Updated Fannie Mae requirements clarify that lenders need to conduct an independent internal audit, something that might require additional investment by nonbanks to set up.
Fannie is requiring that internal audits be separated from all other functions of companies, according to a recent selling guide update. Any changes made to do this must be completed by July 1.
Lenders must ensure auditors use procedures "independent of all key functions of the loan manufacturing and servicing processes" and to "not share any reporting lines" with the areas reviewed. In most cases the auditor or auditors must also report to the lender's senior management, board, or both, with some allowance made for smaller players that find it challenging to separate functions.
A company can fulfill the requirements in-house, or could outsource the responsibility as long as there is independence, which could be an issue even if the audit is handled by a third party.
"If we're supporting a client in a particular area, say vendor management, we can't have anybody from that team do the audit, and if we provide a lot of services for a company we can't become their internal auditor because there is too much overlap," said Michael Steer, founder and president of Mortgage Quality Management and Research, a company that conducts the audits in instances where it can.
Costs could vary widely depending on the scope of audits, which require companies to identify areas with different levels of risk and then assign reviews to them based on the level of the risks' severity. More frequent reviews get assigned to higher risk areas.
