Table of Contents
Table of Contents ... 1 Chapter 1 Introduction ... 5 1.1 Goals & Objectives ... 5 1.2 Required Review ... 5 1.3 Applicability ... 5 Chapter 2 Company Culture ... 6 Chapter 3 Risk Management Governance ... 7 3.1 Board of Directors ... 7 3.2 Risk Management Committee ... 7 3.3 Individual Roles and Responsibilities ... 7 Chapter 4 Identifying Risks ... 9 4.1 Credit Risk ... 9 4.2 Market Risk ... 9 4.3 Liquidity Risk ... 10 4.4 Operational Risk ... 10 4.5 Compliance/Legal Risk ... 10 4.6 Reputation Risk ... 11 4.7 Strategic Risk ... 11 4.8 Inherent Risk ... 11 Chapter 5 Determining Risk Appetite ... 13 5.1 Overview of Risk Appetite ... 13 5.2 Risk Appetite Review ... 13 5.3 Communicating Risk Appetite ... 14 5.4 Applying Risk Appetite ... 14 5.5 Updating Risk Appetite ... 15 Chapter 6 Measuring Risk ... 16 6.1 Quantitative Assessments ... 16 6.2 Qualitative Assessments ... 16SAMPLE
Table of Contents
[Sample Client]
6.3 Assigning Significance ... 16 Chapter 7 Compliance Risk Assessment ... 18 7.1 Quality Control Monitoring ... 18 7.1.1 Preclosing Quality Control Reviews ... 18 7.1.2 Postclosing Quality Control Reviews ... 18 7.1.3 Creating a Target Defect Rate ... 18 7.1.4 Fraud and Misrepresentation ... 19 7.2 Regulatory Monitoring ... 19 7.3 Policies and Procedures ... 20 Chapter 8 Operational Risk Assessment ... 21 8.1 Operational Processes ... 21 8.2 Accountability and Communication ... 21 8.3 Repurchase Risk ... 22 8.3.1 Representation and Warrant Risk ... 22 8.3.2 Non‐Saleable Loan Risk ... 22 8.3.3 Legal and Regulatory Risk ... 22 Chapter 9 Marketing and Advertising Risk Assessment ... 23 9.1 Unfair, Deceptive, and Abusive Acts and Practices ... 23 9.1.1 Regulatory Requirements and Definitions ... 23 9.1.2 Testing for UDAAP ... 24 9.1.3 Enforcement of UDAAP ... 25 9.2 Mortgage Acts and Practices (MAPS) ... 25 9.3 Other Regulations ... 27 9.3.1 Truth‐in‐Lending Act (TILA) ... 27 9.3.2 Fair Debt Collection Practices Act (FDCPA) ... 27 9.3.3 Equal Credit Opportunity Act (ECOA) ... 27 9.3.4 Fair Housing Act ... 27 9.3.5 Federal Secure and Fair Enforcement for Mortgage Licensing (SAFE Act) 28 9.3.6 Telemarketing and Consumer Fraud and Abuse Prevention Act ... 28 9.4 Advertising Monitoring ... 28 9.5 Social Media Requirements ... 28
SAMPLE
9.6 Consumer Complaints ... 29 9.6.1 Sources of Complaints ... 29 9.6.2 Complaint Reporting and Analysis ... 30 Chapter 10 Credit Risk Assessment ... 31 10.1 Product Risk... 31 10.2 Ability to Repay / Qualified Mortgages ... 32 10.3 Mitigating Credit Risk ... 33 10.3.1 Credit Risk Monitoring ... 33 10.3.2 Re‐Verifications ... 33 10.3.3 Exceptions Tracking ... 33 Chapter 11 Hedging Risk Assessment ... 34 11.1 Fallout Risk ... 34 11.2 Interest Rate Risk... 34 11.3 Reporting and Monitoring ... 35 Chapter 12 Information Technology and Security Risk Assessment ... 36 12.1 Security Audits ... 36 12.2 Business Continuity ... 37 12.3 Disaster Recovery ... 38 Chapter 13 Vendor Risk Assessment and Due Diligence ... 39 13.1 Due Diligence ... 39 13.2 Contract Review ... 39 13.3 Ongoing Oversight ... 40 Chapter 14 Servicing Risk Assessment ... 41 14.1 Data Analysis ... 41 14.2 Early Identification ... 41 14.3 Tracking and Analytic Reporting ... 42 14.4 Collections Best Practices ... 42 14.5 Regulatory Requirements ... 43 Chapter 15 Implementing a Risk Management Strategy ... 44 15.1 Risk Monitoring ... 44 15.1.1 Internal Audit ... 44
SAMPLE
Table of Contents
[Sample Client]
15.1.2 Stress Testing ... 44 15.2 Risk Management Reporting ... 45 15.3 Consequences for Insufficient Risk Management ... 45 15.4 Maturing a Risk Management Program ... 45 Chapter 16 Tools for Risk Management ... 47 16.1 Threat Probability Assessment ... 47 16.2 Fannie Mae Target Defect Rate Tutorial ... 48 16.3 Policies and Procedures Checklist ... 49
SAMPLE
Chapter 1 Introduction
This guide shall direct the risk assessment and management program of [Sample Client] and/or its vendors. The purpose of this document is to establish minimum standards and maximize performance in overseeing the amount of acceptable risk in pursuit of strategic initiatives. The goal of the risk management program is to increase profits and decrease negative effects of corporate risks, while ultimately eliminating penalties incurred from regulatory non‐ compliance. It is the expectation of [Sample Client] that all risk management guidance be followed as directed through identifying, assessing, monitoring, and controlling risks to maintain compliance with regulatory standards.1.1
Goals & Objectives
The standards set out in this guide represent minimum requirements for compliance with internal controls and assessment of risk management factors. These requirements are intended to prevent [Sample Client], our employees, and vendors from violating federal regulations related to mortgage lending and consumer compliance.1.2
Required Review
[Sample Client] requires this policy be reviewed no less than annually. Last Date of Review – 01/01/20XX Next Due for Review – 01/01/20XX The above required annual review shall include the compliance of this policy with current law, regulation or directive, the procedural implementation of this policy within the then current scope of [Sample Client] business lines and operations, internal audit results received during the previous year, and current industry trends or regulatory guidance.1.3
Applicability
The purpose of this guide is to implement risk management mechanisms as required and recommended by United States statutes and related regulations administered by the Consumer Financial Protection Bureau (CFPB) and other regulatory agencies. Wherever local regulations are stricter than the requirements set out in this policy, the stricter standard shall be applied. If any applicable laws are in conflict with this guide, [Sample Client] must consult with the appropriate legal counsel to resolve the conflict.SAMPLE
Identifying Risks
Credit Risk[Sample Client]
Chapter 4 Identifying Risks
An effective risk management program must be structured with an understanding of the types of risk exposure faced by [Sample Client]. The Board of Directors oversees the risk tolerance for each type of risk, establishing standards and policies to reflect such tolerance. Each risk type shall be audited periodically for changing factors which may alter [Sample Client]’s level of exposure. Risk types are not exclusive. One action or process may involve several different types of risk exposure, and [Sample Client] will weigh the severity of potential threats in determining acceptable maximum risk levels.4.1
Credit Risk
Credit risk encompasses many aspects of mortgage transactions and is found where an obligor fails to meet the terms of a contract. Any time funds are extended, committed, or otherwise exposed through actual or implied contractual agreements, credit risk is a possibility. Credit risk exists when borrowers become unable, or unwilling, to make payments on their loan, failing to pay as contractually obligated in accordance with the conditions of the mortgage. Creating minimum underwriting standards to effectively review the borrower’s ability to repay can maximize on‐time payment performance. When an early payment default occurs, [Sample Client] may be required to repurchase the loan from the investor to which it was sold. Any other loan violation of contractual representations and warranties with investors can cause repurchase risk. Other violations may include fraud, incomplete documentation, or inability to meet product guidelines. With multiple third‐party vendor contracts, [Sample Client]’s credit risk exposure increases. Third‐party vendor products are typically used throughout the mortgage process and include the use of a credit reporting company, loan origination system, and compliance software. Companies offering vendor services include mortgage insurance companies, quality control review companies, and investors.4.2
Market Risk
With the uncertainty of the mortgage market, [Sample Client] is at risk of market volatility when engaging in the buying or selling of mortgages through its Capital Markets Department. Market risk includes risks to earnings, loan quality, or valuation resulting from adverse movements in interest rates or equity prices.SAMPLE
Chapter 7 Compliance Risk Assessment
The portion of the assessment related to compliance risk shall evaluate the effectiveness of the following required regulations and guidelines throughout daily operations. The results of this risk assessment will be used as the basis for enhancing the compliance monitoring, testing, and audit program and ensuring compliance resources are properly allocated.7.1
Quality Control Monitoring
Establishing effective prefunding and postclosing quality control procedures allows [Sample Client] to assess trends that may be increasing the risk of repurchase or inability to sell its originated loans. With quality control responsibilities separate from the operation and production tasks, unbiased findings are reported.7.1.1 Preclosing Quality Control Reviews
The goal of preclosing quality control reviews is to prevent errors by allowing corrections to be made prior to the borrower signing closing documents, which may decrease the risk of repurchase. Preclosing reviews are most effective when performed between underwriting approval and loan closing. Preclosing quality control reporting shall include sampling methodology, findings information, and trending details. Trends may warrant targeted postclosing quality control reviews to ensure errors are being accurately corrected in a timely manner.7.1.2 Postclosing Quality Control Reviews
In accordance with requirements of Fannie Mae, Freddie Mac, and the Department of HUD, [Sample Client] shall sample a minimum of 10% or use statistical sampling of originated loans during postclosing reviews. Common findings can be evaluated in order to issue corrective action for monitoring and improved compliance. Standardized review checklists ensure a thorough review and allow for the grouping of findings to create trending information.7.1.3 Creating a Target Defect Rate
The Board of Directors and [Sample Client]’s management team shall establish a target defect rate as part of its risk management program. The target defect rate includes the maximum number of loans [Sample Client] is willing to originate that do not meet agency or investor guidelines. These loans may be found to contain insufficient documentation, the inability to verify the documentation provided, or they may contain fraud or falsified documents.The Target Defect Rate Tutorial in Appendix 2 details the procedures for obtaining an effective target defect rate in accordance with Fannie Mae requirements.
