Enterprise-Wide Risk Assessments for Small Mortgage Companies

Small mortgage companies face the same regulatory expectations as larger institutions when it comes to identifying and managing risk. Even with one or two branches and fewer than fifty employees, regulators expect management to conduct an enterprise-wide risk assessment (EWRA) that evaluates exposures across operations, compliance, cybersecurity, and customer interactions. The EWRA provides a structured approach to documenting where risks exist, how they are controlled, and how frequently those controls are reviewed.

Risk Assessment Framework

The EWRA matrix organizes risks into categories, assigns an initial rating, lists the existing mitigation measures, records the residual rating, identifies the responsible party, and determines the review frequency.

We provide a tool to conduct your Risk Assessment internally. The idea is a four-step process: 1.) Identify Risk 2.) Risk Level (low, medium, or high) 3.) Where and how the risk is mitigated (e.g. policies/audits) and 4.) Post-mitigation risk.

• Advertising – Online or remote application gateways

  • Initial Risk: Medium

  • Mitigation: Advertising compliance checklist; social media policy review

  • Residual Risk: Low

  • Responsibility: Compliance Officer

  • Review: 12 months

• Advertising – Non-compliant advertising or social media use

  • Initial Risk: Medium

  • Mitigation: Advertising audit and officer oversight

  • Residual Risk: Low

  • Responsibility: Marketing Manager, reviewed by Compliance Officer

  • Review: 12 months

• Compliance – Failure to comply with published regulations

  • Initial Risk: High

  • Mitigation: Regulatory Compliance Management System, documented policies and procedures

  • Residual Risk: Low

  • Responsibility: Compliance Officer / Management

  • Review: 12 months

• Cyber-Security – Customer data exposure

  • Initial Risk: High

  • Mitigation: Red Flags Identity Theft program, written safeguarding policies, IT security plan

  • Residual Risk: Medium

  • Responsibility: IT Administrator or designated third-party vendor, overseen by Management

  • Review: 12 months

• Fair Lending – Credit decisioning risk

  • Initial Risk: Medium

  • Mitigation: Fair Lending Plan with monitoring and comparative file review

  • Residual Risk: Low

  • Responsibility: Underwriting Manager / Compliance Officer

  • Review: Annual

Responsibility for the EWRA

Responsibility for the risk assessment rests with management. In small companies without a board of directors, the owner, managing broker, or designated compliance officer typically prepares the matrix and maintains the record. Regulators expect management to review and approve the EWRA annually and when major changes occur, such as opening a branch or introducing a new loan product. Companies may hire a third party to conduct or validate the assessment, but if they follow the structured process outlined in Form 1-80, they can complete the EWRA internally without outside assistance.

Application for Small Companies

A small mortgage company must demonstrate that it applies this framework proportionately to its size.

• Policies such as the QC Plan, Compliance Manual, and IT Security Plan serve as the mitigation layer.

• Risk ownership is documented directly in the matrix to show who is accountable for each item.

• The EWRA is updated when products, vendors, or branch operations change.

• Documentation is reviewed during examinations to confirm the company has a process to identify and mitigate risks.

States That Require Enterprise-Wide Risk Assessments

Several states have explicit or implied EWRA requirements tied to licensing examinations. Current examples include:

• Texas – Department of Savings and Mortgage Lending (SML) requires annual EWRA documentation.

• Washington – Department of Financial Institutions (DFI) cites EWRA in examinations.

• South Carolina – Department of Consumer Affairs requires an IT-security-focused EWRA.

• New York – Department of Financial Services (DFS) requires risk assessments as part of cybersecurity compliance.

• Connecticut – Banking Department requests EWRA in mortgage company exams.

• California – Department of Financial Protection and Innovation (DFPI) includes EWRA in compliance review requests.

• Florida, Virginia, and Maryland – examiners frequently request EWRA documentation, even if it is not formally codified.

Next Steps - Conduct one NOW!

An EWRA is a core element of compliance for small mortgage companies. By documenting risks, mitigation, responsibilities, and review cycles in a structured matrix, the company demonstrates control of exposures across advertising, compliance, cybersecurity, and fair lending. Regulators expect to see this process in place, regardless of company size.

Should You Reprocess Your Mortgage Loan File Before Submitting It to a Regulator for Review?

When it comes to regulatory reviews, presenting a meticulously organized and thoroughly vetted mortgage loan file is crucial. You might wonder if reprocessing your loan file before submission is worthwhile. The short answer is yes, especially if you are not already post-closing and organizing loans when they close. In this case, reprocessing your mortgage loan file could be the difference between a smooth review and a costly, time-consuming ordeal.

Why Reprocess? It’s All About Precision

Loan files are complex, containing numerous documents, verifications, and disclosures that must be accurate and complete. Even with the best intentions and processes, items can be missed. The reality is that we often discover missing or incorrect items when we take the time to reprocess files. These oversights might seem minor but can lead to significant issues during a regulatory review.

By reprocessing your loan file, you ensure that every document is where it should be, every calculation is correct, and every compliance box is checked. The attached FORM 1-4 QC PROC Closed File Pre-Audit Compliance Checklist is an excellent example of a comprehensive tool to guide this reprocessing. This checklist covers everything from verifying borrower information to ensuring all regulatory disclosures are accounted for. You might use the state required version of the file, such as that provided by North Carolina or Texas, for your review (even though the FORM 1-4 does contain all these items.)

The Benefits of Reprocessing

1. Reducing Findings and Penalties: Regulators are thorough, and they will catch mistakes. By reprocessing your file, you can correct errors before they become findings in an audit. This proactive step can save you from fines, penalties, or even more severe regulatory actions.

2. Cost Savings: When a file is well-organized and accurate, it takes less time for the examiner to review it. This not only makes the review process faster but can also reduce the overall cost of the examination. A clean file means fewer questions, less back-and-forth, and ultimately, less time spent by the examiner—time that you won’t be billed for.

3. Building Confidence: Presenting a thoroughly reprocessed file with a detailed checklist like the Post-Closing Audit Preparation/Regulatory Compliance Checklist gives the examiner confidence in your compliance processes. While it’s unlikely that an examiner will completely forego reviewing your files based on this alone, a well-organized submission can lead to a more favorable outcome, potentially reducing the depth of the review.

4. Streamlined Communication: A file that has been reprocessed is easier to navigate, not just for the examiner, but for anyone in your organization who might need to answer questions or provide additional documentation. Having a checklist attached that shows exactly what has been reviewed and included in the file simplifies communication and ensures everyone is on the same page.

What Happens If You Don’t Reprocess?

If you decide to submit your file without reprocessing, you’re taking a risk. Missing or incorrect items can lead to findings that will need to be corrected under the pressure of a regulatory deadline. This can be more stressful and costly than simply reprocessing the file upfront. Moreover, repeated findings can damage your company’s reputation with regulators and may lead to increased scrutiny in the future.

A Checklist to Guide Your Reprocessing

Consider using a tool like the FORM 1-4 QC PROC Closed File Pre-Audit Compliance Checklist as part of your reprocessing efforts. This checklist is comprehensive, covering all the necessary components of a loan file, including:

• Borrower and Loan Information: Ensuring all borrower details, loan amounts, and terms are correctly documented.
• Fee/Cost Reconciliation: Verifying that all fees are correctly calculated and documented, with copies of relevant checks and invoices attached.
• Record Retention: Confirming that all required documents are included and appropriately filed, from the initial loan application to the final promissory note.
• Post-Closing Audit: Preparing for a regulatory review by double-checking that all compliance requirements are met and that the file is ready for submission.

Conclusion

In conclusion, reprocessing your mortgage loan file before submitting it to a regulator for review is not just advisable—it’s essential. By taking the time to review and organize your file, using a comprehensive checklist, you can significantly reduce the likelihood of costly errors, streamline the review process, and potentially save your company both time and money. So, next time you’re preparing a file for submission, take that extra step to reprocess—it’s well worth the effort.

What items MUST a Broker retain independently in each loan file

Don't let your wholesaler tell you they've got everything you need. They don't. Important lessons in regulatory audits and examinations. 

"If you only do ONE THING - post close your loan files."

Brokers - ALWAYS Retain All Loan Documents

I cannot overstate the importance of meticulous record-keeping. Regulatory requirements and best practices require brokers to maintain comprehensive records of all loan transactions, including disclosure events and closing documents. 

I hear people saying, "I don't see anything in the regulations that says I have to keep certain documents..." but your regulator will require copies of all documents on all the loans you handle. In this article, we provide an explanation of what documents regulators hold brokers accountable for. 

I also hear people saying "My wholesaler will give me copies of everything if I ask for it. So I don't need to post-close my loan files..." While the wholesaler will retain copies, and may also provide a copy of a file a long time after loan closing, we see a lot of inconsistency in the condition of those document stacks from the lender. They can look like a jumble, which will require you to reprocess the file. Furthermore, what happens if the lender shuts down, gets merged or otherwise doesn't have the ability to provide what you need? 

Record Retention Requirements

As a broker, your record retention involves both the disclosures you issue and those provided by the lender. While federal and state regulations may not explicitly mandate the retention of all documents from the lender, best practices and regulatory expectations strongly advise maintaining a complete set of records. 

Also, your loans progress in stages and may not complete or get submitted to the lender. Our system suggests what you must retain at various stages of the process. 

We provide a checklist of this here:

Key Practices and Checklists

1. Retain All Broker-Issued Disclosures:

   • Initial Loan Application Form (1003): Ensure that the signed initial application is on file.
   • Loan Estimate and Required Providers Disclosure: These should be issued within three days of application.
   • Notice of Intent to Proceed: Must be signed by all borrowers.
   • Changed Circumstances Re-issued: Include any tolerance adjustments.
   • E-SIGN Acceptance/Agreement and Delivery Transcript: Keep records of acceptance and delivery audit trails.
   • Signed Initial and Final Broker Fee Agreement: Must match the closing disclosure or settlement statement.

2. Obtain and Retain Lender-Issued Documents:

   • Final Loan Application (1003) and Transmittal Summary (1008): Essential for compliance.
   • Executed Closing Disclosure (CD): Include all attachments.
   • Final Mortgage Loan Lock-in/Financing Agreement: Required at least five days prior to closing.
   • Appraisal and Related Notices: Keep copies of the appraisal order, the appraisal itself, and the right to appraisal notice.
   • Final Sales Contract and Earnest Money Deposit: Ensure these are part of your records.
   • Loan Commitment/Approval Notification: Document the lender's commitment to the loan.

3. Comprehensive Documentation:

   • Fee/Cost Reconciliation: Maintain copies of all application fees, appraisal fees, credit report fees, and other relevant costs.
   • Affiliated Business Arrangement Disclosure: If applicable, retain this disclosure.
   • Compliance Disclosures: Include ARM disclosures, CHARM Booklet Notice, Anti-Steering Notice, ECOA Rights, Fair Credit Reporting Act Notice, and others.
   • State-Specific Disclosures: Ensure all state-required disclosures are documented and retained.

Why Complete Record Retention Matters

State regulators, such as those in Washington and Texas, expect brokers to maintain records similar to those required from lenders. During examinations, brokers are often asked to produce detailed records of all disclosure events, closing documents, and other pertinent paperwork.

Texas, North Carolina, and Maryland Loan File Checklists

Adhering to the checklists from different states can help ensure comprehensive compliance:

• Texas Checklist: Includes initial and final disclosures, funding checks, appraisal reports, and title insurance.
• North Carolina Loan File Checklist: Similar to the Texas checklist, emphasizing the importance of complete documentation.
• Maryland Loan File Checklist: Focuses on detailed retention of all application and closing documents.

Updated Practices and Client Advice

In light of experiences and state examinations, brokers should update their practices to require copies of all signed disclosures and final closing packages from the lender. This proactive approach not only ensures compliance but also protects brokers in the event of an audit. You do not want to have to stop producing and getting new business to have to reprocess loan files to submit to a regulator. 

Advice for Broker Clients: Always obtain a complete disclosure package from the lender, and ensure you send out the required broker disclosures independently. This comprehensive approach to record retention is crucial for compliance and to avoid citations for missing lender documents. If the lender does not cooperate, document your efforts to obtain the necessary records.

A Look at AML Audits - Can you Audit Without a Risk Assessment?

We deal with known risks by establishing a plan to mitigate them. In the case of AML plans for mortgage companies, we face the risk of allowing financial crimes to go undiscovered and enter the financial system through our business. 

We create compliance plans as multi-tiered tools to deal with the risk. The tiers are the four (or five, depending on your business) pillars of an AML plan 

1. the plan itself - which identifies the risks your business encounters and how you mitigate them
2. training - your employees learn how to identify and report red flags
3. compliance officer - the person who implements the procedures, files reports, and ensures the activity, such as training, audits, risk assessments, etc., takes place 
4. an audit or exam - reviews your plan, determines if it is sufficient for the risks you face, and identifies if you are following it
5. ongoing review of accounts - if we are servicing, for instance

Static Plans DO NOT Address the Risks - Make Sure you know what they are

We conduct hundreds of AML audits, and the BIGGEST problem we see is that AML plans don't address the risks the business faces explicitly. Furthermore, the audits or tests we see focus on whether the AML plan contains arcane legal citations or reviews a sampling of closed loan files. This is not where the risk is.  

In the mortgage business, we are experts in looking for fraud - documenting sources of funds and ferreting out suspicious income and transactions. This doesn't mean that fraud and suspicious activity doesn't make it through (CoreLogic reports 1 in 131, or 0.76% of loans, are fraudulent). Still, it does mean that the MAJORITY of incidences probably aren't in the files that make it through to closing. So it makes sense to focus our efforts on loans that don't go through a complete underwriting process. 

None of the AML plans and audits we have reviewed focus on risk assessments. Hawaii is the only state we have encountered where they are requesting a specific AML risk assessment - (Bravo! Mahalo!). New York requires large-scale risk assessments of the entire operation, including AML. 

This leads me to conclude that people don't know what a risk assessment is or even why you do one. The purpose of the Risk Assessment is to look at YOUR business for areas of risk. Only then can you create a strategy to mitigate money laundering activity? 

How to Conduct a Risk Assessment?

Depending on the firm's scope, our risk assessments create a binary decision tree instead of a complex "relative risk rating" approach - e.g., low, medium, and high. We do it this way because the risk increases on an absolute basis. One red flag doesn't necessarily indicate fraud or money laundering activity; however, two levels of risk means that we should, at a minimum, document that we validated there were no red flags. We refer to this as "risk layering," where two or more inherent risks exist in a file. 

• Higher risk components - Company-wide
• Geography
• Business model -
• delegated, non-delegated, 
• retail/wholesale, etc. 
• Origination strategy - 
• direct/indirect
• relationship/transactional
• Higher risk components - Loan Level
• Loan Type
• Gift Letter
• ALT/Non-QM
• Investment
• Borrower Type
• Self-employed
• Real Estate
• Medical
• Cash Business

This allows us to have a methodical elevation of the review of the file. 

We do this because things that don't matter to the underwriter from an approval perspective (the loan meets guidelines) often matter for detecting and reviewing red flags. In our business, we review files for these elements, and it always surprises us how often these are overlooked. Examples include:

Deposits not needed for down payment or closing costs - the underwriter isn't concerned about whether a borrower has a $100,000 CD in one bank if he has the $20,000 he needs for closing seasoned in another account. The money has been there forever, and the account doesn't move. But does it make sense that someone who makes $60,000 a year has $100,000 stashed in an account they don't touch? Especially when they have a lot of debt? No, it doesn't. That's a SAR.

Income and Expenses from a side business - the underwriter doesn't include the borrower's side business which involves cash in the computation. He or she has enough income to qualify for the loan. The side job (documented by frequent small dollar cash deposits) is a compensating factor, and the borrower didn't need to provide tax returns because she was on salary. That makes perfect sense, except that if there is more than $5,000 of this kind of activity in the loan file (e.g., 2 months' bank statements), then that triggers a SAR report for "smurfing."

• Focus on engagements/applications/rate quotes/pre-quals which do not complete
• The greatest risk lies in loans or prospects not reviewed by underwriting/credit.

UWM Renewals - Reviewers Asking Lenders to Locate Items in QC Plans

We have seen an uptick of inquiries from our customers who engage with several national wholesalers. At the root of the inquiry is the reviewer asking the customer to locate items in the QC Plan. To forestall this we wanted to show you what a standard response looks like.

More than this, though, is an understanding of the terms. Our plans are all delivered in Word format. This means you can easily search them for a particular phrase. The problem is that the reviewers aren't using standard QC nomenclature. Key phrases include: 

• Independence - does the plan show that reviewers are not involved in underwriting or production?
• Completion - are loans reviewed within 90 days of closing?
• Selection - does the plan require a 10% sampling
• Schedule - does the plan require reporting results to management within 90 days
• Scope - does the plan review all origination documents, underwriting, and closing documents?

==============================

They want to know who your QC person is and provide a resume. If you are using a 3rd party, you need to show that in the plan. The Plan itself shows independence here:

On the matter of timing the plan is clear:

Reporting results to management:

Sample size is addressed here:

Scope is addressed here:

Of course, if you ever have a problem with any of our products, we welcome the opportunity to fix it and make it right. We want you out there doing business, not worrying about whether your policies and procedures are updated!

#QCPlans #LenderAnnualReview #Compliance Audit

What is a "Written Supervisory Plan?"

Regulators requesting "supervisory plans" may be on a fishing expedition

Before you purchase a "supervisory plan" we need to agree that regulators do not define the term clearly. At issue; many states that require supervisory plans have figured out that companies will try to avoid accountability for employee actions by saying "the employee did it, not us." The regulator wants to eliminate this excuse, so requires you to tell the employee specifically what his or her job entails.

The "Written Supervisory Plan" requirement is a bit of a red herring. There isn't a particular guideline defining what that means; the rule simply says you are responsible for your employees' actions.  

This means you must have an overall employee operating plan, such as an HR module. In addition, you must have the basic policies and procedures for regulatory compliance for all employees. Then, if you have licensed originators, you must have origination policies and procedures. If you process loans in state and you have processors, you must have processing policies and procedures. The same is true for closing, underwriting and any other function, such as wholesale, that you have.

Effectively, the mortgage correspondent package or mortgage banker package meets this requirement. Simply print the documents as the applicable title to a PDF. E.g.; 2-0 Compliance would be "2-0 All Employee Compliance Related Supervisory Plan." "3-0 Originator Supervisory Plan" etc.

If you are a very small company where only the principals are active in originating, you can use the Quality Control Plan and Compliance Policies and Procedures and call them "Employee Supervisory Plan."

North Carolina Mortgage Licensing and Examinations - What have we learned?

It should surprise no one that NCCOB - the nation's FIRST state regulator to initiate anti-predatory lending laws, and one of the first to initiate robust pre-licensing training, AND was a leader in pre-Dodd-Frank regulation - has now taken the flag as one of the most detail-oriented examiners. 

Expect an initial examination within the first 12 months of licensing. Existing licensees who have never been examined should expect one, and this normally coincides with a complaint or other inconsistency.

For those licensed in the state, NCCOB (North Carolina Commissioner of Banks) has clearly and transparently posted its expectations. Yet over and over we see brokers and lenders alike responding with surprise to examination findings and questionnaires. When we review the findings to help licensees comply we aren't surprised, just a little disappointed at what some might call willful blindness.

We have a great deal of respect for the rational approach that the regulator has taken. Nothing in the findings represent anything that brokers or lenders shouldn't be responsible for. If anything, our concern is that these problems exist elsewhere and propagate because of a lack of oversight.

Broker Fee Agreements

It's illegal to collect a fee without the customer's explicit agreement. These files show missing or incorrect broker fee agreements, or incorrectly completed lender financing agreements. The common response or argument is that the LE or CD provides the customer's tacit agreement. However, it's usually too late at that point; the information on the LE/CD should come from the financing or broker agreement.

For our customers, we devote a section of our quality control plan for correct completion and retention of financing or fee agreements.

BSA/Anti-Money Laundering Plans

We sell both stand-alone anti-money laundering plans, or better yet, QC (Quality Control) plans that identify the full set of FinCEN (FINancial Crimes Enforcement Network) identified Red Flags. Our BSA/AML (Bank Secrecy Act/Anti-Money Laundering) plans use these to identify potential SARs (Suspicious Activity Reports) for reporting.

Most people don't read them.

Otherwise, they would know that they include:

• A SAR Reporting Workflow
• A Compliance Officer (You have to put the person's name where it says "Insert Compliance Officer here")
• Initial and Periodic Training (We give this away here, or provide a checklist to ensure you have taken AML specific training as part of your Continuing Education)
• Both FinCEN and Industry Specific Red Flags

When we see a finding related to "deficient AML plans" these all fall under that category.

Missing Documents in Audit Files

Inexcusably, many files reflect missing exhibits or data reflected in reporting doesn't match loan files. THIS IS JOB ONE of a quality control plan! Time spent retrieving documents from investors, closing agents or even borrowers represents lost loan production time; wouldn't you rather spend time originating than chasing old loan file exhibits? 

This is the reason our QC Plan has a closed loan checklist. Click to download NCCOB's version here. We find it interesting that the checklist they provide bears some resemblance to the one in your plan:

1099's - Beware EVERYONE

We recently wrote an article on 1099 compensation of originators. NCCOB takes the position that originators are employees. Unless you follow the recommendations in our article, expect an issue with 1099 payments. Further, BRANCH MANAGERS ARE EMPLOYEES by definition; you can't be a contract manager. No Branch Manager 1099s. Also, you can't have branches in homes.

Contract Processors and other unlicensed entities

As above, compensating 3rd parties for work normally done by employees, such as processing, should automatically prompt you to require licensing of that individual or service.

Advertising, VA QC Requirements, NY Compliance Plan Update

We continue to update our products as we get feedback from our customers. We list the recent updates here, some of which relate to our review of materials from our Compliance VP CMS product. You will notice three themes for this series of updates:

Advertising on the Radar

Prompted by a Washington state review this past spring, advertising for particular products have come on to the Federal government's radar. The CFPB has stated its renewed interest in protecting veterans, and so has Veterans Affairs. Specifically, the question surrounds whether the way companies advertise certain programs comprises puffery or a deceptive act.

Reporting Notices of Advertising Related Findings to HUD-FHA

A company must report any notice, sanction or citation received, from any state or federal regulator, agency or investor, relating to its advertising practices as a "Notice of Material Event" through their Quality Control plan.

Advertising
We recommend that you review all advertising (even business cards, emails and social media postings) using an advertising approval checklist. Look most carefully at unsubstantiated claims, like best rate, fastest service, or lowest cost and avoid them unless you can substantiate them.

Advertising Trigger Terms
An updated checklist reviews what text or information you have to include if your advertising includes "trigger" terms.

VA Adamant about following Updated Pamphlet

Inclusion of VA Specific Requirements in Plan
The VA now uses a checklist to validate that you have included its specific quality control plan requirements in your plan. The updated pamphlet published 2/1/2019, has a listing of QC requirements, which the VA simply has memorialized in writing. We have most of this material in the QC plan, so this update references where a reviewer can find it. The only addition focuses on the use of Staff Appraiser Reviews, which doesn't really impact Post Closing QC, but which we add to the post-closing review process anyway.

New York State DFS - Again

New York State Compliance Plan
We have prepared a New York State-specific compliance plan to align with licensing application and renewal review feedback. To meet their requirements, we stripped out a lot of material they felt was extraneous. You should not exclude other elements of your compliance plan and rely solely on the DFS' explicit requirements, because we have found myriad other implicit and explicit requirements within the rules which could also result in findings.

Other Updates also available

Fraud Prevention – Red Flag Process
We inadvertently truncated the Fraud Reporting process, as it applied to possible organized crime. Or maybe an unseen hand silenced the author?

Unfair Deceptive Abusive Acts and Practices (UDAAP)
Certain investors wanted us to include CFPB definitions of unfair, deceptive and abusive acts. Reading the definitions you realize their redundancy; all UDAAP actions really tie back to the same actions. One unfortunate side-effect of so much regulation: policies and procedures that no one can follow because lawyers write them for legal action.

Can't access the links?

Members receive free access to updates. Request access through the link if it prompts you, and we will respond with authorization once verified.

In addition, we now offer the Compliance VP compliance management system for small companies.

Aspirin for Risk Assessments - Relieving Pain for Small Mortgage Firms

What could go wrong?

Demystifying risk assessments by evaluating your solutions

New York State examiners recently began requesting Risk Assessments for NYS Department of Banking applications and some renewals. These requirements applied even to single proprietors who, naturally, felt overwhelmed and confused about what the examiners requested. In fact, risk assessments represent a prudent step in the process of building a business. It's simply asking the question: "what could go wrong?"

In that spirit, here is a sample risk assessment policy and procedure.

The CFPB provides a sample risk assessment in its examination guides, which you can access here. In our view, the CFPB assessment addresses many items, but misses some as well. There is the regulator's well-known penchant for diving into minutia in some elements (like corporate governance and certain regulations), then overly broad assessments of others. The best approach remains thinking through your process.

Risk Management Process for Mortgage Bankers and Brokers

Mortgage Companies small and large face the same risks as any company; physical damage and infrastructure damage from disasters, employee and workplace safety. But financial institutions also face risks specific to the business model: compliance, counter party risk, process management issues and particularly fraud and information security.

Even the smallest company needs to address these issues, and it can seem like an almost insurmountable task. By structuring our business with systems that regularly address these risks and then rationalizing these checks into a standard business flow, the task becomes more manageable and understandable.

The standard risk management process should look like this:

1.      Identify what risks a company faces,

2.      Identify the level of risk to the company, its customers and counter-parties,

3.      How the company mitigates those risks through procedures and other provisions

We have compiled a risk assessment for standard retail mortgage brokering or lending operations, identified the level of risk, and shown how, through policies or procedures, these companies mitigate this risk.

Risk Levels

We follow the CFPB’s model for assessing the risk to the customer.

Quality of Risk Controls

A non-system based Risk Control produces haphazard results. For instance, if there is simply an individual who is responsible for the execution of a risk mitigation procedure, it is likely to be missed. By integrating controls into processes that we already conduct, scheduling regular audits, and using pre-programmed systems like LOS, Credit Reporting tools such as fraud guards, web alerts like Google Alerts, we control these risks automatically.

At the heart of all our risk mitigation is the implementation of a “systems-based” approach that does not rely on an individual to oversee the process. For instance, checklists, step-by-step procedures, and automation all contribute to systematic risk management.

Risk Assessment For Mortgage Companies

Customers of MortgageManuals.com can download samples for their own use here: