Q: We have both a Quality Control Department and a Compliance Department. Can one of these departments perform the Internal Audit component as required by the GSEs?
A: No. Fannie Mae recently published Selling Guide Announcement SEL-2017-10, which clearly outlines mortgage lender internal audit requirements with regard to independence and reporting lines, eliminating any perceived ambiguity from the current Selling Guide Eligibility requirements. The update, dated December 19, 2017, lists minimum requirements for all Fannie Mae approved sellers and servicers and indicates they "must have internal audit and management controls to evaluate and monitor the overall quality of their loan production and servicing."
Below please find an outline of such minimum requirements. Such requirements are effective July 1, 2018.
Not only does Internal Audit reporting help lenders meet GSE requirements by identifying risks or gaps in controls, there is an added benefit in getting ahead of potential damage to a company's reputation or financial well-being.
- The procedures must be independent of all key functions of the loan manufacturing process and the servicing processes that they review.
- The seller/servicer's lines of reporting must reflect the independence of the audit process at all levels.
- The audit function must not share any reporting lines with the functional areas that it reviews.
- The audit function must report directly to the seller/servicer's senior management and/or board of directors. Exceptions are permitted in situations in which the size of the seller/servicer's organization is insufficient to support adequate resources to allow for separation of these functions.
- The procedures must be consultative, so that they help the seller/servicer accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes.