5 Internal Audit Issues We're Seeing in FNMA's MORAs and How to Prevent Them

The increase in regulatory exams for lenders, such as FNMA's Mortgage Origination Risk Assessment (MORA), highlights the importance of maintaining oversight and continuous improvement in operations. FNMA requires companies, whether already approved or in the process of approval, to demonstrate their commitment to managing risk effectively. During the MORA process, FNMA examines the most recent risk assessment, including the internal audit plan and the latest independent internal audit over the quality control (QC) function. Meeting FNMA's internal audit requirements is crucial for sellers/servicers to maintain eligibility.

Common Issues We’ve Seen Resulting From a MORA Relating to Internal Audit:

1. Lack of Internal Audit Function

One common issue we’ve seen resulting from a MORA relating to internal audit is that companies do not have an internal audit function established that covers the requirements outlined in the MORA. This is especially true for IMBs that have been FNMA-approved for several years and may be unaware of all of the requirements they need for an appropriate internal audit function. Without this function in place, companies are unable to identify any risks or deficiencies in their loan manufacturing and servicing processes, which can lead to costly mistakes down the line.

2. No Risk-Based Internal Audit Schedule

Another concern is that companies do not have a risk-based internal audit schedule capturing all of the loan manufacturing and servicing processes that are applicable to their organization. Risk-based internal audits are essential for identifying potential risks and ensuring compliance with the changing regulatory requirements. Without a comprehensive internal audit roadmap, companies may miss important controls or overlook potential areas of risk, which could result in costly fines or other penalties from regulators.

3. Lack of Independent QC Review

We’ve also seen a trend of companies not having an independent review of the QC function performed annually as required by the MORA. Quality control reviews are necessary to ensure that all loan manufacturing and servicing processes meet regulatory standards as well as company policies and procedures. Without an independent QC review, there is no way to ensure quality control measures are being properly implemented throughout the organization, which can lead to costly mistakes or violations of regulations down the line.

4. Inadequate Documentation & Records Management

Another common issue is inadequate documentation and records management can also be an issue when it comes to meeting MORA requirements related to internal audit functions. Companies must ensure they have adequate documentation and records management systems in place in order to track loan manufacturing and servicing processes throughout their organization correctly. Without proper documentation and records management, it can be difficult for companies to identify any potential risks or deficiencies in their processes, which could lead to costly mistakes down the line if left unchecked.

5. Poor Communication Between Departments

Poor communication between departments can also be an issue when it comes to meeting MORA requirements related to internal audit functions. It is essential for all departments within a company (such as underwriting, QC, etc.) to communicate with each other regularly in order to ensure all loan manufacturing and servicing processes are compliant with regulatory requirements as well as company policies and procedures. Without proper communication between departments, there is no way for a company to know if its processes are up-to-date or if any changes need to be made in order for them to remain compliant with regulations going forward.

6. Policies and Procedures Not Customized to Unique Needs

Finally, we are seeing a “one-size-fits-all" approach to developing policies and procedures. While purchasing a package of this content may seem like a time savings, when this content is not customized and tailored to fit the company exactly, it causes issues when it is not aligned with an internal audit process.

What To Know - FNMA Internal Audit Requirements

Per FNMA A4-1-01 Maintaining Seller/Servicer Eligibility, the seller/servicer must have internal audit and management control procedures to evaluate and monitor the overall quality of its loan production and servicing processes, as applicable. The internal audit procedures must be independent of all key functions of the loan manufacturing process and the servicing processes that they review so that such procedures provide an objective and unbiased evaluation that adds value and improves the seller/servicer’s operations.

FNMA’s Internal Audit Self-Assessment states that the internal audit plan should be risk-based, updated annually, and include a review of all controls and key functions in each origination and servicing department.

FNMA's Quality Control Self-Assessment (pg. 2) states: “Ensuring that an independent audit of the QC process is conducted and, if appropriate, establishing an action plan for remediation or policy/procedure changes identified from such an audit. Results of the annual QC audit include an affirmative statement that no influence from other business units or bias in the QC conclusions was apparent.”

Successfully navigating a MORA requires meticulous attention to internal audit processes and procedures. Companies should prioritize establishing effective internal audit practices to meet FNMA's expectations and ensure ongoing compliance. Utilizing an outsourced, independent internal audit function with deep experience in FNMA compliance, such as Richey May, can ensure you are ready for an FNMA MORA as well as other industry compliance needs. Contact us today at info@richeymay.com.

‍