OFFICE OF AUDIT DRAFT REGION 7 For Discussion and Comment Only - Subject to Review and Revision KANSAS CITY, KS U.S Department of Housing and Urban Development, Office of Single Family Housing Review of FHA Default and Claims Information in Credit Alert Verification Reporting System (CAIVRS) 2014-KC-0002 July 2, 2014 Issue Date: July 2, 2014 Audit Report Number: 2014-KC-0002 TO: Kathleen Zadareky, Deputy Assistant Secretary for Single Family Housing, HU //signed// FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA SUBJECT: The Data in CAIVRS Did Not Agree With the Data in FHA’s Default and Claims Systems Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our review of the default and claims information in HUD’s Credit Alert Verification Reporting System (CAIVRS). HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 913-551-5870. Office of Audit Region 7 400 State Avenue, Suite 501, Kansas City, KS 66101 Phone (913) 551-5870, Fax (913) 551-5877 Visit the Office of Inspector General Web site at www.hudoig.gov. July 2, 2014 The Data in CAIVRS Did Not Agree With the Data in FHA’s Default and Claims Systems Highlights Audit Report 2014-KC-0002 What We Audited and Why What We Found We reviewed the Credit Alert HUD’s CAIVRS did not contain information on all Verification Reporting System borrowers’ default, foreclosure, and claim activity. It (CAIVRS), the U.S. Department of would incorrectly return accept codes for more than Housing and Urban Development’s 260,000 borrowers who had been in default, (HUD) shared database of defaulted foreclosure, or claim within the past 3 years. Federal debtors, due to our observations during another audit (2013-KC-0004, CAIVRS did not contain information for FHA September 18, 2013). We noted that borrowers with claims older than 3 years. Therefore, only one borrower on a defaulted loan HUD did not provide other Federal agencies with typically received a negative result from sufficient information on FHA borrowers with the system, while the remaining delinquent Federal debt to meet the requirements of the borrowers received clear results. Our Debt Collection Improvement Act, which bars audit objective was to determine delinquent Federal debtors from obtaining additional whether the default and claims data in Federal loans or loan guarantees until such CAIVRS agreed with the data in the delinquency is resolved. Federal Housing Administration’s (FHA) default and claims systems. What We Recommend We recommend that HUD document the selection rules used for feeding data to CAIVRS, update the rules to provide for complete reporting of all ineligible borrowers, and develop system error checks to identify potential issues. We also recommend that HUD report FHA borrowers with delinquent Federal debt beyond the 3-year claim period or obtain an exemption from the Secretary of the Treasury to exempt FHA loans after 3 years. TABLE OF CONTENTS Background and Objective 3 Results of Audit Finding 1: CAIVRS Contained Incomplete Information on Delinquent FHA Borrowers 5 Finding 2: CAIVRS Excluded Claims Older Than 3 Years 8 Scope and Methodology 11 Internal Controls 13 Appendixes A. Schedule of Funds To Be Put to Better Use 14 B. Auditee Comments and OIG’s Evaluation 15 2 BACKGROUND AND OBJECTIVE Title 31, U.S.C. (United States Code) 3720B, bars delinquent Federal debtors from obtaining Federal loans or loan insurance guarantees. The Office of Management and Budget (OMB) has mandated that all Federal credit agencies prescreen all applicants for nondelinquency in Federal debt and, if practical, do the prescreening through a system of shared data. The Credit Alert Verification Reporting System (CAIVRS) was developed by the U.S. Department of Housing and Urban Development (HUD) in June 1987 as a shared database of defaulted Federal debtors. CAIVRS has delinquent borrower records from HUD, the U.S. Department of Veterans Affairs, the U.S. Department of Education, the U.S. Department of Agriculture, the Small Business Administration, and the U.S. Department of Justice. CAIVRS is the only system of shared delinquent Federal debtor records available to support the OMB mandate. CAIVRS enables processors of applications for Federal credit benefit to identify individuals who are in default or have had claims paid on direct or guaranteed Federal loans or are delinquent on other debts owed to Federal agencies. Authorized users may access CAIVRS via the Internet. The system prompts the user to enter the Social Security number of the applicant. If the applicant’s Social Security number is not in the database, the user will receive a clear confirmation code (a code beginning with the letter “A”). If there is a record of default for the borrower whose Social Security number was entered, the user will be given the name of the agency reporting the default, the case number of the defaulted debt, the type of delinquency (default, “D”; claim, “C”; foreclosure, “F”; lien or judgment, “J”) and a telephone number to call for further information or assistance. The Federal Housing Administration (FHA) provides mortgage insurance on loans made by FHA-approved lenders, enabling them to provide credit to borrowers who might otherwise be unable to access the capital markets to purchase or refinance a property. FHA is the largest insurer of mortgages in the world, having insured more than 40 million properties since its inception in 1934. FHA mortgage insurance provides lenders with protection against losses as a result of homeowners’ defaulting on their mortgage loans. The lenders bear less risk because FHA will pay a claim to the lender in the event of a homeowner’s default. Loans must meet certain requirements established by FHA to qualify for insurance. One of those requirements contained in HUD Handbook 4155.1, paragraph 4.A.7.b, states that lenders must use CAIVRS to screen all borrowers except those involved in a streamline refinance. The borrower is not eligible if CAIVRS indicates that he or she (1) is presently delinquent on a Federal debt or (2) has had a claim paid within the previous 3 years on a loan made and insured on his or her behalf by HUD. HUD says that CAIVRS reduces by almost 100 percent the risk of endorsing a mortgage for FHA insurance without knowledge of previous delinquencies or defaults in Federal programs. According to HUD Handbook 4155.1, paragraph 4.A.7.a, CAIVRS is a Federal government-wide repository of information on those individuals • with delinquent or defaulted Federal debt, and/or • for whom the payment of an insurance claim has occurred. 3 Our audit objective was to determine whether the default and claims data in CAIVRS agreed with the data in FHA’s default and claims systems. 4 RESULTS OF AUDIT Finding 1: CAIVRS Contained Incomplete Information on Delinquent FHA Borrowers HUD’s CAIVRS did not contain default, foreclosure, and claim activity information for more than 260,000 borrowers. HUD did not adequately design the process for feeding data to CAIVRS from its other systems. As a result, CAIVRS could allow ineligible debtors to obtain new Federal loans and loan insurance guarantees. Incomplete Default and Claim Information CAIVRS did not contain complete information on all FHA borrowers’ default, foreclosure, and claim activity. As of January 2014, CAIVRS did not include information on more than 252,000 borrowers who were in default or foreclosure on their FHA-insured mortgages. These borrowers were generally the coborrowers on the loan. On rare occasions, the coborrower was reported to CAIVRS instead of the primary borrower. Also, as of January 2014, CAIVRS did not include information on nearly 6,000 borrowers who had claims paid on their FHA-insured mortgages in the past 3 years. These borrowers were the second, third, or fourth coborrowers on the loans. CAIVRS also did not include information on borrowers during the delay between when the lender reported the loan as a claim termination and when the lender submitted the claim and HUD processed and paid it. Specifically, CAIVRS excluded borrowers on nearly 2,000 loans that were delinquent and reported as claim terminations as of January 2014 but later had claims paid, which would then cause them to appear in the CAIVRS system. In addition, CAIVRS excluded borrowers on nearly 3,400 loans that lenders had reported as claim terminations since 2010 for which a claim had not been paid by HUD. Inadequate Data Feed HUD did not adequately design the process for feeding data to CAIVRS from its other systems. Each month, the default system provided CAIVRS with a file of Social Security numbers of borrowers who were in default or foreclosure or had a claim paid within the previous 36 months. This single file contained the merged records from the default system and the claims system. 5 HUD did not extract complete information on all borrowers from its default and claims systems for the monthly file provided to CAIVRS. The selection rules generally excluded coborrowers on loans and allowed for a gap in reporting between when a loan was reported as a claim and when a claim was paid and processed. While loans were in default or foreclosure, lenders generally entered the Social Security number for only the main borrower on the loan into the default system. Once HUD paid claims on these loans, the selection rules for claims added one coborrower listed on the claim form supplied by the lenders but no additional coborrowers. HUD also did not adequately document the selection rules used for feeding data to CAIVRS. We were provided with and reviewed multiple documents related to CAIVRS, including interface control documents and system run books. Interface control documents summarize the requirements and operation for a data interface between CAIVRS and another system. These documents are meant as a technical reference and therefore, its main audience is computer programmers, data base administrators and analysts, who develop software to either produce, analyze or handle data products. However, these documents did not provide information on which specific fields determined whether a loan was classified as a D-default, F- foreclosure, or C-claim in CAIVRS. While HUD provided some additional information through emails about its selection rules, this information should be formally documented in such a way that it is readily available and can be updated over time. Ineligible Debtors Allowed To Obtain New Federal Loans As a result of the deficiencies described above, CAIVRS could allow ineligible debtors to obtain new Federal loans and loan insurance guarantees. More than 260,000 borrowers could receive an accept code from CAIVRS despite having defaults or claims on their FHA loans. If HUD, lenders, or other agencies performing prescreening procedures ran these borrowers in CAIVRS, they would receive incorrect results. For HUD and lender purposes, these incorrect results could lead to ineligible borrowers being approved for new loans in violation of FHA underwriting requirements. HUD Handbook 4155.1 4.A.2.g establishes a three-year waiting period for borrowers with past delinquencies, defaults or claims on FHA loans before they can regain eligibility for another FHA-insured mortgage. For example, in fiscal year 2013, FHA insured 63 new loans totaling $9.5 million, although the borrowers had recent claims. On all of these 63 new loans, the borrowers improperly received an accept “A” code from CAIVRS to qualify for the new loan. Therefore, the new lenders did not know that the borrowers had 6 delinquencies and foreclosures reported in HUD’s systems or that HUD had paid claims on their behalf. One of these new loans was to coborrower 1 on the original loan, who had a claim paid on his behalf on September 4, 2013, and closed on a new loan as the primary borrower on September 23, 2013, less than 20 days from when the claim on the first loan was paid. This borrower was coded as “accept” in CAIVRS in September 2013. There were likely more improperly insured loans during 2013, since the 63 loans identified did not include borrowers who obtained a new loan while their old loan was in a default status but HUD had not yet paid a claim. These loans also did not include borrowers who obtained a new loan while their old loan was in a default status and ultimately resulted in a preforeclosure sale or deed in lieu. Furthermore, when other agencies use CAIVRS to screen for delinquent Federal debt, they would receive incorrect results to the extent that some of these loans are covered by the Debt Collection Improvement Act. Conclusion HUD did not adequately design the process for feeding data to CAIVRS from its other systems. As a result, CAIVRS could allow ineligible debtors to obtain new Federal loans and loan insurance guarantees. CAIVRS did not contain complete information on all FHA borrowers’ default, foreclosure, and claim activity. Therefore, more than 260,000 borrowers could receive an accept code from CAIVRS despite having defaults or claims on their FHA loans. Recommendations We recommend that the Deputy Assistant Secretary for Single Family Housing 1A. Document the selection rules used for feeding data to CAIVRS to explain in detail the flow of information from HUD’s systems. 1B. Update selection rules for CAIVRS to provide for complete reporting of all ineligible borrowers to put $9.5 million to better use. 1C. Develop and implement system error checks to identify potential reporting issues. 7 Finding 2: CAIVRS Excluded Claims Older Than 3 Years CAIVRS did not contain information for FHA borrowers with claims older than 3 years. This condition occurred because HUD stopped reporting FHA claims to CAIVRS after 3 years since these debtors were no longer ineligible for new FHA single-family loans. As a result, HUD did not provide other Federal agencies with sufficient information on FHA borrowers with delinquent Federal debt to meet the requirements of the Debt Collection Improvement Act. Claims Excluded After 3 Years CAIVRS did not contain information for FHA borrowers with claims older than 3 years. Title 31, U.S.C. 3720B, bars delinquent Federal debtors from obtaining Federal loans or loan insurance guarantees. Regulations at 31 CFR (Code of Federal Regulations) 285.13(b)(5) state that a person may be eligible for Federal financial assistance only after the delinquency is resolved in accordance with this section. OMB has mandated that all Federal credit agencies prescreen all applicants for nondelinquency in Federal debt and, if practical, do the prescreening through a system of shared data. HUD promotes CAIVRS as a single repository of delinquent Federal debtor records to support the OMB mandate. CAIVRS provides records with easy access through the Internet to more than 61,000 authorized user IDs from HUD, the U.S. Department of Agriculture, the U.S. Department of Veterans Affairs, the Small Business Administration, the Federal Deposit Insurance Corporation, the U.S. Department of Education, and the U.S. Department of Justice. However, CAIVRS returned accept codes for borrowers on former FHA loans starting 3 years after their claim was paid. Older Claims Not Needed by FHA HUD stopped reporting FHA claims to CAIVRS after 3 years because these debtors were no longer ineligible for new FHA single-family loans. FHA underwriting rules and regulations state that after a 3-year waiting period, a borrower may regain eligibility for another FHA-insured mortgage. HUD decided to discontinue reporting on these borrowers without obtaining permission from the Secretary of the Treasury to exempt these claims. The “Exemptions by the Secretary” regulations at 31 CFR 285.13(f) state that upon the written request and recommendation of the head of the creditor agency to which a class of debts is owed, the Secretary of the Treasury may exempt any 8 class of debts from affecting a debtor’s eligibility for Federal financial assistance. We asked HUD for evidence that it had sought an exemption from the Secretary of the Treasury to exclude claims after 3 years. No evidence was provided. Insufficient Data on Delinquent FHA Debtors HUD did not provide other Federal agencies with sufficient information on FHA borrowers with delinquent Federal debt to meet the requirements of the Debt Collection Improvement Act. HUD’s previously published written guidance such as Mortgagee Letter 91-31 has considered FHA-insured loans to be Federal debt. In addition, OMB guidance in Circular A-129 treats delinquent loans guaranteed or insured by the Federal Government as delinquent Federal debt. Furthermore, regulations at 31 CFR 285.13(d)(3) state that a debt is in delinquent status even if the creditor agency has suspended or terminated collection activity with respect to such debt. The regulations further state that a person’s delinquent debt is resolved only if the person pays or satisfies the debt or enters into a repayment agreement. Users from the six other Federal agencies that access CAIVRS may rely on the results they receive for borrowers on these former FHA loans. Because HUD stopped reporting claims after a 3-year period, other agencies would not be aware of the previous claims paid on the borrowers’ behalf by HUD. Some of these excluded claims would meet the definition of delinquent Federal debt, since the passage of time does not impact whether or not a delinquent Federal debt exists. Therefore, these agencies could unknowingly violate the Debt Collection Improvement Act by granting new Federal debt to these ineligible borrowers. Conclusion HUD stopped reporting FHA claims to CAIVRS after 3 years because these debtors were no longer ineligible for new FHA single-family loans. HUD did not document the resolution of delinquent Federal debt prior to the removal of the debtors’ identification from CAIVRS. HUD’s comments to this audit report indicate that it considers very few FHA claims to be Federal debt. Recommendations We recommend that the Deputy Assistant Secretary for Single Family Housing 2A. Update CAIVRS’ selection rules to report delinquent Federal debt beyond the 3-year claim period or obtain an exemption from the Secretary of the Treasury to exempt FHA loans after 3 years. 9 2B. Notify the users of CAIVRS that the system may have incomplete information for FHA delinquent Federal debtors. 2C. Obtain a determination from the Secretary of Treasury of whether FHA- insured loans meet the definition of Federal debt. 10 SCOPE AND METHODOLOGY To accomplish our objectives, we Reviewed relevant laws, regulations, and HUD guidance. Reviewed HUD’s policies and procedures. Reviewed CAIVRS internal control documents in the Cyber Security Assessment and Management tool. Reviewed CAIVRS monthly reports. Interviewed relevant HUD management and staff. Reviewed relevant background pages on HUD’s internal and external Web sites. Reviewed prior U.S Government Accountability Office and HUD Office of Inspector General (OIG) reviews. We analyzed computer-processed data contained in HUD’s Single Family Data Warehouse and Neighborhood Watch systems and from the CAIVRS mainframe to demonstrate the need for additional selection rules and identify potential issues that should be considered by HUD while implementing our recommendations. Although we did not perform a detailed assessment of the reliability of the data, we did perform electronic testing of data elements and interviewed agency officials knowledgeable about the data. Based on the work performed, we determined that the computer-processed data were sufficiently reliable for the purposes of this report. The data used from the Single Family Data Warehouse included data that originated from several of HUD’s single-family systems, such as the A43C Single Family Default Monitoring System (default system), F42D Single Family Insurance System - Claims Subsystem (claims system), and the F17 Computerized Homes Underwriting Management System (CHUMS). Specifically, we used select fields from the following Single Family Data Warehouse tables: idb_1, idb_1_coborrower, sfdw_default_current_detail, and claims_form_1. The Single Family Data Warehouse is a large and extensive collection of database tables organized and dedicated to support the analysis, verification, and publication of Single Family Housing data. CHUMS supports Housing staff in the processing of single family mortgage insurance applications from initial receipt through endorsement. Neighborhood Watch Early Warning System is intended to aid HUD/FHA staff in monitoring lenders and HUD programs and to aid lenders and the public in self-policing the industry. To determine how many borrowers were excluded from CAIVRS on loans that were in its January 2014 CAIVRS borrower history table, we compared the number of borrowers for each loan from CAIVRS to the number of borrowers for these same loans in the idb_1 / idb_1_coborrower tables in the Single Family Data Warehouse. The borrower data in the idb_1 and idb_1_coborrower tables is from F17 (CHUMS). To determine how many loans were excluded from CAIVRS due to a delay from when the loan was reported as a claim termination in the default system to when the loan was reported as a claim paid in the claims system, we analyzed data from CAIVRS and the default and claims 11 systems. We focused on loans with a claim termination type in the default system that were likely to result in one of the claim types selected by CAIVRS. As of March 2014, we had identified 3,383 loans that had been reported as relevant claim terminations since 2010 for which a claim had not been paid. Based on HUD’s selection rules for CAIVRS, these loans would not be included in CAIVRS again until a claim was processed and paid. We also identified 1,968 loans that were at least 90 days delinquent at the time of the January 2014 CAIVRS data but were not included in the data because they had been reported as a claim termination in the default system but a claim had not been paid according to the claims system. These claims have since been paid so they should now be classified as a claim in CAIVRS. To partially illustrate the effect of CAIVRS’ not containing all data that it should on loans in default or claim, we matched borrower data from CHUMS on endorsed loans closed between October 2012 and September 2013 against borrower data from CHUMS on loans that had a claim type and status that would have been captured by CAIVRS based on claims data from August 2009 forward. For the new loans, we performed the match only on loans for which the lender was required to check the borrowers in CAIVRS, which eliminated streamline refinance loans. This analysis identified 2,324 potential matches. From the 2,324 matches, we identified 321 Social Security number matches that we believed were the Social Security numbers of borrowers for whom the new FHA loan was closed either before or during the period when the borrower should have been in CAIVRS for a claim episode on a previous FHA loan. We performed additional analysis on these matches using data in CAIVRS, the Single Family Data Warehouse, and HUD’s Neighborhood Watch system as needed. We identified a total of 67 instances in which a borrower received an accept code in CAIVRS and obtained a new loan when he or she should not have received the accept code based on the delinquency status of the prior loan. This process resulted in identifying 63 unique new loans that were closed between October 2012 and September 2013. To determine the number of loans older than 3 years that CAIVRS excluded, we analyzed claims system records that met the CAIVRS selection rules for claim type and status. We then compared the claims system records against the January 2014 CAIVRS data to identify loans that were not captured by CAIVRS. We identified more than 1.3 million loans that were not included in the January 2014 CAIVRS data. According to the claims system, the claims for these loans were processed before January 2011. We performed our audit work between September 2013 and March 2014. We conducted audit fieldwork at our office in St. Louis, MO. Our audit period generally covered August 1, 2009, through March 31, 2014. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 12 INTERNAL CONTROLS Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: Controls to ensure that CAIVRS receives all relevant delinquency and claims data on Title II borrowers. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following items are significant deficiencies: HUD did not adequately design the process for feeding data to CAIVRS from its other systems (finding 1). HUD stopped reporting FHA claims to CAIVRS after 3 years because these debtors were no longer ineligible for new FHA single-family loans (finding 2). 13 APPENDIXES Appendix A SCHEDULE OF FUNDS TO BE PUT TO BETTER USE Recommendation Funds to be put number to better use 1/ 1B $9,501,619 1/ Recommendations that funds be put to better use are estimates of amounts that could be used more efficiently if an OIG recommendation is implemented. These amounts include reductions in outlays, deobligation of funds, withdrawal of interest, costs not incurred by implementing recommended improvements, avoidance of unnecessary expenditures noted in preaward reviews, and any other savings that are specifically identified. In this instance, if HUD implements our recommendations, it will ensure that FHA insures new loans only for eligible borrowers. It will no longer insure new loans for borrowers who have had recent claims paid on their behalf by the FHA insurance fund. In fiscal year 2013, we identified $9.5 million in ineligible mortgages as being insured due to CAIVRS’ returning incorrect results. We expect a similar number of ineligible mortgages to be insured next year if HUD does not make the needed corrections to its CAIVRS system. This amount is conservative as it does not take into account borrowers, whose FHA loan claims have not been paid, who obtained a new loan while their old loan was in a default status. It also does not consider whether borrowers, who ultimately completed a preforeclosure sale or deed in lieu, obtained a new loan while their old loan was in a default status. 14 Appendix B AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments 15 Ref to OIG Evaluation Auditee Comments Comment 1 Comment 2 16 Ref to OIG Evaluation Auditee Comments Comment 3 17 OIG Evaluation of Auditee Comments Comment 1 Previous departmental guidance has treated FHA-insured loans as Federal debt. HUD is now reconsidering this definition. The Debt Collection Improvement Act does not give HUD the authority to define Federal debt. Therefore, we have added recommendation 2C for HUD to request a determination from the Secretary of Treasury of whether FHA-insured loans meet the definition of Federal Debt. Comment 2 We updated the language in the recommendation to clarify that additional reporting is only required for claims qualifying as delinquent Federal debt. Comment 3 If FHA updates the other users of CAIVRS of its intention to revise reporting and the current state of CAIVRS data, it will satisfy this recommendation. 18
The Data in CAIVRS Did Not Agree with the Data in FHA's Default and Claims System
Published by the Department of Housing and Urban Development, Office of Inspector General on 2014-07-02.
Below is a raw (and likely hideous) rendition of the original report. (PDF)