Request MORA Tune-up® Information
QUESTION
Last month, you answered a question about doing an internal audit in advance of Fannie’s MORA audit. We did not pay much attention to it because (A) we never had a MORA audit, and (B) we did not expect a MORA audit anytime soon. Then, all hell broke loose!
Yesterday, we got a letter from Fannie Mae telling us that they will be scheduling a date for an on-site audit. They are requesting policies, procedures, and many other documents. There are due dates. This review makes a state banking exam look like child’s play. But I’m a QC manager, so I don’t have the whole picture of our risks. However, I do know one thing: we are not ready for this MORA audit.
The CEO called a team meeting in the conference room. Our compliance manager is in charge, and everyone reports to her. I got your name at the meeting because she said we are going to use you to do a MORA Tune-up®. I just wish they would have done this sooner.
What I need – and I think they need it too – is some idea of what we can expect from the MORA exam. I hope you don’t wait to reply. The compliance manager and others in management read your articles. They pass them around to us all the time. Please tell us what to expect about the MORA process.
What is the audit process of a Fannie MORA audit?
SOLUTION
RESPONSE
If you want a copy of this article, please contact us here.
We realize your question is urgent. Accordingly, we are prioritizing a response. You only have a few weeks to get ready for the MORA audit, the purpose of which is for Fannie Mae to evaluate your company’s compliance with Fannie guidelines as well as assess the operational risks.
For those who
don’t know, Mortgage Origination Risk Assessment (MORA) is a Fannie Mae review
of a Fannie Seller/Servicer. It is intended to be a collaborative engagement
led by the review team with the active participation of your organization.[i]
Getting our MORA Tune-up® engaged is one of several readiness activities you must undertake as soon as possible. Ours is the pioneer of the Compliance Tune-up, a unique review that provides a risk assessment and self-evaluation to satisfy the Second Line of Defense. I am grateful that your compliance manager chose Lenders Compliance Group. Nevertheless, to all our subscribers, please know that a few compliance and law firms offer to prepare you for the MORA review. Pick one you trust and get it done!
There are seven phases in the MORA review process, and I will outline them for you. My outline will give you a high-level view. You should not delay!
Here are the seven phases of a MORA review:
Phase 1:
Selecting the Organization
Phase 2:
Confirmation and Engagement
Phase 3:
Document Request and Receipt
Phase 4:
Process Evaluation
Phase 5:
Interviews
Phase 6:
Final Assessment
Phase 7: Remediation
I am going to provide a brief overview of each phase. However, numerous contingencies can affect the process and outcome. Take this review as a deep dive, one that will make your company stronger and its relationship with Fannie more durable. It is not too late to get started immediately.
PHASE 1: SELECTING THE ORGANIZATION
Fannie Mae selects organizations for a review using risk-based inclusion criteria and provides advance notice to the organization prior to scheduling the review. A member of the review team begins the process by compiling the organization’s pertinent contact information to start the review before moving to Phase 2.
We are often asked if there is a way to predict whether and when the selection takes place. The short answer is No. The best answer is Soon. In other words, always be prepared.
PHASE 2: Confirmation and Engagement
There are obviously two parts to this phase: the first part involves confirmation, and the second part involves scheduling. These two parts are interfaced. What happens is your point person – in your case, the compliance manager – will discuss Fannie’s BAMS team, that is, its Business Account Management Solutions team, to discuss some basics. The MORA team is independent of the BAMS team. This is a sort of Question and Answer format where the BAMS team gathers the following information:
1. What changes to your organization have taken place since the last review or approval?
2. Who are the main contact(s) for the review?
3. Are there any outstanding items remaining from previous reviews?
Your compliance manager will get confirmation dates to conduct the review and assist in the submission of documents and communications with the review team. It seems to me that the letter you refer to is more in line with Phase 2.
Our experience has been that every attempt is made to accommodate scheduling conflicts; however, scheduling is based on the last scheduled review, the status of any remediation, and Fannie’s scheduling (and staff) staff capacity.
Several variables determine whether the review is held virtually or on-site. Most reviews are conducted over two days and held virtually.
There are two very important pre-review planning requirements that you should decide immediately.
First of all, determine who the main contacts are. The main contact for the review must be capable of fully understanding your processes and able to access loan files and other documents. This is critical in ensuring that the appropriate documentation is submitted and the individual can effectively communicate with MORA regarding any preliminary findings based on the documentation submitted or process evaluation. Caution: Lack of appropriate contact will likely adversely affect the final review assessment!
Secondly, make sure that you have “deputized” the necessary staff and management for the MORA review. If availability is going to be a problem, keep in mind that the review is typically scheduled a few months in advance; therefore, block staff calendars for those days.
PHASE 3: Document Request and Receipt
Although all phases are critical, this phase is central to the evaluation itself. No document should be submitted unless it has undergone a serious review to determine that it is responsive to the Document Request; hence, the main contact must use internal controls and personnel to ensure a “second look” at documents prior to submission. Failure to provide all applicable documents by the due date can adversely affect the final assessment.
Approximately 80 days prior to the scheduled review date, MORA will send a comprehensive list of required documentation to the main contact. Document production will include, but is not limited to, requests for copies of policies, procedures, various reports, and loan files. Additional data may be requested to finalize the mandates of the Document Request.
Due dates will be clearly identified on the Document Request and are generally set two to four weeks from the request, depending on the review scope. The review team will use the requested documents to complete the process evaluation prior to the interviews.
The Document Request Instructions set forth the list of requested documents and respective due dates. I suggest that your point person set up a project planner approach to complying with the Document Request.
The project planner should have fields for:
(1) affirming that the entire Document
Request has been read and the specific documents listed;
(2) stating the required due dates when
documents must be submitted to Fannie Mae;
(3) outlining the required document
submission format and following the specific submission requirements provided
with the Document Request;
(4) recording any contact made to the
review team with questions or needed clarifications; and
(5) viewing a sample Document Request template that can be obtained from Fannie Mae’s website. With respect to the template, you will receive a customized Document Request relevant to the scope of the review.
PHASE 4: Process Evaluation
Having passed Phase 3, the review shifts to Fannie’s MORA team to evaluate the documents and information provided by your company. Thus begins MORA’s evaluation process – which is colloquially called “testing” – which consists of a review of policies, procedures, management reports, and file-level testing. The objective is to evaluate adherence to Fannie’s requirements and assess operational capabilities.
You should not assume that the Document Request is “once and done.” MORA may request additional information at any time during this phase of the review.
The following
is our firm’s table for MORA’s process areas.
|
EVALUATION
PROCESS: AREAS SUBJECT TO REVIEW |
||
|
Organizational
Overview and Shared Processes |
Selling |
Servicing |
|
Enterprise
Risk Management |
Origination
Channels |
General
Servicing |
|
Change
Management |
Underwriting Appraisal |
Solution
Delivery |
|
People
Management |
Quality
Control |
Timeline
Management |
|
Technology Business
Continuity Disaster Recovery |
Secondary
Marketing |
|
|
Vendor
Management |
Closing Post-Closing Funding |
|
|
|
||
Each of the
table’s process areas is evaluated and given a risk rating. The ratings are determined
based on all information obtained in the overall review, including file
testing, process reviews, and interviews.
PHASE 5: Interviews
Many companies seem to be most intimidated by the interviews. I think you should keep in mind that Fannie wants to have a viable and mutually successful relationship. Fannie is looking to ensure the relationship meets the high standards it holds itself to and expects from its relationship partners. That said, you must show your commitment to the MORA review. One of the worst things you could do is not have the appropriate staff present and on time for the interviews. The MORA team may request the participation of staff in addition to those originally selected by your organization for a host of reasons, such as if such attendance is necessary to understand your operations.
The interviews occur over two days. MORA will provide an agenda and confirm the topic areas and participants with the main contact. Interviews are a necessary component to reconcile preliminary findings and any additional questions that would ensure a comprehensive assessment. This conversation often includes discussions around the root causes of findings identified. View these meetings as a way to reconcile the final conclusion between your documented processes and your actual performance. You usually will be allowed to provide any evidence to rebut MORA’s findings.
Day One – Interviews
The interviews on Day One begin with an “entrance” meeting to set expectations for the interviews. The remainder of the day includes process area interviews, which typically conclude by the close of business on Day Two. If necessary, MORA may accommodate your scheduling if they deem it appropriate.
Day Two – Interviews
Generally, the Day Two interviews are scheduled for half a day but may be extended if additional time is needed to discuss processes and findings. The day will conclude with an “exit” meeting to recap MORA’s findings and recommendations and discuss the next steps.
PHASE 6: FINAL ASSESSMENT
Having concluded Phase 5, the review now shifts to Fannie’s MORA team to draft a final assessment report that includes the findings, applicable corrective actions, any recommendations based on the results of testing and interviews, and process area ratings. The final assessment report will receive a comprehensive review for approval prior to being issued to you.
Some clients
express confusion about the process area ratings. The final report is going to
show the ratings, so I think it will help you know how Fannie rates the process
areas. The ratings reflect assessments based on the findings identified and
the severity of those findings. I am reluctant to categorize the ratings as
high severity, medium severity, and low severity. Over many years, Fannie has
derived a ratings approach that is attuned to a generalized evaluation, thereby
removing the ambiguity of ratings that are simply high, medium, and low.
Instead, Fannie’s ratings are Acceptable, Needs Improvement, and Unsatisfactory.
|
EVALUATION
PROCESS: PROCESS AREA RATINGS |
||
|
ACCEPTABLE |
NEEDS
IMPROVEMENT |
UNSATISFACTORY |
|
Controls or
outcomes were satisfactory. |
Certain
adverse findings or inconsistencies were identified. |
Certain
adverse findings have been identified, and corrective actions were cited. |
|
Minor
remediation was provided to strengthen the business area. |
Corrective
action will be required to address the deficiencies within a specified time
period. |
Corrective
action will be required to address the deficiencies within a specified time
period. |
|
Recommendations
were provided to strengthen the business area. |
An action
plan or other available remedies may be assessed. |
Significant
or accelerated remediation will be required as stated in the Action Plan, and
other remedies may be assessed. |
|
|
||
PHASE 7: Remediation
As you work to
cure adverse findings, Fannie offers a Remediation team for you to work
with. This team will be your primary contact for questions regarding the completion
of your Action Plan. All communication should be sent to the assigned
Remediation team member. If you have questions, send inquiries to the
Remediation team mailbox.
I will give you some “rules of the road” to help you to resolve the adverse findings. I do not claim that these are comprehensive. However, at the least your remediation should include these actions.
Remediation “Rules of the Road”
· Review the findings and corrective actions
on the final report and begin to plan the steps needed to resolve the findings.
Begin working to resolve the cited findings upon receiving the final report.
· An Action Plan template, if applicable,
is provided with the final report.
o
Timeline: Complete and return it no
later than 20 days from receiving the final report.
· A Remediation team member will contact you to
schedule an Action Plan call to discuss corrective actions and proposed due
dates for remediation of each finding.
o Due dates are stated in the Action Plan template.
· Submit Proposed Action Plan: Upon completing the Action Plan template, according to the instructions given in the Action Plan call (but no later than 20 days from receiving the final report), submit the proposed Action Plan to the Remediation team.
· Timeline: The Action Plan must be approved by Fannie Mae within 30 days of the final report date.
· It is your responsibility to resolve all corrective actions for cited findings by the agreed-upon due dates in the Action Plan.
· Throughout the remediation process, the Remediation team will review submitted documentation to determine if corrective actions have been resolved to Fannie Mae’s satisfaction according to the Selling and Servicing Guides.
Request MORA
Tune-up®
Information
Chairman & Managing Director
[i] See
Successfully Managing the Selling and Servicing Compliance and Performan
Reviews, Fannie Mae, October 2024
