Issue Date September 28, 2010 Audit Report Number 2010-KC-0003 TO: Vicki Bott, Deputy Assistant Secretary for Single Family Housing, HU //signed// FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA SUBJECT: HUD’s Written Policies and Procedures for Loan Indemnifications Were Generally Adequate, But Did Not Include Procedures for Pursuing Signed Indemnification Agreements From Lenders HIGHLIGHTS What We Audited and Why We selected the Office of Lender Activities and Program Compliance, Quality Assurance Division, for review because during a prior audit, we saw instances in which indemnification agreements were not obtained from lenders under certain circumstances. Our objective was to determine whether the U.S. Department of Housing and Urban Development (HUD) had adequate controls to track, obtain, and record indemnification agreements from lenders for materially deficient loans. What We Found HUD’s Quality Assurance Division had written policies and procedures for determining when an indemnification agreement was appropriate and how to process a signed agreement. However, it did not have written policies and procedures for pursuing the signed indemnification agreement from lenders. As a result, HUD did not have assurance that its employees consistently and correctly applied its procedures to pursue signed indemnification agreements. What We Recommend We recommend the Quality Assurance Division develop and implement effective policies and procedures to ensure that its employees consistently pursue signed indemnification agreements. For each recommendation without a management decision, please respond and provide status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or directives issued because of the audit. Auditee’s Response HUD disagreed that it did not have written policies and procedures for pursuing indemnification agreements. We provided the draft report to HUD on August 9, 2010 and requested a response by September 8, 2010. It provided written comments on September 10, 2010. The complete text of the auditee’s response, along with our evaluation of that response, can be found in appendix A of this report. 2 TABLE OF CONTENTS Background and Objective 4 Results of Audit Finding 1: HUD’s Quality Assurance Division Did Not Have Written Policies 5 and Procedures for Pursuing Signed Indemnification Agreements From Lenders Scope and Methodology 7 Internal Controls 8 Appendix A. Auditee Comments and OIG’s Evaluation 9 3 BACKGROUND AND OBJECTIVE The Federal Housing Administration (FHA) provides mortgage insurance on loans made by approved lenders throughout the United States and its territories. FHA mortgage insurance provides lenders with protection against losses as the result of homeowners defaulting on their mortgage loans. The lenders bear less risk because FHA will pay a claim to the lender in the event of a homeowner’s default. Loans must meet established FHA requirements to qualify for insurance. The Office of Single Family Housing is responsible for the overall management and administration of FHA single-family mortgage insurance programs. The mission of the Office of Single Family Housing is to expand and maintain affordable homeownership opportunities, on an actuarially sound basis, for those that are unserved or underserved by the private market and to provide a consistent, stabilizing force in the home financing market. One of the offices comprising the Office of Single Family Housing is the Office of Lender Activities and Program Compliance. The Office of Lender Activities and Program Compliance’s Quality Assurance Division is responsible for the oversight of FHA lenders. The Quality Assurance Division performs lender oversight functions at U.S. Department of Housing and Urban Development (HUD) headquarters in Washington, DC, and at the four homeownership centers located in Atlanta, GA, Denver, CO, Philadelphia, PA, and Santa Ana, CA. Mortgage lender violations that significantly increase FHA’s risk and were caused by fraud or negligence on the part of the mortgage lender typically result in an indemnification agreement between FHA and the mortgage lender. Under an indemnification agreement, the originating mortgage lender agrees to either abstain from filing an insurance claim or reimburse FHA if a subsequent holder of the mortgage files an insurance claim and FHA suffers a financial loss when disposing of the property. Our objective was to determine whether HUD had adequate controls to track, obtain, and record indemnification agreements from lenders for materially deficient loans. 4 RESULTS OF AUDIT Finding 1: HUD’s Quality Assurance Division Did Not Have Written Policies and Procedures for Pursuing Signed Indemnification Agreements From Lenders HUD’s written policies and procedures for loan indemnifications were generally adequate, but did not include procedures for pursuing signed indemnification agreements from lenders. This deficiency occurred because Quality Assurance Division management did not believe it was necessary to have written policies and procedures for pursuing signed indemnification agreements. As a result, HUD’s Quality Assurance Division did not have assurance that its employees consistently and correctly applied its procedures to pursue signed indemnification agreements. HUD Lacked Written Policies and Procedures HUD’s written policies and procedures for loan indemnifications were generally adequate, but did not include procedures for pursuing signed indemnification agreements from lenders. The written Quality Assurance Division guidance did not address procedures for pursuing indemnification agreements from lenders who: refuse to sign the agreement ignore the request to sign the agreement repeatedly submit additional documentation to mitigate the deficiencies instead of sending back the signed agreement Additionally, the policies and procedures did not address the types of letters to send in each scenario above, as well as the number of days the lenders had to respond to each type of letter. HUD handbook 1840.1 requires managers to establish and maintain a system of management controls to provide reasonable assurance that programs and activities are effectively and efficiently managed and to protect against fraud, waste, abuse, and mismanagement. Internal control, sometimes referred to as management control, includes the written policies and procedures that staff members are to use to perform their jobs to meet HUD’s missions, goals, and objectives. 5 HUD Management Did Not Believe That Written Policies and Procedures Were Necessary Quality Assurance Division management officials told us that they did not believe it was necessary to have written policies and procedures for pursuing signed indemnification agreements because it was part of a larger lender monitoring review process. The written procedures for performing the monitoring review process were detailed and included all aspects of performing the reviews, but they did not address how HUD staff should pursue an indemnification agreement after determining that a material violation had occurred but before the signed indemnification agreement was received. The procedures did not ensure that lenders were held responsible for loans that posed a material risk to the FHA insurance fund. The lack of policies and procedures for the pursuit of indemnification agreements was an internal control weakness. Employees who do not have written policies and procedures to follow cannot perform consistently and appropriately since they do not know which procedures apply in various situations. Because of this deficiency, HUD’s Quality Assurance Division did not have assurance that its employees consistently and correctly applied its procedures to obtain signed indemnification agreements. Recommendations We recommend that the Deputy Assistant Secretary for Single Family Housing require the Quality Assurance Division to 1A. Develop and implement effective policies and procedures to ensure that its employees consistently pursue signed indemnification agreements for loans that pose a material risk to the FHA insurance fund. 6 SCOPE AND METHODOLOGY Our review covered the period January 1, 2008, through December 31, 2009, and was expanded as necessary. We accomplished our objective by conducting interviews with HUD headquarters staff and staff at the four homeownership centers: Atlanta, GA, Denver, CO, Philadelphia, PA, and Santa Ana, CA. We reviewed Federal regulations, HUD handbooks and guidebooks, and Quality Assurance Division policies and procedures. In addition, we reviewed prior Government Accountability Office reports applicable to HUD’s oversight of FHA-approved lenders. We performed our audit from January through July 2010, including onsite work at the Denver, CO, homeownership center and at HUD headquarters in Washington, DC. We did not rely on computer-processed data for this review. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 7 INTERNAL CONTROLS Internal control is a process adapted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to: Effectiveness and efficiency of operations Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: Policies and procedures – Controls designed to ensure that indemnification agreements are obtained from lenders who originate loans that are a material risk to the FHA insurance fund. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. We evaluated internal controls related to the audit objective in accordance with generally accepted government auditing standards. Our evaluation of internal controls was not designed to provide assurance on the effectiveness of the internal control structure as a whole. Accordingly, we do not express an opinion on the effectiveness of the Quality Assurance Division’s internal control. 8 APPENDIX Appendix A AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 9 Comment 2 Comment 3 Comment 4 Comment 5 10 OIG Evaluation of Auditee Comments Comment 1 We reviewed the “Quality Assurance Division Desk Guide” and the “Indemnification of FHA Single Family Mortgages Policy Statement” during our audit, and our report conclusions and recommendations reflect that review. Comment 2 We were unable to find in the “Quality Assurance Division Desk Guide” where it states the letter process is repeated until the findings are resolved or a final determination is made that the loan(s) do not meet FHA insurance requirements. Further, page 75 of the Guide states that the lender “may be” referred to the Mortgagee Review Board if the lender fails to take corrective actions, but the Guide does not provide criteria for when the lender will be referred or what alternative procedures are available if the lender is not referred. Finally, the Guide does not make reference to indemnification agreements in this section and it is not clear that they are part of this process. Comment 3 The Office of Single Family Housing states that lenders who choose not to sign the indemnification agreement or refuse to respond to Quality Assurance Division letters are referred to the Mortgagee Review Board for appropriate administrative action. This statement conflicts with statements on page 74 of the “Quality Assurance Division Desk Guide” and page 3 of the “Indemnification of FHA Single Family Mortgages Policy Statement” which both say lenders who refuse to sign “may be” referred to the Mortgagee Review Board. Comment 4 We were advised during our review that the Quality Assurance Division is in the process of drafting Standard Operating Procedures. It would be appropriate to include the written policies and procedures for pursuing indemnification agreements in the Standard Operating Procedures, and doing so should resolve the recommendation in this report. Comment 5 We held an exit meeting with the Office of Single Family Housing to discuss the report. During that meeting, the Office of Single Family Housing staff made several suggestions for wording changes in the report, and we made significant changes to the report based on that feedback. An objection to this statement was not mentioned during the exit meeting. Further, we did not intend for this statement to be inflammatory. We included supporting sentences to explain why Quality Assurance Division staff thought written policies and procedures for pursuing indemnification agreements was not necessary, and we believe the statement is accurate and adequately supported. 11
HUD's Written Policies and Procedures for Loan Indemnifications Were
Published by the Department of Housing and Urban Development, Office of Inspector General on 2010-09-28.
Below is a raw (and likely hideous) rendition of the original report. (PDF)