Issue Date June 14, 2011 Audit Report Number 2011-KC-0001 TO: Vicki Bott, Deputy Assistant Secretary for Single Family Housing, HU //signed// FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA SUBJECT: FHA Has Improved Its Annual Lender Renewal Process, but Challenges Remain HIGHLIGHTS What We Audited and Why We audited the Federal Housing Administration’s (FHA) Title II single-family lender renewal process. During our 2009 audit of FHA’s lender approval process, we noticed indications of weaknesses in the controls over FHA’s process to annually renew lenders’ status as FHA-approved lenders. Our objective was to determine whether the Lender Approval and Recertification Division’s (Division) controls were adequate for determining whether lenders met FHA annual renewal requirements. What We Found The Division had taken significant steps to strengthen its controls over the lender renewal process; however, additional improvements are needed. The process still had weaknesses related to Mortgagee Review Board referrals, lender financial information review, and data and renewal fee calculations in the Division’s lender recertification tracking system. These weaknesses resulted in an increased risk that noncompliant lenders were allowed to continue participating in the FHA program, the Division’s inability to effectively monitor lenders, and lenders paying lower fees than required. What We Recommend We recommend that the Deputy Assistant Secretary for Single Family Housing require the Division to improve controls over the lender recertification process and make changes to the Institutional Master File system to ensure data integrity. Auditee’s Response We provided the discussion draft to the U.S. Department of Housing and Urban Development (HUD) on April 1, 2011, and requested a response by May 2, 2011. HUD provided a response on May 19, 2011. HUD generally agreed with finding 1 and parts of finding 2 but disagreed with some of our recommendations. The complete text of the auditee’s response, along with our evaluation of that response, can be found in appendix B of this report. 2 TABLE OF CONTENTS Background and Objective 4 Results of Audit Finding 1: Control Weaknesses in FHA’s Lender Renewal Process Continued 7 To Impact Lender Oversight Finding 2: Data and Lender Fee Calculations in the Division’s Recertification 12 Tracking System Were Not Always Accurate Scope and Methodology 16 Internal Controls 18 Appendixes A. Schedule of Questioned Costs and Funds to Be Put to Better Use 20 B. Auditee Comments and OIG’s Evaluation 21 C. Lender Assessment Subsystem - Lenders’ Financial Statement Certification and 29 Financial Information Tab D. Lender Assessment Subsystem - Independent Public Accountant Attestation 30 3 BACKGROUND AND OBJECTIVES The Federal Housing Administration’s (FHA) mortgage insurance programs help low- and moderate-income families become homeowners by lowering some of the costs of their mortgages. FHA mortgage insurance encourages lenders to make loans to otherwise creditworthy borrowers who might not be able to meet conventional underwriting requirements by protecting the lender against default. Title II of the National Housing Act, Section 203(b) is FHA’s One- to Four-Family Mortgage Insurance Program. It expands homeownership opportunities for first-time home buyers and other borrowers who would not otherwise qualify for conventional mortgages on affordable terms, as well as for those who live in underserved areas where mortgages may be harder to get. These obligations are protected by FHA’s Mutual Mortgage Insurance Fund, which is sustained entirely by borrower insurance premiums. The HUD (U.S. Department of Housing and Urban Development) Reform Act of 1989, 12 U.S.C. (United States Code) 1708 established the Mortgagee Review Board and 24 CFR (Code of Federal Regulations) Part 25 outlines its duties and procedures. The Mortgagee Review Board consists of HUD officials, including the Assistant Secretaries of Housing and Fair Housing as well as key legal and finance personnel. The President of the Government National Mortgage Association is also a member of the board. FHA-approved lenders who knowingly and materially violate FHA program statutes, regulations, and handbook requirements are subject to administrative sanctions and civil monetary penalties by the Mortgagee Review Board. The Mortgagee Review Board meets monthly to rule on actions to be taken against noncompliant lenders. Lender Approval and Recertification Division The Lender Approval and Recertification Division (Division) is responsible for reviewing renewal items and referring noncompliant lenders to the Mortgagee Review Board for possible sanctions. The Division begins this legal process by preparing notices of violation for the Mortgagee Review Board. The Office of Lender Activities and Program Compliance oversees the Division. The HUD Administrative Proceedings Division of the Office of Associate General Counsel for Program Enforcement (Office of Program Enforcement) provides affirmative counsel, guidance, and support to the Division. In Mortgagee Review Board actions, attorneys evaluate potential cases for legal sufficiency and litigate cases on behalf of the Government. Before 2008, the Division had authority to withdraw lenders for failure to comply with FHA’s annual renewal requirements. The Division lost this authority due to a 2007 administrative hearing ruling (HUDALJ 07-052-MR). The hearing involved a lender that was withdrawn from the FHA program by the Division for not submitting its audited financial statements on time, although there were extenuating circumstances. The administrative law judge ruled that the lender was not given due process. 4 Significant Changes in Statutes and Regulations That Affected the Division In fiscal year 2009, the Federal Housing Commissioner issued mortgagee letters that changed the annual lender renewal process: Mortgagee Letter 2009-01, dated January 6, 2009, informed lenders that if they failed to complete the renewal requirements in an acceptable, timely manner, they might be brought before the Mortgagee Review Board. Mortgagee Letter 2009-25 became effective September 1, 2009, and required FHA- approved lenders seeking renewal to complete the electronic annual certification in FHA Connection. Mortgagee Letter 2009-31, dated September 18, 2009, implemented the Helping Families Save Their Homes Act of 2009. The letter included additional standards that an FHA program participant must meet and required notification of these standards after approval. It also expanded FHA’s ability to seek civil money penalties against any owners, officers, or directors of an FHA-approved lender for violations of program requirements. On April 20, 2010, HUD published the final rule change for the lender approval and renewal process. The final rule eliminated FHA approval of loan correspondents, increased the net worth requirements for FHA-approved lenders, codified requirements of the Helping Families Save Their Homes Act of 2009 (Public Law 111-22), and made minor modifications to other aspects of FHA’s regulations governing lender activities. Requirements for Maintaining Status as an FHA-Approved Lender To maintain status as an FHA-approved lender, lenders must electronically submit a yearly certification and pay an annual fee for their main and registered branch offices. This action had to be completed within 30 days of the lender’s fiscal yearend date. The date when this information is submitted is recorded in the Institutional Master File. The Institution Master File maintains the official record of lenders approved by FHA to originate, service, or invest in FHA- insured mortgages or loans. One of the principal objectives of the Institutional Master File is to consolidate information on the approval status of mortgagees and lenders participating in FHA’s insurance programs. Nonsupervised mortgagees were required to electronically submit annual audited financial statements and required reports that meet the requirements of the Secretary of HUD within 90 days of the lender’s fiscal yearend date. On November 17, 2010, FHA issued Mortgagee Letter 2010-38, which immediately changed the 30-day requirement for the certification and fees to 90 days. In addition, as discussed in Mortgagee Letter 2009-31, supervised mortgagees must submit audited financial statements to HUD beginning with the 2010 calendar year. The lender’s financial statement reporting package is submitted electronically through the Lender Assessment Subsystem. This system automatically triggers flags if the data in the reporting package violates established requirements. Lender reporting packages that trigger flags 5 require a manual review. Lender reporting packages that do not trigger flags are automatically approved by the system without review by the Division. Our audit objective was to determine whether the Division’s controls were adequate for determining whether lenders met FHA annual renewal requirements. 6 RESULTS OF AUDIT Finding 1: Control Weaknesses in FHA’s Lender Renewal Process Continued To Impact Lender Oversight FHA had weaknesses in its controls for determining whether lenders met their annual renewal requirements. This condition occurred because the Division could not establish effective controls quickly enough to keep pace with rapid internal and external business changes. As a result, the Division was less able to effectively monitor and assess the condition of the lenders and determine whether they posed a risk to HUD, its programs, or the public. FHA Had Improved Its Controls, but Weaknesses Remained FHA and the Division recently made significant changes that strengthened controls over the lender renewal process, including Requiring lenders to submit the annual certification electronically; Requiring each lender to register the names of the corporate officers who make its electronic annual renewal certifications; Adding new flags to the Lender Assessment Subsystem to identify lender financial statement deficiencies; and Sending lenders automated 60-, 30-, and 15-day e-mail reminders before the annual renewal due date. These changes, along with eliminating the FHA approval of loan correspondents, improved the effectiveness and efficiency of the lender renewal process. However, there were still some weaknesses in the process. Specifically, the Division Did not have written procedures for referring lenders to the Mortgagee Review Board, Did not have a reliable way to flag high-risk lenders for manual reviews, Did not have an effective method for ensuring the accuracy of lender financial data in the Lender Assessment Subsystem, and Did not include a notification of potential penalties in the lender’s financial statement certification. According to Office of Management and Budget (OMB) Circular A-123, management control is an integral component of an organization’s management that provides reasonable assurance that the following objectives are achieved: 7 effectiveness and efficiency of operations, reliability of reporting, and compliance with applicable laws and regulations. Management control activities include policies, procedures, and mechanisms in place to help ensure that agency objectives are met. The Division Lacked Written Procedures for Referring Lenders for Sanctions The Division did not have written procedures for referring lenders to the Mortgagee Review Board. With assistance from the Office of Program Enforcement, the Division developed informal policies and procedures for referring lenders that violated annual renewal requirements to the Mortgagee Review Board. This measure resulted in a process through which the Division conducted roundtable discussions to determine, on a case-by-case basis, which lenders are referred to the Mortgagee Review Board for sanctions, the recommended amount of civil money penalties assessed, and whether the lender should be terminated. This process did not always result in referring lenders that violated renewal requirements to the Mortgagee Review Board for sanctions, nor was the reason for not making those referrals apparent. A sound control system should include written procedures with predetermined actions to consistently guide the Division in making decisions about referring lenders to the Mortgagee Review Board. The Division Did Not Consistently Flag High-Risk Lenders for Review The Division did not have a reliable method for flagging high-risk lenders for manual reviews. The Lender Assessment Subsystem Standard Operating Procedures states that the Division will manually enter flags for high-risk lenders so that their financial statements will be manually reviewed. High-risk lenders are typically new or high-volume lenders or those that have experienced some types of past problems. However, more than 124 high-risk mortgagees with October 2008 through September 2009 fiscal yearends were not flagged for manual review. The Division was in the process of linking the Lender Assessment Subsystem with other systems containing lender data to automate the process of flagging high-risk lenders. However, we were unable to review the effectiveness of this improvement since it was not completed during our audit. 8 The Division’s Controls Over the Accuracy of Lender Data in Its System Were Not Effective The Division did not have an effective method for ensuring the accuracy of lender information in the Lender Assessment Subsystem. Each lender is responsible for entering its financial statement information into the Lender Assessment Subsystem. The lender’s independent public accountant is responsible for verifying that the information was entered accurately (appendix D). However, Lenders often entered inaccurate information into the Lender Assessment Subsystem data collection form for the financial statements (appendix C), and the independent public accountants did not identify that the data in this form was inaccurate. The Division’s contracted quality assurance auditors had also reported that lenders entered inaccurate financial information into the Lender Assessment Subsystem data collection form. They sampled a total of 436 lenders, the financial statements of which were auto-accepted by the Lender Assessment Subsystem, and found that more than 60 percent of these financial statements would have required correction before being accepted. The contracted auditors projected this percentage to the universe and determined that 2,657 of the 4,322 lender financial statements auto-accepted by the Lender Assessment Subsystem were deficient. The Division was improving the Lender Assessment Subsystem to better analyze data and create new flags in the system and planned to impose sanctions on independent public accountants that were responsible for verifying the information in the system. These are significant improvements. However, they alone will not adequately ensure that the financial statement data form information is accurate. The improvements will need to include a comparison of the data in the system to contents of the actual audit reports, financial statement footnotes, and audit findings. The Lender’s Financial Statement Certification Needs Strengthening The Division did not include a notification of potential penalties in the lender’s financial statement certification (appendix D). The current certification states: This is to certify that to the best of my knowledge and belief, the information contained in this submission – including but not limited to the 9 accompanying FDT [Financial Data Template], DCF [Data Collection Form], and Notes & Findings – is accurate and complete for the period …. By selecting Submit, I declare that the foregoing is true and correct. A notification of potential penalties included with this certification would strengthen the Division’s controls by ensuring that lenders are aware of the consequences of submitting inaccurate or incomplete data. The Division Had To Adapt to Internal and External Business Changes The Division could not establish effective controls quickly enough to keep pace with rapid internal and external business changes. When FHA lost the 2007 administrative hearing, it had to change the way that it took actions against lenders and create new policies and procedures. Before the administrative hearing, the Division could withdraw lenders that violated annual renewal requirements and reinstate these lenders when they became compliant. Now these lenders must be sent to the Mortgagee Review Board for administrative action. This requires a legal process that involves more resources. In addition, during this period, FHA named a new director of the Division and a new recertification branch chief. Further, there was a shortage of trained staff to review the financial statements and lender responses to financial statement deficiencies. There were also a number of external business changes. There was a large increase in the number of approved FHA lenders and, as reported in our prior audit report (2010-KC-0002, issued August 6, 2010), more than half of the lenders violated annual renewal requirements. Additionally, there were a number of changes in FHA statutes and regulations to strengthen FHA’s risk management. For example, Mortgagee Letter 2009-25 requires lenders to submit annual recertifications electronically and to provide the names and Social Security numbers of the officials that enter the electronic certifications on behalf of each lender. The Mortgage Letter provides that FHA will validate the required Social Security numbers. Additionally, the Helping Families Save Their Homes Act of 2009 contains provisions that provide limitations on those eligible to participate in FHA programs. The Annual Renewal of FHA Approval Requirements Is Critical to the Program As noted in Mortgagee Letter 2009-01, HUD considers the timely annual renewal of FHA approval requirements to be critical to its ability to adequately monitor and assess the condition of the lender and determine whether the lender poses a risk to HUD, its programs, or the public. We agree. 10 A lack of written policies and procedures for the annual renewal process can create inconsistencies in the treatment of noncompliant lenders. By not flagging high-risk lenders for manual reviews, the Division cannot be assured that it is devoting its monitoring resources in the highest risk areas. Inaccurate data in the Lender Assessment Subsystem inhibit effective assessments of lenders’ financial condition. And, without a notification of potential penalties in the lender’s financial statement certification, lenders will be less likely to be deterred from submitting false data, and HUD will be less likely to prevail in enforcement actions against lenders that submit false data. All of the above factors contributed to the Division’s being less able to effectively monitor and assess the condition of the lenders and determine whether they pose a risk to HUD, its programs, or the public. Conclusion Although the Division had made substantial improvements in controls over the annual recertification process, additional improvements are needed to ensure that lenders meet FHA eligibility requirements. The Division needs to adopt written procedures to ensure that lenders that violate annual renewal requirements are properly referred to the Mortgagee Review Board and are treated consistently. Controls relating to lender financial statement information need to be improved to ensure proper review of information received from high-risk lenders and to detect incorrect financial information in the Lender Assessment Subsystem. Financial information certifications need to be strengthened to discourage lenders from misrepresenting financial data in the Lender Assessment Subsystem. Establishing stronger controls and deterrents will ultimately reduce the workload of the Division and will reduce the risk to the FHA insurance fund. Recommendations We recommend that the Deputy Assistant Secretary for Single Family Housing require the Division to 1A. Improve controls over the lender recertification process by Preparing and implementing written procedures containing benchmarks for determining which noncompliant lenders should be referred to the Mortgagee Review Board for sanctions, Preparing and implementing written procedures to ensure that high- risk lenders’ financial statements are manually reviewed, Preparing and implementing procedures to ensure that the data in the Lender Assessment Subsystem are accurate and complete, and Adding a notification of potential penalties for false certification to the financial statement certification. 11 Finding 2: Data and Lender Fee Calculations in the Division’s Recertification Tracking System Were Not Always Accurate The Division’s system used to keep track of lenders’ annual renewal progress contained data and lender fee calculations that were not always accurate. This condition occurred because the Division did not develop sufficient controls to ensure data integrity. As a result, the Division could not accurately monitor the renewal status of lenders, and lenders paid lower fees than required. Inaccurate Data Existed in the Division’s System The dates and status codes in the Institution Master File system (System) were not always correct. This system was used by the Division to track each lender’s progress in the annual renewal process. The System contained annual renewal data including the status and date submitted for the annual certification, renewal fee, and audited financial statements. The System’s status and date information was not always accurate. For example, The System incorrectly showed 690 lenders with a “received” status for their annual certification and a “paid” status for their renewal fee. The receipt date in the system for the certification and fee payments was December 26, 2008. The Division told us that these lenders did not actually make a fee payment on that date because the fee was not owed. However, instead of entering a “not owed” status into the system for these lenders, the fee status was incorrectly reset to “paid” with a receipt date of December 26, 2008. The System showed conflicting status codes for 116 lenders. For these lenders, the system’s status code showed “new approval/reinstatement” for one or more of the required renewal items and a status code of “owed,” “received,” or “paid” for the other renewal items. If these lenders were actually reinstated or newly approved during the year, at least one of the status codes was not accurate since the renewal items would not have been due. If the lender was not newly approved or reinstated, the “new approval/reinstatement” code should not have been used. Lender Fees Were Not Calculated Correctly The System did not correctly calculate annual renewal fees for 458 lenders that added offices in the seventh month before their yearend. According to HUD Handbook 4060.1, REV-2, each lender was required to pay $500 for its main 12 office plus $200 for each branch registered for more than 6 months before its fiscal yearend date. For its fee calculation, the System captured only the lender’s yearend month and subtracted 6 months. For example, if a lender’s fiscal yearend month was December, the System used June for the branch cutoff date. However, the lender’s yearend date was actually December 31, so the sixth month cutoff date should have been July 1. Consequently, 266 main offices and 385 branches were incorrectly omitted from the fee calculation. The following graph depicts the date error for lenders with a December 31 yearend. Offices authorized during the month of June were excluded from the Division's fee calculation Lender FYE 12/31/2008 January February March April May June July August September October November December 1 2 3 4 5 6 7 8 9 10 11 12 Offices authorized before the Offices authorized during the last last 6 months of the lender's 6 months of the lender's fiscal fiscal yearend must be included yearend are excluded from the in the fee calculation fee calculation In addition, the System did not have a built-in cutoff date for lenders to delete branches. Before paying the annual renewal fees, 217 lenders were able to delete 973 branches in the System, although the branches were active beyond their previous fiscal yearend date. The Division Did Not Develop Sufficient Controls The Division did not develop sufficient controls to ensure data integrity and reliable data processing. It relied solely on the System to collect renewal data and calculate the renewal fees without verifying that the data were accurate. In addition, it did not perform testing of the payment calculation to determine whether the System computed the correct amount of fee. According to OMB Circular A-123, information systems controls should be designed to ensure that the data are valid and information processing is accurate. Further, HUD Handbook 1840.1 states that management controls are vital and must be in place to ensure that automated data processing is reliable. The Division was modifying its systems. However, the changes had not been implemented in time for review. 13 The Division Could Not Accurately Monitor Lenders To enforce renewal requirements, the Division must be able to efficiently monitor lender compliance. If a lender’s status in the System did not accurately reflect its renewal progress, the Division would not be able to readily determine whether the lender still owed a renewal item. Consequently, lenders could actively conduct FHA business without submitting the required renewal items. For example, a lender originated FHA mortgages without submitting its certification and fee because the System reported a status of satisfied instead of an “owed” status for all of the requirements. However, at that time, only the financial statements had been submitted, but the form and fee had not. Lenders Paid Lower Fees Than Required The data system issues allowed lenders to pay lower fees than required. FHA lenders with fiscal years ending October 1, 2008, through September 30, 2009, paid $404,600 less than they should have. The date error omitted 1 month’s worth of lender branches, accounting for $210,000 in lost fees. The lenders’ ability to delete branches after the payment was due resulted in an understatement of $194,600 in fees. The Scope and Methodology section shows the calculation of these amounts. Recommendations We recommend that the Deputy Assistant Secretary for Single Family Housing require the Division to 2A. Make changes to the System to ensure that The data accurately reflect the status of each lender’s recertification, The fee payment calculation includes each branch registered for more than 6 months before its fiscal yearend date, The system has a built-in cutoff date for lenders to delete branches, and An estimated $178,600 in future fees collected from mortgagees can be available for the purposes of the FHA single family insurance program. The calculation for the $178,600 is provided in the Scope and Methodology section. 14 2B. Collect $210,000 in underpaid fees from the 458 lenders that added offices in the seventh month before their yearend that were not used in the fee calculation and $194,600 from the 217 lenders that were able to delete 973 branches in the System that were active beyond their previous fiscal yearend date. The calculation of the unpaid fees is provided in the Scope and Methodology section. We will provide a list of these lenders to the Division. 15 SCOPE AND METHODOLOGY This audit is the second of two audits of FHA’s lender renewal process. During our initial audit, we noticed indications of weaknesses in the controls over the lender renewal process. Our audit covered 11,163 Title II lenders with October 2008 through September 2009 fiscal yearends that were required to submit annual recertification items. We expanded our scope as necessary. We conducted our fieldwork from October 2009 through November 2010 at the Division in Washington, DC, and in our office. To accomplish our objective, we Reviewed applicable laws and regulations; Interviewed appropriate Division and Office of General Council staff; Evaluated the Division’s manuals, quality control plan, and certification; Examined Mortgagee Review Board meeting documents; and Analyzed lender data contained in the Single Family Housing Enterprise Data Warehouse, Institutional Master File system, and the Lender Assessment Subsystem. We gained an understanding of the lender recertification process and procedures by interviewing HUD staff and reviewing the laws and regulations affecting FHA lender annual recertification. We examined the annual renewal and financial statement certifications to determine whether they complied with requirements and compared them to the lender approval certification. We evaluated the Division’s quality control plan, Lender Assessment Subsystem Standard Operating Procedures, and manual. We used lender data found in the Single Family Housing Enterprise Data Warehouse to identify high-risk lenders as defined in the Lender Assessment Subsystem manual. We compared the high-risk lenders with the list of lenders provided by the Division that were automatically approved through the Lender Assessment Subsystem. We also identified high-risk lenders with deficient net worth and/or liquidity. We relied on work performed by the Division’s quality assurance auditors. The auditors worked for a certified public accounting firm, and the work performed was compliant with generally accepted government auditing standards. We evaluated the quality assurance auditors’ qualifications and reviewed their quality assurance reports. The quality assurance auditors selected a random sample of lenders’ financial statements that auto-completed through the Lender Assessment Subsystem to determine whether the financial statements complied with FHA requirements. We reviewed a sample of the lenders audited financial statements and agreed with the quality assurance auditor’s opinion. The work done by the quality assurance auditors was sufficiently reliable to satisfy our audit objective. We evaluated the amount of the annual renewal fees associated with October 2008 through September 2009 fiscal yearend lenders. The Division provided lender amounts paid and due from the Institution Master File, and we obtained data from the Single Family Housing Enterprise Data Warehouse to analyze the fees calculated by the Institution Master File system. We also requested the programming code used for the fee calculation. We determined what the fee calculation should be and the lender branches that were omitted because of the fiscal yearend 16 date error based on the regulations. There were 385 branches and 266 offices omitted from the fee payments. With a $200 per branch fee and a $500 per office fee, the Division did not collect $210,000 in annual fees ((385 x $200) + (266 x $500)). We then quantified how many branches were left out of the fee calculation because a cutoff date was not established for branch deletion by using the authorized date, termination date, and fiscal yearend of the lenders and their branches. There were 973 lender branches terminated after the fee due date but before the late payment was made. At $200 per branch, the Division did not collect $194,600 (973 x $200). To estimate the amount of funds to be put to a better use, we removed the amounts in the 2 calculations above that were associated with loan correspondents because only mortgages will be required to register in the future. For the mortgagees, there were 269 branches and 28 offices omitted from the fee payments. With a $200 per branch fee and a $500 per mortgagee office fee, the Division did not collect $67,800 ((269 x $200) + (28 x $500)). Additionally, for the mortgagees there were 554 branches terminated after the fee due date but before the late payment was made. At $200 per mortgagee branch, the Division did not collect $110,800 (554 x $200). We used the sum of these amounts as our estimated $178,600 funds to be put to better use in Appendix A. We assessed the reliability of the Lender Assessment Subsystem and Institution Master File data by performing electronic testing for erroneous and incomplete data. The Institution Master File system contained inaccurate data as reported in finding 2, and the Lender Assessment Subsystem contained duplicate records. We removed those discrepancies, such as inaccurate submission status and dates and inconsistencies between the recertification items, from the data before our analysis. We did not assess the reliability of the Single Family Housing Enterprise Data Warehouse data as the data were used solely to demonstrate the potential impact of the finding. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 17 INTERNAL CONTROLS Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to Effectiveness and efficiency of operations, Reliability of management reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objectives: Policies and procedures for the annual renewal process. Effective system controls for certifications, fee payments, and lender financial reporting packages. Lender certifications. Management reporting for monitoring the annual renewal process. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following items are significant deficiencies: The Division lacked written procedures for referring lenders to the Mortgagee Review Board and lacked adequate controls over the review of lender audited financial statement packages (finding 1). 18 The Division did not develop sufficient controls in the Institutional Master File system to ensure data integrity and reliable data processing (finding 2). 19 APPENDIXES Appendix A SCHEDULE OF QUESTIONED COSTS AND FUNDS TO BE PUT TO BETTER USE Recommendation Ineligible 1/ Funds to be put to better use 2/ number 2A $178,600 2B $404,600 1/ Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity that the auditor believes are not allowable by law; contract; or Federal, State, or local policies or regulations. 2/ Recommendations that funds be put to better use are estimates of amounts that could be used more efficiently if an Office of Inspector General (OIG) recommendation is implemented. These amounts include reductions in outlays, deobligation of funds, withdrawal of interest, costs not incurred by implementing recommended improvements, avoidance of unnecessary expenditures noted in preaward reviews, and any other savings that are specifically identified. For this instance, this is the amount of additional future fees that will be collected if the Division implements our recommendations. The calculation of this amount is described in the Scope and Methodology section of the report. 20 Appendix B AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 21 Ref to OIG Evaluation Auditee Comments Comment 2 Comment 3 22 Ref to OIG Evaluation Auditee Comments Comment 4 23 Ref to OIG Evaluation Auditee Comments Comment 5 24 Ref to OIG Evaluation Auditee Comments Comment 6 Comment 7 Comment 8 25 Ref to OIG Evaluation Auditee Comments Comment 9 Comment 10 Comment 11 26 OIG Evaluation of Auditee Comments Comment 1: In several areas of its comments, FHA states that it has made changes to improve its lender renewal process. None of the changes were in place when we did our audit work so we have not evaluated their implementation or effectiveness. However, if the changes are implemented consistently, they should help improve the controls over the recertification process. Comment 2: During the audit, the Division provided draft written standard operating procedures. However these procedures only specified referring lenders to the Mortgagee Review Board for submitting recertification items late. There was no other guidance in the procedures that specified Mortgagee Review Board referral for other violations such as insufficient lender net worth or liquidity. Comment 3: Although the Division has begun implementing a more in-depth review of lenders, these controls were not fully in place during our audit scope and therefore have not been reviewed. Comment 4: As noted in finding 1, we considered the changes required in the administrative process due to the 2007 ruling, and acknowledged the improvements made that strengthened controls over the lender renewal process. Comment 5: Included in the deficiencies were reports that did not state that the audits were conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS). Without the report being prepared in accordance with GAGAS, including an adequate major compliance report and required disclosures, FHA cannot ensure that deficiencies would not pose an immediate threat to the public or the FHA insurance fund Comment 6: The Division did not provide any internal policies and procedures that would explain the inconsistencies we found in the data. The status codes in the system need to accurately show any change in lender status so that the Division can ensure that the lender submits the correct recertification items. Since the Division relies on this system to monitor each lender’s recertification, we continue to recommend that it makes changes to the system to ensure the data accurately reflect each lender’s recertification status. Comment 7: We agree that lenders are not likely to delete a branch then immediately reinstate the branch. Nonetheless, as noted in finding 2, 217 lenders were able to delete 973 branches. These branches were active in the system and could originate FHA loans beyond the recertification payment due date of 30 days past the lenders’ fiscal year end dates. 317 of these branches remained active and were not deleted until at least 90 days past the lenders’ fiscal year end dates. Comment 8: We will provide the loan activity for the deleted branches referred to in the report under separate cover. 27 Comment 9: OLAPC is correct in its understanding that OIG will not be evaluating the $178,600 in future audits. This is just an estimate of the monetary benefit of implementing the recommendation. Comment 10: HUD Handbook 4060.1 REV 2 chapter 4 states that a lender must remit an annual fee for its main office and any branch registered at least six months prior to the lender’s fiscal yearend. Therefore, renewal fees are due for branches added seven months prior to the fiscal yearend. Comment 11: We will consider a cost benefit analysis of collecting the unpaid fees from the 675 lenders from the Office of Lender Activities and Program Compliance. 28 Appendix C LENDER ASSESSMENT SUBSYSTEM - LENDERS’ FINANCIAL STATEMENT CERTIFICATION AND FINANCIAL INFORMATION TAB Financial Statement Certification Data Collections Form, Financial Statements Information Tab 29 Appendix D LENDER ASSESSMENT SUBSYSTEM - INDEPENDENT PUBLIC ACCOUNTANT ATTESTATION Attestation Agreed-Upon Procedures The independent public accountant attests to the lender’s submission once it is submitted for review. The agreed-upon procedures ensure the financial data entered into the Lender Assessment Subsystem by the lender are accurate and tie to the lender’s hardcopy financial statements. By clicking the “Agrees” option button, the independent public accountant attests to the statements listed in the second paragraph of the independent public accountant’s report. We conducted our audit of compliance with those requirements in accordance with auditing standards generally accepted in the United States of America, Government Auditing Standards, issued by the Comptroller General of the United States, and the Consolidated Audit Guide for Audits for HUD Programs (the “Guide”), issued by the U.S. Department of Housing and Urban Development, Office of Inspector General. Those standards and the Guide require that we plan and perform the audit to obtain reasonable assurance about whether material noncompliance with the requirements referred to above occurred. An audit includes examining, on a test basis, evidence about the Company’s compliance with those requirements. We believe that our audit provides a reasonable basis for our opinion. 30 Independent Public Accountant’s Verification of Financial Information and Attachments 31
FHA Has Improved Its Annual Lender Renewal Process, but Challenges Remain
Published by the Department of Housing and Urban Development, Office of Inspector General on 2011-07-14.
Below is a raw (and likely hideous) rendition of the original report. (PDF)