oversight

Controls Over FHA's Single-Family Lender Approval Process Need Improvement

Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-09-30.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                                  Issue Date
                                                                        September 30, 2009
                                                                  Audit Report Number
                                                                           2009-SE-0004




TO:         Phillip A. Murray, Deputy Assistant Secretary for Single Family Housing, HU



FROM:       Joan S. Hobbs, Regional Inspector General for Audit, Region X, 0AGA

SUBJECT: Controls over FHA‟s Single-Family Lender Approval Process Need
         Improvement

                                    HIGHLIGHTS

 What We Audited and Why

      In response to a congressional request, we audited the Federal Housing Administration
      (FHA) Title II single-family lender approval process. We wanted to know whether the
      application process provided effective controls and procedures to ensure approval of only
      those lenders that complied with U.S. Department of Housing and Urban Development
      (HUD) requirements. We also determined whether FHA collected application fees,
      accounted for files that were electronically imaged, and planned to include new
      information becoming available under the Secure and Fair Enforcement (S.A.F.E.)
      Mortgage Licensing Act in the approval process.


 What We Found
      FHA‟s lender approval process did not have sufficient controls and procedures to ensure
      that lenders met all applicable requirements for approval to participate in the FHA single-
      family program. In addition, FHA did not obtain or consider negative information on
      lenders from other HUD offices, ensure that application fees were collected, ensure that
      all supporting documents were obtained, or include adequate certifications on the lender
      application form. Further, FHA‟s controls over the contractor tasked with imaging lender
      approval files did not ensure the proper disposition of those files, which contained
      personally identifiable information. In fiscal year 2008, the number of Title II lender
     applications approved by FHA totaled 3,297, more than triple the number of applications
     approved in 2007. FHA officials told us that staffing levels had been near constant since
     2005 and that the large increase in applications strained FHA‟s ability to review the
     applications. FHA believed that additional resources for staff and systems would
     enhance their ability to review lender applications. FHA officials also stated that they
     would review available information to ensure that lender principals complied with the
     S.A.F.E Mortgage Licensing Act of 2008.

What We Recommend

     We recommend that FHA ensure that lender principals and staff are free of indictment,
     conviction, debarment, suspension, limited denials of participation, and unpaid federal
     debt before applications are approved. FHA should also consult with other HUD offices
     to determine whether applicants are subject to unresolved findings and ensure that
     application fees received are reconciled with the related applications. We also
     recommend that FHA include a stronger lender fraud certification on the application, and
     improve controls over the maintenance and disposition of electronic lender files.

     For each recommendation without a management decision, please respond and provide
     status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us
     copies of any correspondence or directives issued because of the audit.


Auditee’s Response

     We issued the draft report to the Deputy Assistant Secretary for Single Family Housing
     on September 9, 2009, and held an exit conference on September 16, 2009. The Deputy
     Assistant Secretary generally agreed with most of the content of the report and the
     recommendations.

     The complete text of the auditee‟s response, along with our evaluation of that response,
     can be found in appendix A of this report.




                                             2
                           TABLE OF CONTENTS

Background and Objective                                                            4

Results of Audit
      Finding 1: FHA‟s Lender Approval Process Did Not Ensure That Only Eligible    6
                 Applicants Were Approved

      Finding 2: FHA‟s Lender Application Did Not Contain Adequate Certifications   12
      Finding 3: FHA Did Not Ensure the Proper Handling and Storage of Approved     16
                 Lender Files

Scope and Methodology                                                               19

Internal Controls                                                                   21

Appendices

   A. Auditee Comments and OIG‟s Evaluation                                         23




                                           3
                      BACKGROUND AND OBJECTIVE

The Federal Housing Administration‟s (FHA) mortgage insurance programs help low- and
moderate-income families become homeowners by lowering some of the costs of their mortgage
loans. FHA mortgage insurance also encourages lenders to make loans to otherwise
creditworthy borrowers that might not be able to meet conventional underwriting requirements
by protecting the lender against default.

Title II of the National Housing Act, Section 203(b) is the centerpiece of FHA‟s single-family
mortgage insurance programs—the successor of the program that helped save homeowners from
default in the 1930s, that helped open the suburbs for returning veterans in the 1940s and 1950s,
and that helped shape the modern mortgage finance system. Today, FHA‟s One- to Four-Family
Mortgage Insurance Program is still an important tool through which the federal government
expands homeownership opportunities for first-time home buyers and other borrowers who
would not otherwise qualify for conventional mortgages on affordable terms, as well as for those
who live in underserved areas where mortgages may be harder to get. These obligations are
protected by FHA‟s Mutual Mortgage Insurance Fund, which is sustained entirely by borrower
insurance premiums.

The Helping Families Save Their Homes Act of 2009 was enacted on May 20, 2009 and includes
additional standards that an applicant for participation in the FHA single-family program must
meet. The standards require that the lenders and their officers, partners, directors, principal
managers, supervisors, loan processors, loan underwriters, and loan originators, have an
acceptable background check. The Act‟s standards also make it clear that an applicant must
comply with the Secure and Fair Enforcement (S.A.F.E.) Mortgage Licensing Act of 2008,
which requires state licensing of loan originators and a nationwide database containing loan
originator licensing and sanction information.

The S.A.F.E. Mortgage Licensing Act of 2008 was a component of the Housing and Economic
Recovery Act (HERA) of 2008 signed into law on July 30, 2008. The S.A.F.E. Mortgage
Licensing Act component was designed to enhance consumer protection and reduce fraud by
encouraging states to establish minimum standards for the licensing and registration of state-
licensed mortgage loan originators and establishment and maintenance of a nationwide mortgage
licensing system and registry.

HUD is required to determine whether lenders are qualified before allowing them to participate
in the FHA program. To that end, FHA established an application process administered by
FHA‟s Office of Lender Approval and Recertification Division. That process requires the lender
to submit a paper application form with supporting documentation. The application process is
designed to allow FHA to approve lenders that meet a number of qualification requirements,
possess experience in loan origination, and are responsible industry members.

The number of lenders applying to participate in the FHA program has greatly increased in the
last two years. This increase can be attributed to the turmoil in the financial industry and


                                                4
reduced availability of conventional credit. The following chart shows the changes in the
number of lender approvals for FHA participation between 2004 and 2009.


                              Title II lender approvals
                     3,500

                     3,000
                 A
                 p   2,500
                 p
                 r   2,000
                 o
                 v   1,500
                 a
                     1,000
                 l
                 s
                      500

                        0
                              2004    2005     2006        2007   2008   First half
                                                                         of 2009
                                                   Fiscal year



Congressional concerns brought about in part by media coverage has raised concerns that former
subprime lenders and brokers are obtaining approval to participate in the FHA program and that
they will be responsible for FHA insurance of loans to people unlikely to make their payments.

Our audit objective was to determine whether the application process for Title II provided
effective controls to ensure approval of only those lenders that complied with FHA requirements,
applicants paid the application fee, and all files sent for imaging were accounted for and
available. We also wanted to determine whether FHA planned to include new information
becoming available under the S.A.F.E. Mortgage Licensing Act in the lender approval process.




                                               5
                                 RESULTS OF AUDIT

Finding 1: FHA‟s Lender Approval Process Did Not Ensure That Only
           Eligible Applicants Were Approved
FHA‟s lender application process was not adequate to ensure that all of its lender approval
requirements were met. This condition occurred because FHA control procedures had not been
enhanced and automated to handle the recent large increase in the number of lenders applying for
the FHA program. As a result, FHA lacked assurance that lenders approved to participate in
FHA‟s Title II single-family program met all of the requirements and were eligible. Office of
Lender Approval and Recertification Division officials told us that they were working on
automating the application process and obtaining needed information on lender official
backgrounds.



 Lender Approval Process Did
 Not Fully Address Lender
 Eligibility Requirements

       The regulations for the program at 24 CFR (Code of Federal Regulations) 202.5(j)
       provide that a lender is ineligible if its principals or any staff members are (1) suspended,
       debarred, or otherwise restricted under HUD regulations or similar procedures of any
       other federal agency and (2) indicted for or have been convicted of any offense which
       reflects upon the responsibility, integrity, or ability of the lender to participate in the
       program. However, FHA‟s lender approval process did not fully address these
       requirements.

       The application requires the lender to use check boxes to answer the following questions:

              “Is the applicant or any of its principals, officers, individuals serving on its Board
              of Directors, individuals acting as authorized signatories, or employees currently
              involved in a proceeding or subject to an investigation that could result, or has
              resulted, in suspension, fine, or disbarment by a Federal, State, or local
              government agency, conviction in a criminal matter, bankruptcy or denial of
              fidelity insurance or mortgagee‟s errors and omissions insurance coverage?”

              “Has the applicant or any of its principals, officers, individuals serving on the
              Board of Directors, or individuals acting as authorized signatories, ever been, or
              are any presently suspended, terminated, debarred, sanctioned, fined, convicted,
              denied approval, or refused a license by any Federal, State, or local government
              agency, or a government-related entity, where the action is related to the
              responsibilities that are commensurate with those of the financial services
              industry?”

                                                 6
        However, the completion of the checked boxes did not address lender staff as required
        because FHA‟s application process did not require lenders to clearly certify that
        principals and staff were not subject to one of the listed actions, nor did it include a check
        to ensure that none existed for staff.

        FHA does not have access to the Justice Department‟s National Crime Information
        Center to verify the criminal record of lender officials. FHA officials told us that the
        review of a lenders criminal background information is impractical unless a single source
        could be used. During later discussions, they told us that they were contracting for
        criminal background information from a private industry provider. They stated the
        information would be used to supplement the other background checks done. The lender
        application files show those checks include reviews for debarments, suspensions, limited
        denials of participation, and ChoicePoint reports1. Additionally, they told us that the
        requirement was considered to have been met by the application question on indictments
        and convictions and FHA certification of the application. In their comments on the draft
        report FHA officials told us that they had revised the certification on the application to
        include lender employees.

        In addition to the FHA‟s efforts to obtain criminal background information, FHA
        officials told us that they would use information from the nationwide loan originator
        licensing database established by the S.A.F.E Mortgage Licensing Act of 2008. That Act
        provides that a license cannot be issued to an applicant convicted of or who pled guilty or
        nolo contendere to a felony within the past seven years or at any time if it involved a
        felony related to fraud, dishonesty, breach of trust, or money laundering. It also provides
        for access to the needed criminal background information. For applicants licensed as
        loan originators, use of this information should complement any background check
        performed by FHA.

    Other HUD Offices Were Not
    Queried about Unresolved
    Findings

        The regulations for the program at 24 CFR 202.5(j)(3) provide that a lender is ineligible
        if it, its principals, or any staff members are subject to unresolved findings as a result of
        HUD or other governmental audits or investigations. Officials at FHA‟s Lender
        Approval and Recertification Division told us that they review information from the
        Homeownership Centers on unresolved findings but did not request such information
        from other HUD offices. We confirmed that information on unresolved findings was not
        requested from three other HUD offices with roles that included monitoring of lenders.
        Those offices were the Office of RESPA (Real Estate Settlement Procedures Act) and
        Interstate Land Sales, Office of Fair Housing and Equal Opportunity, and Office of


1
 FHA uses the LexisNexis service ChoicePoint‟s Mortgage Asset Research Institute tools to check participant
backgrounds. The service can verify licensing and discover adverse activity, public disciplinary and other
derogatory information about professionals.

                                                       7
    Inspector General. Our review of 22 approved lender applications disclosed no checks
    with the three other HUD offices to determine whether there were unresolved findings.

    We checked for unresolved findings by the three other HUD offices related to the lenders
    included in our review and noted that there were none. Nevertheless, FHA lacked
    assurance that lenders met all eligibility requirements in the absence of the results from
    checks with other HUD offices to determine whether there were unresolved findings.
    FHA officials told us that they interpreted the requirement to check for unresolved
    findings as applicable to FHA activities. They noted that there was no central HUD
    database containing information on unresolved findings. In the absence of such a
    database they considered making checks for unresolved findings unreasonable and
    incompatible with the timely review of lender applications.

Documents Were Missing from
Lender Application Files


    HUD Handbook 4060.1, REV-2, paragraph 3-2, specifies the contents of the application
    for lender approval. Our review of 22 approved lender applications showed that only one
    of the lender approval files contained all required supporting documentation. The
    remaining files were missing from one to five required documents. As a result, FHA
    lacked assurance that the lenders met all eligibility requirements.

    Our review of 22 approved lender application files showed that

           14 applications were missing the photographs showing that the facilities met FHA
           requirements,
           Seven applications were missing the required documentation for the payment of
           the application fee,
           Six applications were missing the required FHA certification,
           Three applications were missing the required checks of principal background
           information,
           Three applications were missing the required audited schedule of net worth
           showing that FHA requirements were met,
           Three applications were missing the required resumes for principals,
           Two applications were missing the required certification that neither the lender,
           officers, directors, nor principals had been denied a license or were otherwise
           sanctioned,
           Two applications were missing required credit reports for principals and/or the
           lender,
           One application was missing the required current financial statements, and
           One application was missing required information on the business organization.

    FHA officials told us that the lack of resources to respond to the large increase in
    application volume impacted the quality of their lender application reviews. They also
    noted that the former imaging contractor was unacceptable. For the most frequent

                                            8
     missing item, photographs, we were told that initially photographs were not sent to the
     imaging contractor because it was not believed that the contractor would image
     photographs.

Controls Did Not Ensure Receipt
of Application Fees

     The regulations for the program at 24 CFR 202.5(i) provide that a lender must pay an
     application fee. Paragraph 2-7 of HUD Handbook 4060.1, REV-2, requires the lender to
     send the actual payment check and HUD form for application fee to the HUD lockbox
     with copies to be submitted with the application. FHA did not reconcile the applications
     received with the actual funds received at the HUD lockbox. Thus, FHA lacked
     assurance that all application fees were received at the HUD lockbox and deposited into
     HUD accounts.

     FHA officials told us that fees collected from lenders were reconciled to the applications
     received. They also stated that the Single Family Accounting Branch reconciled the fees
     collected with the transaction detail ledger. However, the director of the Single Family
     Accounting Branch told us that (1) it only reconciled the amount the lockbox
     electronically credited to HUD‟s account to the supporting documentation provided by
     the lockbox and (2) it did not reconcile collections to the applications received by FHA.
     Further, FHA officials told us that they would be changing the payment process. They
     told us the lockbox arrangement is ending, and the U.S. Treasury‟s Pay.Gov Web site
     will be used to collect lender application fees once an agreement is executed. Pay.Gov
     allows users to pay fees on line by way of credit card or bank account debit. FHA
     officials told us the conversion to Pay.Gov will ensure that collections are reconciled to
     applications. They also told us that FHA can receive daily electronic reports from
     Pay.Gov which will be used to reconcile the receipt of the application fee prior to
     approval of a lender.

The Large Increase in Application
Volume Strained FHA Resources


     FHA officials told us that the large increase in applications strained FHA‟s ability to
     review the applications and noted that additional resources for staff and systems would
     enhance their ability to review lender applications. In fiscal year 2008, the number of
     Title II lender applications approved by FHA totaled 3,297, more than triple the number
     of applications approved in 2007, and the average time to complete application reviews
     increased 17 percent. Further, the percentage of total applications receiving approval,
     including those that were incomplete, resubmitted, and appealed, went from 77 percent in
     2007 to 71 percent in 2008.

     FHA officials advised that they hired additional staff, and are working to improve and
     modernize their information technology resources in response to the increase in

                                              9
        applications. This included having a contractor develop an online application process
        and getting it approved for installation. A review of the future online application process
        was not included within the scope in our review.

    Questionable Lenders Were
    Approved for the FHA Program

        On November 19, 2008, Business Week magazine reported that First Magnus, an FHA-
        approved lender, was cited by state and federal regulators for misleading borrowers,
        using unlicensed brokers, and other infractions. The article stated that First Magnus was
        “…shut down last summer [2007] and laid off its 5,500 employees. But in May [2008],
        the FHA issued a group of former First Magnus executives a new license to make
        taxpayer-insured home loans. They have opened a company called StoneWater Mortgage
        in the same office building that First Magnus had occupied.” Our prior audits2 of First
        Magnus disclosed a number of serious violations of the Real Estate Settlement
        Procedures Act (RESPA) such as paying marketing fees, non-competition fees and
        quality incentives to real estate companies in exchange for more than $157 million in
        FHA mortgage business. The lender also disregarded HUD requirements when it
        originated and processed FHA-insured loans, exposing FHA to unnecessary risks.

        We reviewed the application for StoneWater mortgage to determine whether FHA
        followed its rules in approving the application. Although the principals of StoneWater
        identified themselves as having prior employment with First Magnus, FHA had no
        records showing that these same individuals violated its requirements while employed at
        First Magnus. Further, our audits of First Magnus and two referrals to the Office of
        RESPA and Interstate Land Sales did not explicitly show that the StoneWater principals
        shown on the application had any involvement with the findings presented. FHA was
        bound by the rules in place at the time and concluded that it had no legal basis for
        denying the StoneWater application. In this regard, FHA lacked records of administrative
        actions or sanctions against these individuals. In processing the StoneWater application,
        the FHA Office of Lender Approval followed the control procedures for lender approval
        with the exception of documentation that the fee was paid, computation of adjusted net
        worth, and photographs of the facilities.

        In another situation, in July 2008, FHA denied the application of a mortgage company
        because the company‟s vice president was associated with a formerly approved mortgage
        company that was removed by the Mortgagee Review Board in 2005 for program
        violations. The denial letter stated that the formerly approved company still owed HUD
        about $237,440 for indemnification agreements3. Although the name of the new
        company was different, the new company‟s address was the same as the address of the
        formerly approved mortgage company.

2
 Audit report 2006-LA-1018 issued July 26, 2006 and audit report 2007-LA-1002 issued December 12, 2006.
3
 HUD Handbook 4155.2 paragraph 9.D.4.c describes single-family indemnification agreements as a lender and
HUD‟s agreement that the lender will abstain from filing an insurance claim or reimburse FHA if a subsequent
holder of the mortgage files and insurance claim and FHA suffers a financial loss.

                                                       10
    The application was appealed by the former owner‟s son as president of the new
    company. In his appeal, the son stated that he understood HUD had problems with his
    father but he will not be involved in any aspect of the business and is not an officer or
    employee of the new company. The appeal also stated that his father had been removed
    as the broker of record for the new company. After further review, the new company‟s
    reapplication was approved after the normal review of the principals shown on the
    application did not disclose any records of administrative sanctions against these
    individuals.

Conclusion

    The current economic crisis was due, in part, to the collapse of the mortgage industry.
    The mortgage industry failed because loose underwriting standards led to lenders making
    mortgage loans available to those that could not afford to make the monthly payments.
    With the collapse came a decreased availability of funds for uninsured mortgages and a
    substantial increase in the number of lenders applying for admission into the FHA single-
    family insurance program. Some of these applicants may have officers and staff that
    were involved with questionable loan origination and underwriting practices in the past.
    FHA needs to implement the Helping Families Save Their Homes Act of 2009 which was
    enacted on May 20, 2009 and includes additional standards that an applicant for
    participation in the FHA single-family program must meet.

 Recommendations


    We recommend that FHA‟s Lender Approval and Recertification Division ensure that:

        1A. Lender principals and staff are free of indictment, conviction, debarment,
            suspension, limited denials of participation, and unpaid federal debt by (1)
            obtaining a clear certification from the lender, (2) performing background
            checks, or (3) obtaining a combination of certifications and background checks.

        1B. The development of a database containing information on unresolved findings
            from other HUD offices is included in FHA information technology initiatives
            and that it is used when evaluating applicants.

        1C. All documents required to support the application are received and reviewed
            before lender approval, and then maintained in the application file.

        1D. Application fees received are reconciled with the applications received.




                                            11
We further recommend that FHA‟s Office of Lender Activities and Program Compliance:

   1E. Ensure the risk factors considered when developing the annual lender
       monitoring plan continue to include lenders with principals formerly associated
       with a sanctioned lender.




                                      12
Finding 2: FHA‟s Lender Application Did Not Contain Adequate
           Certifications
FHA‟s lender application process did not require the lender to certify that the information provided
was complete and accurate or advise the lender of potential penalties for submitting false
information. As a result, FHA had not established the lender certification as a reasonable deterrent
to preclude unqualified lenders from improperly gaining approval to participate in the program.
This condition occurred because FHA officials believed that the process provided adequate
assurance that lenders were eligible to participate in the program.


 The Lender Application Did
 Not Address All Lender
 Approval Requirements


       The regulations at 24 CFR Part 202 and HUD Handbook 4060.1, REV-2, detail the
       requirements that lenders must meet for approval to participate in the program and
       provide that FHA will make a determination on eligibility based on the lender‟s
       application. However, the application and supporting documentation requiring
       certification did not require that the lender certify that the information was complete and
       accurate, nor did it address all requirements. Further, the FHA lender application process
       did not verify all of the information provided or include checking requirements that were
       not addressed in the application, such as the background of lender staff (see finding 1).

       The application required the applicant to complete the following certification: “I certify
       that I am authorized to execute this application on behalf of the applicant.” Additionally,
       the supporting documentation required for the application included requirements that:

               A state-licensed lender must also submit a letter certifying to HUD that it has not
               been refused a license or sanctioned.

               Unaudited financial statements required to update audited financial statements
               more than 6 but less that 12 months old must be certified by management.

               If applicable, a nonsupervised lender or loan correspondent must certify that its
               state does not require that mortgage lenders be licensed.

               The applicant must submit a certification, signed by a senior officer, that the
               facilities comply with FHA requirements.

               The applicant must certify that neither it nor any of its officers, directors, or
               principals have been denied an operating license or otherwise sanctioned by any
               licensing or regulatory body.

                                                 13
The Certifications Did Not
Warn Applicants of Potential
False Certification Penalties

  None of the lender application certifications stated that the information was complete and
  accurate, nor did they put the applicant on notice of potential penalties such as fines or
  imprisonment. The absence of these fraud elements weakened the certifications and was
  striking since Ginnie Mae uses the same form, which, in a different section, requires
  issuers of Ginnie Mae securities to make the following additional certification:

         “I certify that all of the information I have provided on this form and
         in any accompanying documentation is true and accurate to the
         best of my knowledge and belief. I understand that if I knowingly
         have made any false, fictitious, or fraudulent statement,
         representation, or certification on this form or on any
         accompanying documents, I may be subject to civil and criminal
         penalties, including fines and/or imprisonment, under applicable
         federal law, including but not limited to 18 U.S.C. [United States Code] §1001,
         1010, and 1012, and 31 U.S.C. §3729 and 3802.”

  When asked about the differences in FHA and Ginnie Mae certification requirements,
  FHA officials told us that they required a sanction letter that was not required by Ginnie
  Mae. Additionally, they stated that they were developing a form that would not be shared
  with Ginnie Mae and a new online application process. Review of the new form
  submitted to the Office of Management and Budget for clearance showed that it had a
  certification similar to the existing form without certification that information is complete
  and accurate. Also, it did not include notice of potential penalties. In their comments on
  the draft report FHA officials told us that they had revised the the certification on the
  application. Also, during discussions they noted that they had not had problems with
  enforcement.

Conclusion


  FHA should use all reasonable means to ensure that the information presented in a
  lender‟s application to the FHA program is true and accurate. Requiring a lender to
  certify to the truth and accuracy of the information on the application and informing the
  lender of the consequences of false certification would provide an additional safeguard
  against ineligible participants.




                                           14
Recommendation

  We recommend that FHA‟s Lender Approval and Recertification Division:

     2A. Include a certification on the application similar to Ginnie Mae‟s certification
         that makes it clear to the applicant that the information it provides is to be
         complete, accurate, and true with potential penalties for knowingly providing
         information not meeting those standards.




                                         15
Finding 3: FHA Did Not Ensure the Proper Handling and Storage of
           Approved Lender Files
FHA lacked sufficient oversight of the contractor tasked to scan, store electronic images of, and
destroy lender applications. Its monitoring of the contractor‟s performance did not ensure the
proper disposition of lender application files after they were scanned. Further, FHA did not
ensure that the electronic images of the lender applications were retrievable. As a result, it could
not fully account for lender application files containing personally identifiable information and
was not always able to make the files available for review. According to FHA officials, this
condition was due to a lack of sufficient resources to monitor contractor performance.



    FHA Contracted with an
    Outside Firm to Scan and
    Dispose of Lender Applications

         In 2006, FHA contracted with an outside firm to scan, electronically store, and shred
         approved lender application files. These files contained personally identifiable
         information, such as Social Security numbers of the officers and owners of the lenders
         applying for approval to originate FHA loans.4 According to 5 U.S.C. 552a, government
         agencies are responsible for establishing safeguards to ensure the security and
         confidentiality of records containing personally identifiable information. Therefore, the
         contract required the contractor to keep the files confidential and provide FHA with
         certificates of destruction for files destroyed after imaging.

         During the course of the contract, FHA sent approved lender applications to the
         contractor in numbered boxes. After scanning the lender applications, the contractor was
         required to shred them and provide FHA with certificates of destruction covering each
         lender file. However, FHA could not provide the certificates of destruction or other
         documentation regarding the disposition of 24 boxes of lender application files and other
         documents sent for imaging. Although the contractor had no original certificates of
         destruction for the 24 boxes, its project manager stated that the contents of 17 of the
         boxes were shredded and seven boxes that were not shredded were returned to FHA. The
         contractor was unable to provide a receipt for the return of the seven boxes, and FHA
         staff could not locate the boxes or recall the delivery of the boxes.

         The 24 boxes were not properly accounted for because FHA lacked sufficient control
         over the inventory of the approved lender applications. According to FHA, “…the

4
  The term “personally identifiable information” refers to information which can be used to distinguish or trace an
individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined
with other personal or identifying information which is linked or linkable to a specific individual, such as date and
place of birth, mother‟s maiden name, etc.


                                                          16
     Lender Approval and Recertification Division opted to maximize its limited resources by
     ensuring that the documents being transferred to the contractor to be imaged were logged
     and acknowledged by the contractor as being „accepted for imaging‟ versus using limited
     staff to reconcile such files to the contractors‟ requests for authorization to destroy files.”

FHA Could Not Always
Retrieve Electronic Lender
Files

     The contract for imaging the lender application files required the contractor to make the
     scanned images accessible, retrievable, and printable via the Internet. After the contract
     ended on September 30, 2008, the two database servers, one primary and one backup,
     used by the contractor to store the application file images were returned to FHA, and
     FHA no longer had Internet access to the images. We asked FHA for 36 lender
     applications, but it was only able to retrieve 31 of the files. FHA officials stated that the
     missing files were unavailable in hard copy and could not be retrieved from the server.

Conclusion

     Appendix 27 of HUD Handbook 2225.6 states that the lender files of those approved to
     make insured loans must be retained until approval is withdrawn or terminated. FHA did
     not have a process in place to ensure that lender application files were available when
     needed for review. FHA officials told us that they had limited resources and did not
     ensure that all lender files stored on the servers could be retrieved. Access to the lender
     application files is essential since these files contain information on lenders that is useful
     for audits and investigations of lender activities and for FHA‟s lender monitoring and
     annual lender recertification. Since these applications contain personally identifiable
     information, FHA must take precautions to ensure the confidentiality of the applications.

Recommendations


     We recommend that FHA‟s Lender Approval and Recertification Division:

         3A. Determine the disposition of all lender files provided to the imaging contractor.
             If lender file disposition is indeterminable, FHA should notify the applicable
             lenders of the loss of their information and obtain new files from those lenders.

         3B. Develop a plan and request resources to automate the application process to
             retain a record of the application electronically, including supplemental
             information, and ensure accessibility.




                                               17
3C. Implement monitoring controls over future imaging contracts to ensure that
    contract performance is adequate and ensures personally identifiable
    information is safeguarded.




                                  18
                              SCOPE AND METHODOLOGY

We performed an audit of the FHA single-family lender approval process in response to a
congressional request. Our audit covered applications received during the period January 1,
2006, through March 27, 2009 with one exception for an application received on March 19, 2002
from a lender included in the congressional request. We conducted our fieldwork at FHA‟s
Lender Approval and Recertification Division in Washington, D.C. between January and August
2009. To accomplish our objectives, we interviewed staff and obtained an understanding of the
lender application review process and procedures, reviewed a sample of available lender
applications and supporting documentation, analyzed data gathered from an imaging contractor
and HUD staff, and considered the impact of new legislation addressing lender eligibility for
FHA program participation.

We randomly selected 20 of the 36 lender applications reviewed. The remaining 16 applications
selected included five of nine from the congressional request, one from a media article similar to
the basis for the congressional request, nine recent approvals with the highest default rates
identified by HUD‟s Neighborhood Watch system5, and one included in a confidential complaint
received by the Office of Inspector General‟s (OIG) Hotline. Four of the nine applications from
the congressional request were not included because three were approved before 2002 and one
lost its approval with no activity.

The 20 lender applications randomly selected included nine applications that were denied and 11
applications that were approved. The nine applications denied were selected from the 1,056
applications shown in the Approval, Review & Recertification Tracking System as received
January 1, 2006 through February 10, 2009 and denied. The 11 applications approved were
selected from the 6,220 applications shown in the Approval, Review & Recertification Tracking
System as received January 1, 2006 through February 10, 2009 and approved.

The nine lender applications with recent approvals and high default rates identified by HUD‟s
Neighborhood Watch system were selected from the 5,373 applications shown in the Approval,
Review & Recertification Tracking System as received October 1, 2006 through March 27, 2009
and approved. The information from the Neighborhood Watch system was for lenders with at
least 21 originations and 1 default within the first year.

We used computer-processed data from HUD‟s Approval, Review & Recertification Tracking
System and Neighborhood Watch system in conjunction with our selection of lender applications
for review, and FHA retrieved imaged application files for our application review. The data used
for selection of lender application files were considered sufficiently reliable for that purpose.
The imaged application files available for review were not considered complete and are
discussed in finding 3. Additionally, the accuracy of the imaged files from the standpoint of
retention of all the supporting documents is discussed in finding 1.
5
 Neighborhood Watch is a HUD system intended to aid HUD/FHA staff in monitoring lenders and our programs,
and to aid lenders and the public in self-policing the industry. The system is designed to highlight exceptions, so that
potential problems are readily identifiable. In addition, the system can be used to identify loan programs, geographic
areas and lenders that are performing well.

                                                          19
Our review of the lender application files was to determine if FHA followed the control
procedures for lender approval included in HUD Handbook 4060.1, REV-2, paragraph 3-6,
including ensuring that the application has all the documents required by paragraph 3-2.
Accordingly, we reviewed the lender application files to ensure they contained the applicable
supporting documentation that it met HUD requirements, and that required FHA analysis were
completed.

Additionally, we reviewed the lender application file to determine if FHA‟s analysis included
determining if:

   1. Fees remitted were accurate,
   2. Credit reports were reviewed in accordance with FHA underwriting guidelines,
   3. Financial statements were reviewed to ascertain financial soundness,
   4. Evidence of office facilities was reviewed to ascertain compliance with FHA
      requirements, and
   5. Principals of the lender were checked against information sources to determine if they are
      free of derogatory information that would require a denial of the application.

We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                               20
                              INTERNAL CONTROLS

Internal control is an integral component of an organization‟s management that provides
reasonable assurance that the following objectives are achieved:

       Program operations,
       Relevance and reliability of information,
       Compliance with applicable laws and regulations, and
       Safeguarding of assets and resources.

Internal controls relate to management‟s plans, methods, and procedures used to meet its
mission, goals, and objectives. They include the processes and procedures for planning,
organizing, directing, and controlling program operations as well as the systems for measuring,
reporting, and monitoring program performance.



 Relevant Internal Controls


       We determined that the following internal controls were relevant to our audit objectives:

              FHA policies and procedures for processing lender applications and approving those
              meeting FHA requirements,

              FHA procedures for reconciling application fees received with applications received,
              and

              FHA procedures for reconciling lender files provided to the imaging contractor with
              the lender files certified as having been destroyed or returned by the contractor.

       We assessed the relevant controls identified above.

       A significant weakness exists if internal controls do not provide reasonable assurance that
       the process for planning, organizing, directing, and controlling program operations will meet
       the organization‟s objectives.




                                                21
Significant Weaknesses

     Based on our review, we believe that the following items are significant weaknesses:

            FHA approved lender applications without documentation showing that all
            requirements were met including the payment of the application fee (finding1).

            FHA‟s lender application process did not require the lender to certify that the
            information provided was complete and accurate or advise the lender of potential
            penalties for submitting false information (finding 2).

            FHA lacked control over lender files provided to a contractor for imaging (finding
            3).




                                             22
Appendix A

        AUDITEE COMMENTS AND OIG’S EVALUATION


Ref to OIG Evaluation   Auditee Comments




Comment 1




                         23
Comment 2




Comment 3




Comment 4




            24
Comment 5




Comment 6



Comment 7




            25
                         OIG Evaluation of Auditee Comments

Comment 1   We revised the report to reflect their comments on changes made to the
            application certification to give recognition to the stated action taken.

Comment 2   We agree that it is impractical to ask each office to identify on a case by case
            basis unresolved findings for each applicant, its principals and staff. We fully
            expected FHA to work with other HUD offices and develop information
            technology to address the recommendation. We have revised our
            recommendation to explicitly reflect this expectation.

            The need to check for unresolved HUD findings is emphasized by the Helping
            Families Save Their Homes Act of 2009 which became law on May 20, 2009.
            The Act states that to be eligible for approval an applicant mortgagee shall not be,
            and shall not have any officer, partner, director, principal, manager, supervisor,
            loan processor, loan underwriter, or loan originator of the applicant mortgagee
            who is „„(C) subject to unresolved findings contained in a Department of Housing
            and Urban Development or other governmental audit, investigation, or review”.
            Accordingly, it is reasonable to expect that FHA, a part of HUD, will not approve
            a lender that is subject to unresolved HUD findings.

Comment 3   We revised the report to reflect the comment on the contractor performance
            including the associated recommendation.

Comment 4   We revised the report to reflect the comment on the process for using Pay.Gov
            information to reconcile fees received and applications approved.

Comment 5   We revised the report to reflect the comment on additional staff hired and work to
            improve information technology.

Comment 6   We revised the recommendation on questionable lenders to reflect FHA‟s
            comment that it includes a lender‟s prior history as a factor for selecting lenders
            for monitoring.

Comment 7   Our finding is that HUD‟s application certification does not take advantage of the
            deterrent value associated with a certification that clearly advises applicants that
            the information must be complete and accurate, and that there are penalties for
            submitting false information. We made changes to the finding to clarify this and
            included their comments on changes made to the application certification to give
            recognition to the stated action taken.




                                             26