Credit Committees: Central Hub of Mortgage Banking

Jonathan Foxx, PhD, MBA

Chairman & Managing Director

Many clients have credit risk management committees, sometimes referred to as loan committees, lending committees, or credit committees. Let’s just call them “credit committees” or, for the purposes of this article, “Committees.” For small mortgage lenders, the Committees wind up consisting of the owner and perhaps a second company official. Howsoever this internal entity is configured, it is very important to ensure continuity between the origination process flow and, where possible, the interaction with a loan committee that sets policy standards and, as needed, makes decisions on whether to approve a risky loan transaction.

When we are retained by a client to review its departments and functions, for instance to conduct an internal audit or a GSE readiness audit – one of the factors we consider is the lending function itself. This activity is in fact actually distributed over many departments. But the loan flow process must come under a set of review criteria which, when challenged, often requires resolution by a committee constituted to manage the loan transaction’s risk.

First and foremost, it is important to emphasize that an institution’s quality control, compliance, and audit procedures should focus on mortgage lending activities that pose high risk. Controls to monitor compliance with underwriting standards and exceptions to those standards are especially important.

To break this down further, the quality control function should regularly review a sample of loans from all origination channels. A representative sample of underwriters should be subject to quality control auditing in order to confirm that policies are being followed. When control systems or operating practices are found deficient, business-line managers should be held accountable for correcting deficiencies in a timely manner. This means, in effect, that the deficiency should be identified, mitigated through system and training solutions, monitored, and periodically tested.

Since some loans permit a borrower to defer principal and, in some cases, interest payments for extended periods, institutions should have strong controls over accruals, customer service and collections. Servicing must be an intrinsic part of the loan committee’s considerations. The exceptions made by servicing and collections personnel should be carefully monitored to confirm that practices such as re-aging, payment deferrals, and loan modifications are not inadvertently increasing risk. One suggestion would be to have servicing and collection personnel involved in the Committee. At the very least, servicing should be informed of credit decisions that affect its purview. Customer service and collections personnel should receive product-specific training on the features and potential customer issues with these products.

Mortgage Fraud Challenges: How to Catch a Crook

Jonathan Foxx

Chairman & Managing Director

Two of our Directors will be attending the MBA’s “Risk Management, QA & Fraud Prevention Forum,” held in Los Angeles, in September. Attending this venue will be Brandy George, who is the Executive Director of LCG Quality Control and Michael Pfeifer, who is a Director of Legal and Regulatory Compliance. I remember attending the first forum many years ago. The attendance was modest. Although risk management was strengthening, I felt the term risk management was much too broad, as it could be (and was) applied to many industries. So, I coined the term “Mortgage Risk Management” and it caught on! My view has been that mortgage banking poses a unique set of risks that require significant knowledge, experience, and expertise. Turns out, this insight has been reinforced over the years. Now, this event is highly attended and is brimming with new ways to handle quality assurance, mortgage fraud prevention, and risk management oversight.

As I contemplated this forthcoming conference, I thought of the difficulties that mortgage originators have in handling the challenges of mortgage fraud in particular. This is a nasty business and not for the faint hearted! When my firm conducts audits of the loan flow process, it is not unusual to find gaps – perhaps ‘chasms’ is a better word! – in a company’s procedures for managing mortgage fraud risk. It still surprises me, after so many decades in mortgage banking compliance and financial institution management, that the fraudsters seem to have no limit to their scheming, conniving, crafty, wily, and underhanded cunning. These guys are as slippery as a darkly oleaginous grease slick.

Maybe I can’t stop these swindlers and shysters from doing what they do, but I can let you know some of the lessons my firm, Lenders Compliance Group®, has learned in knowing how to identify and trap them. I may not have all the answers, but I sure do have a lot of experience in hooking the crook. So, come with me on a brief walk through the mortgage fraud maze, as I jot down some of my reflections, and perhaps you should consider using some of my ideas to fine-tune your own mortgage fraud prevention procedures.

Let’s start with a simple outline of what fraudsters do!

Committing Fraud

During the mortgage lending process, a fraudster is a person who knowingly does any of the following:

• Makes, uses, or facilitates any deliberate misstatement, misrepresentation, or omission with the intention that it be relied upon by a mortgage lender, borrower, or any other party to the mortgage lending process;
• Receives any proceeds or any other funds in connection with a closing involving mortgage fraud; or
• Files or causes to be filed with the county recorder, any document that contains a deliberate misstatement, misrepresentation, or omission.

In my view, there are two types of mortgage fraud: the first is fraud for property, and the second is fraud for profit.

The Rules of Operational Risk

Recently, I spoke with several clients who had attended mortgage industry conferences. Each one of them pointed out the very same fact: operational risk and regulatory compliance are the most prominent subjects being discussed. Thinking of learning more about new loan products and services, they left these conferences wondering about how they would ever be able to implement all the regulatory requirements being placed on them. As an old friend who runs a mid-tier, mortgage banking company said to me, "I came as a mortgage company and left as a compliance company!"

One of them said, "you know, Jonathan, you're sort of in the 'cat-bird seat' now, since you were among the first to predict that mortgage compliance would oneday dominate how we originate loans." I'm not sure if that was a back-handed compliment, but I appreciate the sentiment, nonetheless. At least LCG tries to lift some of the regulatory burden borne by our clients and free up their time to do what they do best: originate loans.

That said, let's acquaint ourselves with operational risk and how to put some structure into risk management.*

IN THIS ARTICLE

Framework
Controlling Credit Risk
Four Basic Rules
Six Even More Basic Rules
Articles and Newsletters

_______________________________________

Framework

First and foremost, compliance decisions should be made not only on the basis of sound policy and regulatory mandates but also on the basis of how compliance procedures are viewed by regulators. Examiners want to see a financial institution enforcing existing regulatory requirements. However, they also are not antagonists on a witch hunt. They honestly want to product the kind of findings - good or bad - that will help a company to thrive. They do not get a thrill out of putting forth adverse findings.

Building a solid framework begins with cataloging the company's people, processes and technology, and continues on into deriving the means by which a stable policy is designed to formalize the way the company tracks operational risk and identifies those risks within the organization's personnel and departments. Tasking, tracking, and managing risk are central features of governance.

Companies large and small should implement operational risk frameworks that formalize their operational risk management. There really is no excuse, in this day and age - especially with ready access to information and guidance - that any size financial institution cannot position operational risk practices into the loan flow process.

Risk can't be managed if there is no framework through which to manage it.

Reviewing and formalizing an operational risk framework does not need to be a complicated exercise. The size, complexity, and risk profile of the financial institution will dictate the ways and means by which risk is managed.

Controlling Credit Risk

At the start of this year, I published an article about Controlling Credit Risk [PDF]. In the article I pointed out that risk is identifiable and measurable - and it can be controlled. To get a sense of how my firm goes about evaluating credit risk and the concurrent role played by risk management, I outlined two features of managing risk: Quantity of Risk and Quality of Risk Management.

And I concluded with a section, entitled Implementing Risk Management, in which I offered some guidance about how to use credit risk information effectively to fortify a financial institution.

I urge you to download and read it. [PDF] In formalizing a framework to manage operational risk, you need to get some idea of how firms like mine work with clients to ensure appropriate risk management strategies.

Four Basic Rules

(1) Analyze Processes. This requires creating a catalogue of the company's operational processes. This is always the first step. It can be presented like a flow chart or nested folders or in any form that makes sense to management, so long as it makes logistical and experiential sense. In effect, the analysis must reflect the way that the company actually conducts its business.

(2) Identify Risks. Now that processes have been analyzed, each process should be considered on the basis of efficiency, data integrity, and potential risks. This is accomplished through an internal audit, external audit, or designating a competent employee to conduct a generic self-assessment. Whatever the choice, be sure to standardize the evaluation method.

(3) Centralize Policies. Bring together all the company's policies and procedures. Take inventory and determine which policy statements are missing, which ones are outdated, and which ones may be redundant. The requirements of disparate policy statements may conflict with one another, so gather them all together and assess them as a group.

(4) Establish a Master Policy. At this point - having analyzed processes, identified risks, and centralized policies - we are able to draft a master policy. Such an approach is reflective of 'best practices' governance. The master policy sets forth the overarching set of policies and rules that govern the company's management of operational risk. It is the "map" that serves as a guide to the operational risk framework. Be sure that the master policy also provides 'track-back' features and identifies the "owners" of each risk area.

Six Even More Basic Rules

I mentioned above that the master policy is the "map" to the operational risk framework. But, as the philosopher Alfred Korzybski noted, the map is not the territory. Working through the four basic rules takes time and resources. Sometimes we can't even get to the Four Basic Rules, because we have not taken into consideration the Six Even More Basic Rules.

Here follows those six rules, without which an operational risk framework is not really attainable.

(1) Assemble the Management Team. Bring together the company's executive and senior management. Start a conversation about operational risk and how to create a top-down approach toward risk management. Do this at least annually.

(2) Make Lists. Before the management meeting, each member of the management team should draft a list - long or short - of not only the known operational risks but the potential or unexpected risks. Assume that "Black Swans" do happen! Managers should offer insights relating to their own operational area as well as any other areas of the company. An unaccounted for risk, actual or potential, could cause massive financial, strategic, legal, and regulatory damage.

(3) Detail the Risk. Specify the risk in as much detail as possible. State the consequences of risk failure. And, where possible, always provide a solution. If a risk is perceived, seek a way to mitigate or remove it. Don't waste time on solutions seeking a risk; concentrate on risks seeking a solution.

(4) Discuss Risk. In an open and conversational way, discuss the lists. Determine if there are coinciding or divergent perceptions of risk. Identify where there are gaps in knowledge or implementation. And encourage a discussion regarding perceived risk, to be sure that there is some general understanding about the levels of risk tolerance.

(5) Draft a Master List. Now build a consensus amongst the assembled management team. Create priorities to the various lists of risks provided by each participant. Determine the mitigation strategies that are acceptable, given the company's risk profile and risk tolerance.

(6) Work the List. Implement the Master List, which may include the Four Basic Rules outlined above, but may just form sufficient guidelines and directives to establish appropriate means to manage operational risk. Appoint a member of the management team to monitor the Master List and update the list for those risks that have been resolved or mitigated.

Articles and Newsletters

_______________________________________

* Jonathan Foxx is the President & Managing Director of Lenders Compliance Group

Controlling Credit Risk

We begin 2012 with the certain knowledge that many new regulations and responsibilities have made significant and costly demands on lenders, servicers, mortgage brokers, banks, investors, and mortgage securitizers to revise and strengthen plans to assure their economic survival. Many compliance departments throughout the country have set forth robust compliance calendars in order to monitor, test for, and implement federal and state guidelines. [*]

The primary source of revenue for the aforementioned companies (collectively, “financial institutions”) is the negotiating, extending, administering, and packaging of credit. Extension of credit and credit risk are really inseparable features of mortgage loan originations – one does not exist without the other.

Credit risk is quite measurable, especially with respect to any activity that poses a risk to earnings and capital. It is no secret that inadequate risk management is a leading cause of the failure of financial institutions. Just as credit risk and extension of credit are inseparable, so also are they inseparable from risk management. Only to the extent that credit risk and appropriate risk management procedures are identified, analyzed, established, and implemented may financial institutions claim to have safe and sound lending practices.

Risk management (often referred to, generically, as Compliance) should not formally come under the rubric of the so-called “Best Practices” section of corporate governance. In my view, risk management is not an elective, a negotiable issue, a good operating practice, a mere technique consistently providing superior results, a Six Sigma template, or a business management strategy. Rather, risk management is, and ought to be, an inherent and essential, evaluative and ministerial function reaching to virtually all intrinsic aspects of a financial institution’s business model. This is why I coined the term “Mortgage Risk Management,” because it stands on its own, a specialization that provides a firm foundation to the residential mortgage loan flow process – from point of sale to securitization. Put otherwise, it is the one and only “fail-safe” means by which a board of directors may ensure that management effectively implements internal processes designed to identify, measure, monitor, and control credit risk. [†]

Close consideration of appropriate risk management practices is vital to a financial institution’s stability, most especially in the outset of a new year and at all other times. But what is risk management? And, how does risk management affect a financial institution’s way of doing business?

In this article I will provide a brief outline of two key areas where credit risk review and risk management conjoin directly to impact a financial institution’s capability to conduct business and manage a thicket of regulations. Drawing on my own experience in working with our clients, I will offer an overview of what risk management entails, whether conducted internally or through external resources.

To get a sense of a typical approach involved in evaluating credit risk and the concurrent role played by risk management, I will outline the following areas: Quantity of Risk and Quality of Risk Management.

In a penultimate section, entitled Implementing Risk Management, I will offer some guidance about how to use credit risk information effectively to fortify a financial institution.

Quantity of Risk

I define quantity of risk as the level of credit risk associated with the credit portfolio of a financial institution.

Generally, there are three levels for quantity of risk: low, moderate, or high.

In evaluating credit risk, there are nine areas of review that should be undertaken.

1) Risk Level

• Consider in the analysis the size of the exposure associated with each of the areas bulleted below, their risk profiles, credit quality indicators, amounts, volatility, and trends:
  • delinquencies
  • criticized and classified loans
  • nonaccrual or nonperforming loans
  • losses
  • other credit quality metrics used by the financial institution (i.e., weighted average: risk grade or default probability)
  • underwriting standards
  • exceptions to policy

2) Risk Implications

• There are two areas in particular that are determinative with respect to risk implications:

• Significant growth in the size of a credit risk exposure, including whether such growth might be masking deterioration in credit quality indicators, and

• Material changes in policies, procedures, or underwriting standards.