QUESTION
We are a mid-sized mortgage lender focused on investor-owned 1-4 family residential properties. Our underwriting and procedures are risk-based. In the last few years, we have grown considerably. I came on two years ago as the compliance manager.
Last year, I retained a law firm to handle an audit to evaluate our procedures and overall risk-based audit program. In the end, I do not feel they did not consider important areas, such as underwriting standards, portfolio monitoring, capital treatment, and several qualitative factors. The audit objectives were not clearly defined.
I am looking for some guidelines and remedies. If we have to do another audit, we do not want to spend as much money as we spent previously. Our policies and procedures are good, but I want more depth, especially because we are scaling up quickly.
What audit objects and procedures should I consider in a risk assessment?
ANSWER
There are lenders in the country whose sole or primary loan product involves financing investor-owned, 1-4 family residential properties. Our firm has such clients, and we work closely with them on their specific compliance needs. Most of them have risk-based programs that set up audit objectives and procedures.
I suggest you contact us to discuss our IORR Tune-up®. The acronym “IORR” stands for “Investor Owned Residential Real Estate.” The intended purpose of the IORR Tune-up® is to promote consistent risk management practices for residential properties where the primary repayment source for the loan is rental income. The fee is probably a fraction of the cost you spent previously. The IORR Tune-up® will likely tell you the information you sought and does it in 60 days.
For information about the IORR Tune-up®, Contact Us Here.
Lenders are authorized to make loans to investors to purchase or refinance 1-4 family residential real estate (“RRE”) properties for rental to others. Many lenders manage IORR financing like owner-occupied 1-4 family residential loans. However, the credit risk presented by IORR lending is more similar to that associated with loans for income-producing commercial real estate. Because of this similarity, regulators expect lenders to use the same types of credit risk management practices for IORR used for commercial real estate lending. (For banks, this expectation does not change the regulatory capital, regulatory reporting, or HOLA requirements for IORR.[i])
Your review should include at least the following audit objectives:
· Evaluate whether loan underwriting standards incorporate risks related to IORR loans.
· Understand methods for setting loan identification and portfolio monitoring expectations.
· Determine whether ALLL[ii] estimation procedures incorporate IORR loan risks and related qualitative factor adjustments, if applicable.
· Evaluate the adequacy of internal risk assessment and rating systems to monitor IORR credit risks effectively.
· Evaluate continued compliance with regulatory reporting, HOLA[iii], and risk-based capital treatment, if applicable.
We spend considerable time keeping our clients aware of the federal and state laws and regulations relating to IORR transactions, especially the regulations that implement consumer protection laws, including ECOA, the Fair Housing Act, the Fair Credit Reporting Act, the Home Mortgage Disclosure Act, RESPA, HOEPA, TILA, and the Bank Secrecy Act. Management’s lending processes and origination platforms should ensure compliance with all applicable laws and regulations and provides timely and accurate disclosures to mortgage applicants. Mortgage loan originators and the lender’s staff must be diligent in safeguarding applicants’ and borrowers’ confidential information.
Lenders and loan officers should provide sufficient information to customers so they fully understand material terms, costs, and risks of the loan products offered. Communication with customers, including advertisements, oral statements, and promotional materials, should provide clear and balanced information about the relative benefits and risks of mortgage loan products.
Lenders Compliance Group has identified eighteen categories and questions that act as criteria for audit procedures. I will list them, so you can get a sense of how to build a due diligence assessment. The drill-down analysis is extensive.
1. Evaluate the institution’s credit risk management expectations for IORR loans.
Know the risks! IORR has distinct and very different risks involved from traditional 1- to 4-family lending, such as the loans generally being repaid by rent and possibly some of the investor’s personal income, the investor possibly owning multiple properties, vacancies leading to lower revenue, and increased credit risk.
Thus, it is essential to ensure appropriate policies and procedures suitable for the risks specific to IORR lending. These policies and processes should cover loan underwriting standards; loan identification and portfolio monitoring expectations; allowance for loan and lease losses (“ALLL”) methodologies, if applicable; and internal risk assessment and rating systems.
2. Identify if regulatory reporting, HOLA, and risk-based capital treatment are carried out properly.[iv]
3. Determine if IORR loans have been classified as residential or commercial. (If they are classified as residential, are they effectively managed as commercial loans?)
4. Does the institution exercise prudent underwriting due diligence similar to that required for commercial real estate loans?
5. Has an income producing property analysis been conducted?
6. Determine if loan structuring documents incorporate commercial-type provisions.
7. Are credit and administration issues being handled in a manner consistent with commercial real estate loans?
8. Is commercial real estate amortization guidance being followed? What guidelines are used?
9. Is guidance on multiple properties being followed?
10. Are subordination, non-disturbance, and attornment agreements obtained to cover the following issues?
11. Is subrogation considered in the loan agreement?
12. Are commercial vs. residential title issues adequately addressed?
13. Are loan identification and portfolio monitoring expectations adequately addressed?
14. Do internal risk assessment and rating systems include special consideration for IORR loans?
15. Does loan monitoring consider critical IORR loan issues, such as higher overall costs, smaller loan size, competition pricing like residential loans, appraisal timing, and environmental testing?
16. Have the IORR loans been factored into allowance for loan and lease losses considerations, if applicable?
17. Have IORR regulatory exam issues been adequately addressed, such as improper classification, risk rating reviews, LO monitoring, appraisal requirements, and borrower types?
18. Have secondary market issues been adequately addressed?
RRE lending activities for mortgages and home equity loans and lines involve three primary activities - productions, servicing, and collection – further broken down into specific functions. Depending on your institution type, size, risk profile, and complexity, production functions include origination, processing (including collateral valuation), underwriting, and closing. Servicing functions include portfolio supervision and assessment, escrow account administration, account management for open-end lines of credit, and loan modifications. Collection functions include early stage delinquency assessment, renewals, extensions, deferrals and re-aging, and foreclosure assessment and execution.
Depending on the size and nature of a financial institution’s RRE lending activities, quality assurance (“QA”) or quality control (“QC”) or process that reviews mortgage loan underwriting may be necessary. A QA process reviews a sampling of underwriter-approved loans, typically before funding, to ensure consistency with lending standards. Smaller lenders may have 100 percent reviews, while larger departmental lenders may randomly sample a group of approvals. Some companies only review exception approvals (loans approved outside of normal policies and standards) to ensure the underwriter’s decision was justified by effective mitigation of the risks.
Mortgage lenders active in selling loans to the secondary markets, agencies, and investors typically require a review of an independent and statistically sound sampling of loans each month by a QC function, generally post-funding. The QC function may be completed internally by designated personnel or through an external vendor. If performed internally, the QC manager and function should be independent of the loan production function. The QC process usually occurs after a loan has been closed and funded. It is designed to effectively alert management to any deficiencies that may have existed in recently completed loan originations. The QC function should also detect fraudulent transactions so management can effectively address the causes and report perpetrators to the proper authorities.
· If you require Quality Assurance or Quality Control auditing, we have a robust practice in providing audits of IORR loans. Contact Us Here.
· If you are servicing or subservicing, you should be conducting servicing quality control audits. We have a practice focused on Servicing Quality Control. Contact Us Here.
Jonathan Foxx, Ph.D., MBAChairman & Managing Director
[i] Banks should
report IORR loans that meet the call report definition of 1-4 family
residential lending in that category. IORR loans continue to qualify as RRE
property loans under HOLA. IORR loans qualify for the 50 percent risk-based
capital category if certain regulatory requirements are met. IORR loans that do
not meet the criteria fall into a higher risk-based capital category.
[ii] Allowance for
Loan and Lease Losses (ALLL). The purpose of the ALLL is to reflect estimated credit
losses within a bank’s portfolio of loans and leases. Estimated credit losses
are estimates of the current amount of loans that are probable that the bank
will be unable to collect given the facts and circumstances since the
evaluation date (generally the balance sheet date).
[iii] Home Owners'
Loan Act
[iv] If applicable, IORR loans should continue
to qualify as residential real property loans under HOLA and qualify for the 50
percent risk-based capital category if certain regulatory requirements. (IORR
loans that do not meet the criteria will fall into a higher risk-based capital
category.)
