised the report to reflect the comment on the contractor performance including the associated recommendation. Comment 4 We revised the report to reflect the comment on the process for using Pay.Gov information to reconcile fees received and applications approved. Comment 5 We revised the report to reflect the comment on additional staff hired and work to improve information technology. Comment 6 We revised the recommendation on questionable lenders to reflect FHA‟s comment that it includes a lender‟s prior history as a factor for selecting lenders for monitoring. Comment 7 Our finding is that HUD‟s application certification does not take advantage of the deterrent value associated with a certification that clearly advises applicants that the information must be complete and accurate, and that there are penalties for submitting false information. We made changes to the finding to clarify this and included their comments on changes made to the application certification to give recognition to the stated action taken. 26
Controls Over FHA's Single-Family Lender Approval Process Need Improvement
Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-09-30.
Below is a raw (and likely hideous) rendition of the original report. (PDF)