| Outline |
|---|
| I. Internal Controls |
| II. Quality Control |
| Outline |
|---|
| I. Internal Controls |
| II. Quality Control |
PROJECT TIMELINE
1995 1996
Oct. Nov. Dec. Jan. Feb. Mar. April. May June
| | | | | | | | |
-------------------------------------------
| Information Control |
------------------------------------
(10/15-5/15)
This chapter is organized into two sections: Internal Controls and Quality Control. The Internal Controls section identifies the potential risks associated with each component in the process of FHA Single Family Mortgage Loan Sale #2 and the controls established to detect or minimize the potential risk. The Quality Control section describes the process by which the various components will be monitored and tested for accuracy, consistency, and completeness.
I. INTERNAL CONTROLS
The sale of single family mortgage loans requires contact with a large amount of data, gathering information from various sources, and communicating with various personnel and potential buyers. Accordingly, a system of controls must be established and adhered to by all parties involved in the asset sales. Policies and procedures have been established for each applicable section; however, this section will identify the potential risks associated with each process and the system of controls intended to minimize and detect possible errors and inconsistencies.
Risk 1: Files are not transferred in a timely manner resulting in a delay in the initiation of the due diligence process
Internal Controls:
a. Contact the designated person at each location and establish and communicate what files are to be transferred and a required transfer schedule.
b. Establish procedure for documenting the receipt of all files.
Risk 2: Inadequate or incorrect listing of files is maintained and files are unknowingly misplaced or lost
Internal Controls:
a. Prepare and maintain a list of documents to be obtained from all locations.
b. Compile a complete listing of all loans from HUD (control list), to be maintained by one responsible party.
c. Upon receipt of files, compare to the control list.
d. Organize all files by FHA case number and assign each loan a control number.
Risk 3: Information is not collected in a comprehensive manner resulting in incomplete files and loss of control over information provided to investors
Internal Controls:
a. Establish clear cut-off dates for the receipt of additional information.
b. Establish and maintain system to segregate and identify information received after each cut-off date.
c. Provide appropriate supervision for the collection of information subsequent to cut-off date.
2. DUE DILIGENCE SUBCONTRACTOR SELECTION
Risk 1: Unqualified subcontractors are selected to perform required services
Internal Controls:
a. Require potential bidders to submit their qualifications before being added to the solicitation list.
b. Require bidders to submit self-certifications regarding ethics, and 8(a) or MWOB status.
c. Check references of finalists.
Risk 2: Subcontractor selection process is hampered by protests and undue scrutiny due to inconsistency and bias
Internal Controls:
a. Develop the criteria to judge the solicitation responses prior to reviewing proposals.
b. Develop a solicitation package that provides bidders with enough information to prepare a proposal responsive to the project's needs, minimizes bidders' confusion and questions, and allows bidders to submit their proposals in a timely manner.
c. Establish a standard form of subcontract agreement for each type of service to be contracted.
d Establish a protocol to ensure that all bidder's questions, whether directed to HUD, the financial advisor, or the due diligence contractor will receive the same treatment.
e. Require best and final offers from finalists, if appropriate.
f. Release the names of the successful bidders. Debrief unsuccessful bidders.
Risk 3: Subcontractor proposals are difficult to evaluate because they are unresponsive, inconsistent, unclear, or not submitted in a timely fashion
Internal Controls:
a. Evaluate the need for a bidders' conference in lieu of bidders submitting written questions.
b. Conduct and document a preliminary review of each proposal to verify that it is complete and responsive to the solicitation requirements.
Risk 4: Selection of a subcontractor is not supportable or documented
Internal Controls:
a. Document scope of services to be provided as a basis for the statement of work to be included in the solicitation package. Identify the task list, deliverables, timing, description of expertise required, and size of the project.
b. Establish an evaluation committee to score each proposal and rank and prepare a list of finalists.
3. SHORT FORM FILE ABSTRACT - ("SFFA")
Risk 1: Inaccurate or incomplete information is entered on the SFFA form resulting in inaccurate pricing and information to investors
Internal Controls:
a. Provide appropriate database designers to establish electronic edits regarding programs, access to the database and reporting, and assist with data entry process.
b. Insure instructional sheet and adequate training for completion of the SFFA form is received by all subcontractors.
c. Insure SFFA form contains questions that specifically relate to FHA and HUD forms.
d. Provide process for the due diligence subcontractor to sign and date the SFFA upon completion.
Risk 2: Loan modifications made during the life of the loan are not extracted resulting in incorrect information to investors
Internal Controls:
a. Provide section in database to disclose modifications made during the life of the loan.
b. Check due diligence database against HUD servicing system to check for additional modifications.
Risk 3: Due diligence contractor does not communicate exceptions or items that require additional research resulting in inaccurate information provided to the database
Internal Controls:
a. Provide area on SFFA to discuss items that may require research by the CT or other personnel.
Risk 1: Improper supervision given to uploading information into the due diligence database resulting in errors in the entire reporting system
Internal Controls:
a. Insure adequate training for data entry into the database is received by all personnel and that the system is constructed to conform with FHA/HUD forms.
b. Establish method for determining who entered data and when data was recorded, whether by the DDS or CT.
Risk 2: Database system is not monitored for deficiencies and missing information
Internal Controls:
a. Provide for database monitoring and identify data deficiencies by use of exception reports that reveal missing documents and data, and loan status reports that track what information is completed and what information is open.
b. Initiate edits to be performed after asset review file information is input by the due diligence contractor and after the contractor updates the data.
c. Establish an asset tracking database to report information on file status, date and time entered, and user name relating to source documents.
d. Establish a report to identify information that is inconclusive or not available.
5. BROKER PRICE OPINIONS AND CREDIT REPORTS
Risk 1: All properties are not included
Internal Controls:
a. Appoint team leader who will establish assignments and record BPOs and credit reports upon completion, using the control list to ensure all properties are included.
Risk 2: Information is incorrect or unacceptable resulting in the possibility of erroneous market and value information
Internal Controls
a. Compare BPO values to UPB and review loan-to-value ('LTV") ratios for reasonableness. If very low UPB, determine current UPB and original loan amount. If loan has had considerable amortization, a low UPB would be reasonable. If a very high UPB, determine the condition of the property. A property with considerable damage would likely have a low BPO value resulting in a high LTV ratio.
b. Insure that all credit scores are within the ranges set by the provider. Any score outside of the range is likely to be an error.
6. BID PROCESS
Risk 1: Bids will be received from bidders unqualified to purchase
loans from HUD
Internal Controls:
a. Require bidders to submit self-certified qualification statements.
b. Review bidder qualification packages against the debarred list
maintained by HUD.
c. Require substantial initial deposit as assurance of ability
to perform.
Risk 2: Bids are difficult to evaluate or not evaluated effectively
in order to insure maximum recovery to HUD
Internal Controls:
a. Develop model that evaluates any combination of bids.
b. Provide specific format and procedure for submitting bids and
bid packages.
c. Conduct and document a preliminary review of each bid to verify
that it is complete in response to the bidding requirements.
d. Establish evaluation committee composed of HUD and CT members
to approve successful bids and notify successful bidders.
Risk 3: Bid process is not tracked efficiently resulting in
confusion regarding losing bidders and return of earnest money
deposits.
Internal Controls
a. Compile a list of bids received and identify personnel to initiate
and track the return of earnest money deposits.
b. Establish a communications center and identify personnel to
answer questions from bidders regarding the status of their bids.
8. MARKETING
Risk 1: Marketing strategy is ineffective, i.e., a retail market
is not created resulting in less competition, low bids, and a
negative image of FHA's ability to conduct successful nonperforming
single family sales.
Internal Controls:
a. Establish various forums to insure communication to all applicable
markets, to include mailings, regional and trade press publications,
trade associations, industry groups, and on-line systems, including
the website and Bloomberg news systems.
b. Establish a communications center and identify trained personnel
to answer all incoming calls and requests for bidder information
packages.
c. Insure that all information provided to bidders is uniform,
complete, and consistent.
d. Establish system for ensuring that confidentiality agreements
are received and documented in the database and that bidder information
packages are mailed in a timely manner.
9. CLOSINGS
Closings are handled by HUD personnel and, therefore, no internal
controls are established for the CT in this area.
10. INFORMATION CONTROL
Risk 1: Nonpublic information is disclosed, resulting in confidential
information being made available to unauthorized individuals
Internal Controls:
a. Train all personnel on the importance of maintaining confidentiality
of nonpublic information.
b. Insure all members of the CT and its contractors, sign a confidentiality
agreement forbidding them from disclosing nonpublic information.
Risk 2: Release of information is not controlled or information
is incorrect, resulting in inaccurate information being made
available to outside parties.
Internal Controls:
a. Designate and provide training to the appropriate members of
the CT who will be responsible for providing information to outside
parties.
b. Establish system for logging in all inquiries received from,
and responses made to, third parties. Insure system provides
for tracking follow up, if required.
c. Compile and distribute to all interested parties, a uniform
information package maintained by the appropriate CT member.
Insure all updates are made available to all parties on a regular
basis.
d. Obtain appropriate approval from HUD and the CT prior to releasing
any information regarding the timing or terms of the sale not
previously published.
11. TRAINING
Risk 1: Training is insufficient to adequately educate all
personnel resulting in inefficient operation of entire project
Internal Controls:
a. Identify all personnel and all functional areas for which training
is required.
b. Identify qualified instructors who will provide training.
c. Develop program for establishing training location, dates,
subject matter, instructor, method and format of training, and
the distribution of any educational material required.
d. Establish system for notifying all designated personnel of
their training schedule and tracking their attendance at the appropriate
sessions.
