oversight

FHA Has Improved Its Annual Lender Renewal Process, but Challenges Remain

Published by the Department of Housing and Urban Development, Office of Inspector General on 2011-07-14.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                                  Issue Date
                                                                               June 14, 2011
                                                                  
                                                                  Audit Report Number
                                                                           2011-KC-0001




TO:        Vicki Bott, Deputy Assistant Secretary for Single Family Housing, HU

           //signed//
FROM:      Ronald J. Hosking, Regional Inspector General for Audit, 7AGA

SUBJECT: FHA Has Improved Its Annual Lender Renewal Process, but Challenges Remain


                                    HIGHLIGHTS

 What We Audited and Why

             We audited the Federal Housing Administration’s (FHA) Title II single-family
             lender renewal process. During our 2009 audit of FHA’s lender approval process,
             we noticed indications of weaknesses in the controls over FHA’s process to
             annually renew lenders’ status as FHA-approved lenders. Our objective was to
             determine whether the Lender Approval and Recertification Division’s (Division)
             controls were adequate for determining whether lenders met FHA annual renewal
             requirements.

 What We Found

             The Division had taken significant steps to strengthen its controls over the lender
             renewal process; however, additional improvements are needed. The process still
             had weaknesses related to Mortgagee Review Board referrals, lender financial
             information review, and data and renewal fee calculations in the Division’s lender
             recertification tracking system. These weaknesses resulted in an increased risk
             that noncompliant lenders were allowed to continue participating in the FHA
             program, the Division’s inability to effectively monitor lenders, and lenders
             paying lower fees than required.
What We Recommend


           We recommend that the Deputy Assistant Secretary for Single Family Housing
           require the Division to improve controls over the lender recertification process
           and make changes to the Institutional Master File system to ensure data integrity.

Auditee’s Response


           We provided the discussion draft to the U.S. Department of Housing and Urban
           Development (HUD) on April 1, 2011, and requested a response by May 2, 2011.
           HUD provided a response on May 19, 2011. HUD generally agreed with finding
           1 and parts of finding 2 but disagreed with some of our recommendations. The
           complete text of the auditee’s response, along with our evaluation of that
           response, can be found in appendix B of this report.




                                           2
                            TABLE OF CONTENTS

Background and Objective                                                               4

Results of Audit
      Finding 1: Control Weaknesses in FHA’s Lender Renewal Process Continued          7
                 To Impact Lender Oversight
      Finding 2: Data and Lender Fee Calculations in the Division’s Recertification   12
                 Tracking System Were Not Always Accurate

Scope and Methodology                                                                 16

Internal Controls                                                                     18

Appendixes
   A. Schedule of Questioned Costs and Funds to Be Put to Better Use                  20
   B. Auditee Comments and OIG’s Evaluation                                           21
   C. Lender Assessment Subsystem - Lenders’ Financial Statement Certification and    29
      Financial Information Tab
   D. Lender Assessment Subsystem - Independent Public Accountant Attestation         30




                                             3
                     BACKGROUND AND OBJECTIVES

The Federal Housing Administration’s (FHA) mortgage insurance programs help low- and
moderate-income families become homeowners by lowering some of the costs of their
mortgages. FHA mortgage insurance encourages lenders to make loans to otherwise
creditworthy borrowers who might not be able to meet conventional underwriting requirements
by protecting the lender against default.

Title II of the National Housing Act, Section 203(b) is FHA’s One- to Four-Family Mortgage
Insurance Program. It expands homeownership opportunities for first-time home buyers and
other borrowers who would not otherwise qualify for conventional mortgages on affordable
terms, as well as for those who live in underserved areas where mortgages may be harder to get.
These obligations are protected by FHA’s Mutual Mortgage Insurance Fund, which is sustained
entirely by borrower insurance premiums.

The HUD (U.S. Department of Housing and Urban Development) Reform Act of 1989, 12
U.S.C. (United States Code) 1708 established the Mortgagee Review Board and 24 CFR (Code
of Federal Regulations) Part 25 outlines its duties and procedures. The Mortgagee Review
Board consists of HUD officials, including the Assistant Secretaries of Housing and Fair
Housing as well as key legal and finance personnel. The President of the Government National
Mortgage Association is also a member of the board. FHA-approved lenders who knowingly
and materially violate FHA program statutes, regulations, and handbook requirements are subject
to administrative sanctions and civil monetary penalties by the Mortgagee Review Board. The
Mortgagee Review Board meets monthly to rule on actions to be taken against noncompliant
lenders.

Lender Approval and Recertification Division

The Lender Approval and Recertification Division (Division) is responsible for reviewing
renewal items and referring noncompliant lenders to the Mortgagee Review Board for possible
sanctions. The Division begins this legal process by preparing notices of violation for the
Mortgagee Review Board. The Office of Lender Activities and Program Compliance oversees
the Division.

The HUD Administrative Proceedings Division of the Office of Associate General Counsel for
Program Enforcement (Office of Program Enforcement) provides affirmative counsel, guidance,
and support to the Division. In Mortgagee Review Board actions, attorneys evaluate potential
cases for legal sufficiency and litigate cases on behalf of the Government.

Before 2008, the Division had authority to withdraw lenders for failure to comply with FHA’s
annual renewal requirements. The Division lost this authority due to a 2007 administrative
hearing ruling (HUDALJ 07-052-MR). The hearing involved a lender that was withdrawn from
the FHA program by the Division for not submitting its audited financial statements on time,
although there were extenuating circumstances. The administrative law judge ruled that the
lender was not given due process.


                                               4
Significant Changes in Statutes and Regulations That Affected the Division

In fiscal year 2009, the Federal Housing Commissioner issued mortgagee letters that changed the
annual lender renewal process:

      Mortgagee Letter 2009-01, dated January 6, 2009, informed lenders that if they failed to
       complete the renewal requirements in an acceptable, timely manner, they might be
       brought before the Mortgagee Review Board.
      Mortgagee Letter 2009-25 became effective September 1, 2009, and required FHA-
       approved lenders seeking renewal to complete the electronic annual certification in FHA
       Connection.
      Mortgagee Letter 2009-31, dated September 18, 2009, implemented the Helping Families
       Save Their Homes Act of 2009. The letter included additional standards that an FHA
       program participant must meet and required notification of these standards after approval.
       It also expanded FHA’s ability to seek civil money penalties against any owners, officers,
       or directors of an FHA-approved lender for violations of program requirements.

On April 20, 2010, HUD published the final rule change for the lender approval and renewal
process. The final rule eliminated FHA approval of loan correspondents, increased the net worth
requirements for FHA-approved lenders, codified requirements of the Helping Families Save
Their Homes Act of 2009 (Public Law 111-22), and made minor modifications to other aspects
of FHA’s regulations governing lender activities.

Requirements for Maintaining Status as an FHA-Approved Lender

To maintain status as an FHA-approved lender, lenders must electronically submit a yearly
certification and pay an annual fee for their main and registered branch offices. This action had
to be completed within 30 days of the lender’s fiscal yearend date. The date when this
information is submitted is recorded in the Institutional Master File. The Institution Master File
maintains the official record of lenders approved by FHA to originate, service, or invest in FHA-
insured mortgages or loans. One of the principal objectives of the Institutional Master File is to
consolidate information on the approval status of mortgagees and lenders participating in FHA’s
insurance programs.

Nonsupervised mortgagees were required to electronically submit annual audited financial
statements and required reports that meet the requirements of the Secretary of HUD within 90
days of the lender’s fiscal yearend date. On November 17, 2010, FHA issued Mortgagee Letter
2010-38, which immediately changed the 30-day requirement for the certification and fees to 90
days. In addition, as discussed in Mortgagee Letter 2009-31, supervised mortgagees must submit
audited financial statements to HUD beginning with the 2010 calendar year.

The lender’s financial statement reporting package is submitted electronically through the
Lender Assessment Subsystem. This system automatically triggers flags if the data in the
reporting package violates established requirements. Lender reporting packages that trigger flags




                                                5
require a manual review. Lender reporting packages that do not trigger flags are automatically
approved by the system without review by the Division.

Our audit objective was to determine whether the Division’s controls were adequate for
determining whether lenders met FHA annual renewal requirements.




                                               6
                                 RESULTS OF AUDIT

Finding 1: Control Weaknesses in FHA’s Lender Renewal Process
Continued To Impact Lender Oversight
FHA had weaknesses in its controls for determining whether lenders met their annual renewal
requirements. This condition occurred because the Division could not establish effective controls
quickly enough to keep pace with rapid internal and external business changes. As a result, the
Division was less able to effectively monitor and assess the condition of the lenders and determine
whether they posed a risk to HUD, its programs, or the public.



 FHA Had Improved Its
 Controls, but Weaknesses
 Remained

           FHA and the Division recently made significant changes that strengthened controls
           over the lender renewal process, including

                  Requiring lenders to submit the annual certification electronically;
                  Requiring each lender to register the names of the corporate officers who
                   make its electronic annual renewal certifications;
                  Adding new flags to the Lender Assessment Subsystem to identify lender
                   financial statement deficiencies; and
                  Sending lenders automated 60-, 30-, and 15-day e-mail reminders before the
                   annual renewal due date.

           These changes, along with eliminating the FHA approval of loan correspondents,
           improved the effectiveness and efficiency of the lender renewal process.

           However, there were still some weaknesses in the process. Specifically, the Division

                  Did not have written procedures for referring lenders to the Mortgagee
                   Review Board,
                  Did not have a reliable way to flag high-risk lenders for manual reviews,
                  Did not have an effective method for ensuring the accuracy of lender financial
                   data in the Lender Assessment Subsystem, and
                  Did not include a notification of potential penalties in the lender’s financial
                   statement certification.

               According to Office of Management and Budget (OMB) Circular A-123,
               management control is an integral component of an organization’s management
               that provides reasonable assurance that the following objectives are achieved:


                                                 7
           effectiveness and efficiency of operations, reliability of reporting, and compliance
           with applicable laws and regulations. Management control activities include
           policies, procedures, and mechanisms in place to help ensure that agency
           objectives are met.

The Division Lacked Written
Procedures for Referring
Lenders for Sanctions

           The Division did not have written procedures for referring lenders to the
           Mortgagee Review Board. With assistance from the Office of Program
           Enforcement, the Division developed informal policies and procedures for
           referring lenders that violated annual renewal requirements to the Mortgagee
           Review Board. This measure resulted in a process through which the Division
           conducted roundtable discussions to determine, on a case-by-case basis, which
           lenders are referred to the Mortgagee Review Board for sanctions, the
           recommended amount of civil money penalties assessed, and whether the lender
           should be terminated.

           This process did not always result in referring lenders that violated renewal
           requirements to the Mortgagee Review Board for sanctions, nor was the reason
           for not making those referrals apparent. A sound control system should include
           written procedures with predetermined actions to consistently guide the Division
           in making decisions about referring lenders to the Mortgagee Review Board.

The Division Did Not
Consistently Flag High-Risk
Lenders for Review

           The Division did not have a reliable method for flagging high-risk lenders for
           manual reviews. The Lender Assessment Subsystem Standard Operating
           Procedures states that the Division will manually enter flags for high-risk lenders
           so that their financial statements will be manually reviewed. High-risk lenders
           are typically new or high-volume lenders or those that have experienced some
           types of past problems. However, more than 124 high-risk mortgagees with
           October 2008 through September 2009 fiscal yearends were not flagged for
           manual review.

           The Division was in the process of linking the Lender Assessment Subsystem
           with other systems containing lender data to automate the process of flagging
           high-risk lenders. However, we were unable to review the effectiveness of this
           improvement since it was not completed during our audit.




                                            8
The Division’s Controls Over
the Accuracy of Lender Data in
Its System Were Not Effective


            The Division did not have an effective method for ensuring the accuracy of lender
            information in the Lender Assessment Subsystem. Each lender is responsible for
            entering its financial statement information into the Lender Assessment
            Subsystem. The lender’s independent public accountant is responsible for
            verifying that the information was entered accurately (appendix D). However,
            Lenders often entered inaccurate information into the Lender Assessment
            Subsystem data collection form for the financial statements (appendix C), and the
            independent public accountants did not identify that the data in this form was
            inaccurate.

            The Division’s contracted quality assurance auditors had also reported that
            lenders entered inaccurate financial information into the Lender Assessment
            Subsystem data collection form. They sampled a total of 436 lenders, the
            financial statements of which were auto-accepted by the Lender Assessment
            Subsystem, and found that more than 60 percent of these financial statements
            would have required correction before being accepted. The contracted auditors
            projected this percentage to the universe and determined that 2,657 of the 4,322
            lender financial statements auto-accepted by the Lender Assessment Subsystem
            were deficient.

            The Division was improving the Lender Assessment Subsystem to better analyze
            data and create new flags in the system and planned to impose sanctions on
            independent public accountants that were responsible for verifying the
            information in the system. These are significant improvements. However, they
            alone will not adequately ensure that the financial statement data form
            information is accurate. The improvements will need to include a comparison of
            the data in the system to contents of the actual audit reports, financial statement
            footnotes, and audit findings.

The Lender’s Financial
Statement Certification Needs
Strengthening

            The Division did not include a notification of potential penalties in the lender’s
            financial statement certification (appendix D).

            The current certification states:

               This is to certify that to the best of my knowledge and belief, the
               information contained in this submission – including but not limited to the



                                                9
                accompanying FDT [Financial Data Template], DCF [Data Collection
                Form], and Notes & Findings – is accurate and complete for the period ….
                By selecting Submit, I declare that the foregoing is true and correct.

            A notification of potential penalties included with this certification would
            strengthen the Division’s controls by ensuring that lenders are aware of the
            consequences of submitting inaccurate or incomplete data.

 The Division Had To Adapt to
 Internal and External Business
 Changes

            The Division could not establish effective controls quickly enough to keep pace
            with rapid internal and external business changes. When FHA lost the 2007
            administrative hearing, it had to change the way that it took actions against
            lenders and create new policies and procedures. Before the administrative
            hearing, the Division could withdraw lenders that violated annual renewal
            requirements and reinstate these lenders when they became compliant. Now these
            lenders must be sent to the Mortgagee Review Board for administrative action.
            This requires a legal process that involves more resources. In addition, during
            this period, FHA named a new director of the Division and a new recertification
            branch chief. Further, there was a shortage of trained staff to review the financial
            statements and lender responses to financial statement deficiencies.

            There were also a number of external business changes. There was a large
            increase in the number of approved FHA lenders and, as reported in our prior
            audit report (2010-KC-0002, issued August 6, 2010), more than half of the
            lenders violated annual renewal requirements. Additionally, there were a number
            of changes in FHA statutes and regulations to strengthen FHA’s risk management.
            For example, Mortgagee Letter 2009-25 requires lenders to submit annual
            recertifications electronically and to provide the names and Social Security
            numbers of the officials that enter the electronic certifications on behalf of each
            lender. The Mortgage Letter provides that FHA will validate the required Social
            Security numbers. Additionally, the Helping Families Save Their Homes Act of
            2009 contains provisions that provide limitations on those eligible to participate in
            FHA programs.

The Annual Renewal of FHA
Approval Requirements Is
Critical to the Program

            As noted in Mortgagee Letter 2009-01, HUD considers the timely annual renewal
            of FHA approval requirements to be critical to its ability to adequately monitor
            and assess the condition of the lender and determine whether the lender poses a
            risk to HUD, its programs, or the public. We agree.


                                             10
             A lack of written policies and procedures for the annual renewal process can
             create inconsistencies in the treatment of noncompliant lenders. By not flagging
             high-risk lenders for manual reviews, the Division cannot be assured that it is
             devoting its monitoring resources in the highest risk areas. Inaccurate data in the
             Lender Assessment Subsystem inhibit effective assessments of lenders’ financial
             condition. And, without a notification of potential penalties in the lender’s
             financial statement certification, lenders will be less likely to be deterred from
             submitting false data, and HUD will be less likely to prevail in enforcement
             actions against lenders that submit false data.

             All of the above factors contributed to the Division’s being less able to effectively
             monitor and assess the condition of the lenders and determine whether they pose a
             risk to HUD, its programs, or the public.

Conclusion

             Although the Division had made substantial improvements in controls over the
             annual recertification process, additional improvements are needed to ensure that
             lenders meet FHA eligibility requirements. The Division needs to adopt written
             procedures to ensure that lenders that violate annual renewal requirements are
             properly referred to the Mortgagee Review Board and are treated consistently.
             Controls relating to lender financial statement information need to be improved to
             ensure proper review of information received from high-risk lenders and to detect
             incorrect financial information in the Lender Assessment Subsystem. Financial
             information certifications need to be strengthened to discourage lenders from
             misrepresenting financial data in the Lender Assessment Subsystem. Establishing
             stronger controls and deterrents will ultimately reduce the workload of the
             Division and will reduce the risk to the FHA insurance fund.

Recommendations

             We recommend that the Deputy Assistant Secretary for Single Family Housing
             require the Division to

             1A.    Improve controls over the lender recertification process by
                     Preparing and implementing written procedures containing
                       benchmarks for determining which noncompliant lenders should be
                       referred to the Mortgagee Review Board for sanctions,
                     Preparing and implementing written procedures to ensure that high-
                       risk lenders’ financial statements are manually reviewed,
                     Preparing and implementing procedures to ensure that the data in the
                       Lender Assessment Subsystem are accurate and complete, and
                     Adding a notification of potential penalties for false certification to the
                       financial statement certification.


                                              11
Finding 2: Data and Lender Fee Calculations in the Division’s
Recertification Tracking System Were Not Always Accurate
The Division’s system used to keep track of lenders’ annual renewal progress contained data and
lender fee calculations that were not always accurate. This condition occurred because the
Division did not develop sufficient controls to ensure data integrity. As a result, the Division
could not accurately monitor the renewal status of lenders, and lenders paid lower fees than
required.



 Inaccurate Data Existed in the
 Division’s System


              The dates and status codes in the Institution Master File system (System) were not
              always correct. This system was used by the Division to track each lender’s
              progress in the annual renewal process. The System contained annual renewal
              data including the status and date submitted for the annual certification, renewal
              fee, and audited financial statements. The System’s status and date information
              was not always accurate. For example,
                     The System incorrectly showed 690 lenders with a “received” status for
                      their annual certification and a “paid” status for their renewal fee. The
                      receipt date in the system for the certification and fee payments was
                      December 26, 2008. The Division told us that these lenders did not
                      actually make a fee payment on that date because the fee was not owed.
                      However, instead of entering a “not owed” status into the system for these
                      lenders, the fee status was incorrectly reset to “paid” with a receipt date of
                      December 26, 2008.
                     The System showed conflicting status codes for 116 lenders. For these
                      lenders, the system’s status code showed “new approval/reinstatement” for
                      one or more of the required renewal items and a status code of “owed,”
                      “received,” or “paid” for the other renewal items. If these lenders were
                      actually reinstated or newly approved during the year, at least one of the
                      status codes was not accurate since the renewal items would not have been
                      due. If the lender was not newly approved or reinstated, the “new
                      approval/reinstatement” code should not have been used.

 Lender Fees Were Not
 Calculated Correctly

              The System did not correctly calculate annual renewal fees for 458 lenders that
              added offices in the seventh month before their yearend. According to HUD
              Handbook 4060.1, REV-2, each lender was required to pay $500 for its main


                                                12
             office plus $200 for each branch registered for more than 6 months before its
             fiscal yearend date. For its fee calculation, the System captured only the lender’s
             yearend month and subtracted 6 months. For example, if a lender’s fiscal
             yearend month was December, the System used June for the branch cutoff date.
             However, the lender’s yearend date was actually December 31, so the sixth
             month cutoff date should have been July 1. Consequently, 266 main offices and
             385 branches were incorrectly omitted from the fee calculation. The following
             graph depicts the date error for lenders with a December 31 yearend.

                                                        Offices authorized 
                                                        during  the month 
                                                           of June were 
                                                        excluded from the 
                                                          Division's fee 
                                                            calculation                                                      Lender FYE 
                                                                                                                             12/31/2008



      January February    March       April     May          June        July   August September October November December

        1        2           3         4          5            6          7       8           9         10          11       12
                     Offices  authorized before the                                   Offices  authorized during the last 
                     last 6 months of the lender's                                    6 months of the lender's fiscal
                     fiscal yearend must be included                                  yearend are excluded from the 
                     in the fee calculation                                           fee calculation




             In addition, the System did not have a built-in cutoff date for lenders to delete
             branches. Before paying the annual renewal fees, 217 lenders were able to delete
             973 branches in the System, although the branches were active beyond their
             previous fiscal yearend date.

The Division Did Not Develop
Sufficient Controls

             The Division did not develop sufficient controls to ensure data integrity and
             reliable data processing. It relied solely on the System to collect renewal data and
             calculate the renewal fees without verifying that the data were accurate. In
             addition, it did not perform testing of the payment calculation to determine
             whether the System computed the correct amount of fee.

             According to OMB Circular A-123, information systems controls should be
             designed to ensure that the data are valid and information processing is accurate.
             Further, HUD Handbook 1840.1 states that management controls are vital and
             must be in place to ensure that automated data processing is reliable.

             The Division was modifying its systems. However, the changes had not been
             implemented in time for review.


                                                                    13
The Division Could Not
Accurately Monitor Lenders


           To enforce renewal requirements, the Division must be able to efficiently monitor
           lender compliance. If a lender’s status in the System did not accurately reflect its
           renewal progress, the Division would not be able to readily determine whether the
           lender still owed a renewal item. Consequently, lenders could actively conduct
           FHA business without submitting the required renewal items.

           For example, a lender originated FHA mortgages without submitting its
           certification and fee because the System reported a status of satisfied instead of an
           “owed” status for all of the requirements. However, at that time, only the
           financial statements had been submitted, but the form and fee had not.

Lenders Paid Lower Fees Than
Required

           The data system issues allowed lenders to pay lower fees than required. FHA
           lenders with fiscal years ending October 1, 2008, through September 30, 2009,
           paid $404,600 less than they should have. The date error omitted 1 month’s
           worth of lender branches, accounting for $210,000 in lost fees. The lenders’
           ability to delete branches after the payment was due resulted in an understatement
           of $194,600 in fees. The Scope and Methodology section shows the calculation
           of these amounts.


Recommendations

           We recommend that the Deputy Assistant Secretary for Single Family Housing
           require the Division to

           2A.    Make changes to the System to ensure that

                     The data accurately reflect the status of each lender’s recertification,
                     The fee payment calculation includes each branch registered for more
                      than 6 months before its fiscal yearend date,
                     The system has a built-in cutoff date for lenders to delete branches,
                      and
                     An estimated $178,600 in future fees collected from mortgagees can
                      be available for the purposes of the FHA single family insurance
                      program. The calculation for the $178,600 is provided in the Scope
                      and Methodology section.




                                            14
2B.   Collect $210,000 in underpaid fees from the 458 lenders that added offices
      in the seventh month before their yearend that were not used in the fee
      calculation and $194,600 from the 217 lenders that were able to delete 973
      branches in the System that were active beyond their previous fiscal
      yearend date. The calculation of the unpaid fees is provided in the Scope
      and Methodology section. We will provide a list of these lenders to the
      Division.




                              15
                         SCOPE AND METHODOLOGY

This audit is the second of two audits of FHA’s lender renewal process. During our initial audit,
we noticed indications of weaknesses in the controls over the lender renewal process. Our audit
covered 11,163 Title II lenders with October 2008 through September 2009 fiscal yearends that
were required to submit annual recertification items. We expanded our scope as necessary. We
conducted our fieldwork from October 2009 through November 2010 at the Division in
Washington, DC, and in our office.

To accomplish our objective, we

      Reviewed applicable laws and regulations;
      Interviewed appropriate Division and Office of General Council staff;
      Evaluated the Division’s manuals, quality control plan, and certification;
      Examined Mortgagee Review Board meeting documents; and
      Analyzed lender data contained in the Single Family Housing Enterprise Data
       Warehouse, Institutional Master File system, and the Lender Assessment Subsystem.
We gained an understanding of the lender recertification process and procedures by interviewing
HUD staff and reviewing the laws and regulations affecting FHA lender annual recertification.
We examined the annual renewal and financial statement certifications to determine whether
they complied with requirements and compared them to the lender approval certification. We
evaluated the Division’s quality control plan, Lender Assessment Subsystem Standard Operating
Procedures, and manual. We used lender data found in the Single Family Housing Enterprise
Data Warehouse to identify high-risk lenders as defined in the Lender Assessment Subsystem
manual. We compared the high-risk lenders with the list of lenders provided by the Division that
were automatically approved through the Lender Assessment Subsystem. We also identified
high-risk lenders with deficient net worth and/or liquidity.

We relied on work performed by the Division’s quality assurance auditors. The auditors worked
for a certified public accounting firm, and the work performed was compliant with generally
accepted government auditing standards. We evaluated the quality assurance auditors’
qualifications and reviewed their quality assurance reports. The quality assurance auditors
selected a random sample of lenders’ financial statements that auto-completed through the
Lender Assessment Subsystem to determine whether the financial statements complied with
FHA requirements. We reviewed a sample of the lenders audited financial statements and
agreed with the quality assurance auditor’s opinion. The work done by the quality assurance
auditors was sufficiently reliable to satisfy our audit objective.

We evaluated the amount of the annual renewal fees associated with October 2008 through
September 2009 fiscal yearend lenders. The Division provided lender amounts paid and due
from the Institution Master File, and we obtained data from the Single Family Housing
Enterprise Data Warehouse to analyze the fees calculated by the Institution Master File system.
We also requested the programming code used for the fee calculation. We determined what the
fee calculation should be and the lender branches that were omitted because of the fiscal yearend


                                               16
date error based on the regulations. There were 385 branches and 266 offices omitted from the
fee payments. With a $200 per branch fee and a $500 per office fee, the Division did not collect
$210,000 in annual fees ((385 x $200) + (266 x $500)).

We then quantified how many branches were left out of the fee calculation because a cutoff date
was not established for branch deletion by using the authorized date, termination date, and fiscal
yearend of the lenders and their branches. There were 973 lender branches terminated after the
fee due date but before the late payment was made. At $200 per branch, the Division did not
collect $194,600 (973 x $200).

To estimate the amount of funds to be put to a better use, we removed the amounts in the 2
calculations above that were associated with loan correspondents because only mortgages will be
required to register in the future. For the mortgagees, there were 269 branches and 28 offices
omitted from the fee payments. With a $200 per branch fee and a $500 per mortgagee office fee,
the Division did not collect $67,800 ((269 x $200) + (28 x $500)). Additionally, for the
mortgagees there were 554 branches terminated after the fee due date but before the late payment
was made. At $200 per mortgagee branch, the Division did not collect $110,800 (554 x $200).
We used the sum of these amounts as our estimated $178,600 funds to be put to better use in
Appendix A.

We assessed the reliability of the Lender Assessment Subsystem and Institution Master File data
by performing electronic testing for erroneous and incomplete data. The Institution Master File
system contained inaccurate data as reported in finding 2, and the Lender Assessment Subsystem
contained duplicate records. We removed those discrepancies, such as inaccurate submission
status and dates and inconsistencies between the recertification items, from the data before our
analysis. We did not assess the reliability of the Single Family Housing Enterprise Data
Warehouse data as the data were used solely to demonstrate the potential impact of the finding.

We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                17
                               INTERNAL CONTROLS

Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to

      Effectiveness and efficiency of operations,
      Reliability of management reporting, and
      Compliance with applicable laws and regulations.

Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.



 Relevant Internal Controls
               We determined that the following internal controls were relevant to our audit
               objectives:

                  Policies and procedures for the annual renewal process.
                  Effective system controls for certifications, fee payments, and lender financial
                   reporting packages.
                  Lender certifications.
                  Management reporting for monitoring the annual renewal process.

               We assessed the relevant controls identified above.

               A deficiency in internal control exists when the design or operation of a control does
               not allow management or employees, in the normal course of performing their
               assigned functions, the reasonable opportunity to prevent, detect, or correct (1)
               impairments to effectiveness or efficiency of operations, (2) misstatements in
               financial or performance information, or (3) violations of laws and regulations on a
               timely basis.

   Significant Deficiencies

               Based on our review, we believe that the following items are significant deficiencies:

                  The Division lacked written procedures for referring lenders to the Mortgagee
                   Review Board and lacked adequate controls over the review of lender audited
                   financial statement packages (finding 1).


                                                 18
   The Division did not develop sufficient controls in the Institutional Master
    File system to ensure data integrity and reliable data processing (finding 2).




                                 19
                                    APPENDIXES

Appendix A

               SCHEDULE OF QUESTIONED COSTS
              AND FUNDS TO BE PUT TO BETTER USE

 Recommendation                Ineligible 1/                 Funds to be put to better use 2/
        number
              2A                                                        $178,600
              2B                 $404,600


1/   Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity
     that the auditor believes are not allowable by law; contract; or Federal, State, or local
     policies or regulations.
2/   Recommendations that funds be put to better use are estimates of amounts that could be
     used more efficiently if an Office of Inspector General (OIG) recommendation is
     implemented. These amounts include reductions in outlays, deobligation of funds,
     withdrawal of interest, costs not incurred by implementing recommended improvements,
     avoidance of unnecessary expenditures noted in preaward reviews, and any other savings
     that are specifically identified. For this instance, this is the amount of additional future
     fees that will be collected if the Division implements our recommendations. The
     calculation of this amount is described in the Scope and Methodology section of the
     report.




                                               20
Appendix B

        AUDITEE COMMENTS AND OIG’S EVALUATION


Ref to OIG Evaluation   Auditee Comments




Comment 1




                          21
Ref to OIG Evaluation   Auditee Comments




Comment 2




Comment 3




                          22
Ref to OIG Evaluation   Auditee Comments




Comment 4




                          23
Ref to OIG Evaluation   Auditee Comments




Comment 5




                          24
Ref to OIG Evaluation   Auditee Comments




Comment 6




Comment 7


Comment 8




                          25
Ref to OIG Evaluation   Auditee Comments




Comment 9




Comment 10




Comment 11




                          26
                           OIG Evaluation of Auditee Comments

Comment 1: In several areas of its comments, FHA states that it has made changes to improve
           its lender renewal process. None of the changes were in place when we did our
           audit work so we have not evaluated their implementation or effectiveness.
           However, if the changes are implemented consistently, they should help improve
           the controls over the recertification process.

Comment 2: During the audit, the Division provided draft written standard operating
           procedures. However these procedures only specified referring lenders to the
           Mortgagee Review Board for submitting recertification items late. There was no
           other guidance in the procedures that specified Mortgagee Review Board referral
           for other violations such as insufficient lender net worth or liquidity.

Comment 3: Although the Division has begun implementing a more in-depth review of
           lenders, these controls were not fully in place during our audit scope and therefore
           have not been reviewed.

Comment 4: As noted in finding 1, we considered the changes required in the administrative
           process due to the 2007 ruling, and acknowledged the improvements made that
           strengthened controls over the lender renewal process.

Comment 5: Included in the deficiencies were reports that did not state that the audits were
           conducted in accordance with Generally Accepted Government Auditing
           Standards (GAGAS). Without the report being prepared in accordance with
           GAGAS, including an adequate major compliance report and required
           disclosures, FHA cannot ensure that deficiencies would not pose an immediate
           threat to the public or the FHA insurance fund

Comment 6: The Division did not provide any internal policies and procedures that would
           explain the inconsistencies we found in the data. The status codes in the system
           need to accurately show any change in lender status so that the Division can
           ensure that the lender submits the correct recertification items. Since the Division
           relies on this system to monitor each lender’s recertification, we continue to
           recommend that it makes changes to the system to ensure the data accurately
           reflect each lender’s recertification status.

Comment 7: We agree that lenders are not likely to delete a branch then immediately reinstate
           the branch. Nonetheless, as noted in finding 2, 217 lenders were able to delete
           973 branches. These branches were active in the system and could originate FHA
           loans beyond the recertification payment due date of 30 days past the lenders’
           fiscal year end dates. 317 of these branches remained active and were not deleted
           until at least 90 days past the lenders’ fiscal year end dates.

Comment 8: We will provide the loan activity for the deleted branches referred to in the report
           under separate cover.


                                              27
Comment 9: OLAPC is correct in its understanding that OIG will not be evaluating the
           $178,600 in future audits. This is just an estimate of the monetary benefit of
           implementing the recommendation.

Comment 10: HUD Handbook 4060.1 REV 2 chapter 4 states that a lender must remit an annual
            fee for its main office and any branch registered at least six months prior to the
            lender’s fiscal yearend. Therefore, renewal fees are due for branches added seven
            months prior to the fiscal yearend.

Comment 11: We will consider a cost benefit analysis of collecting the unpaid fees from the
            675 lenders from the Office of Lender Activities and Program Compliance.




                                              28
Appendix C

LENDER ASSESSMENT SUBSYSTEM - LENDERS’ FINANCIAL
    STATEMENT CERTIFICATION AND FINANCIAL
               INFORMATION TAB

Financial Statement Certification




Data Collections Form, Financial Statements Information Tab




                                          29
Appendix D

      LENDER ASSESSMENT SUBSYSTEM - INDEPENDENT
           PUBLIC ACCOUNTANT ATTESTATION

Attestation Agreed-Upon Procedures

The independent public accountant attests to the lender’s submission once it is submitted for
review. The agreed-upon procedures ensure the financial data entered into the Lender
Assessment Subsystem by the lender are accurate and tie to the lender’s hardcopy financial
statements. By clicking the “Agrees” option button, the independent public accountant attests to
the statements listed in the second paragraph of the independent public accountant’s report.

       We conducted our audit of compliance with those requirements in accordance with auditing
       standards generally accepted in the United States of America, Government Auditing
       Standards, issued by the Comptroller General of the United States, and the Consolidated
       Audit Guide for Audits for HUD Programs (the “Guide”), issued by the U.S. Department of
       Housing and Urban Development, Office of Inspector General. Those standards and the
       Guide require that we plan and perform the audit to obtain reasonable assurance about
       whether material noncompliance with the requirements referred to above occurred. An audit
       includes examining, on a test basis, evidence about the Company’s compliance with those
       requirements. We believe that our audit provides a reasonable basis for our opinion.




                                               30
Independent Public Accountant’s Verification of Financial Information and Attachments




                                             31