Enterprise-Wide Risk Assessments for Small Mortgage Companies

Small mortgage companies face the same regulatory expectations as larger institutions when it comes to identifying and managing risk. Even with one or two branches and fewer than fifty employees, regulators expect management to conduct an enterprise-wide risk assessment (EWRA) that evaluates exposures across operations, compliance, cybersecurity, and customer interactions. The EWRA provides a structured approach to documenting where risks exist, how they are controlled, and how frequently those controls are reviewed.

Risk Assessment Framework

The EWRA matrix organizes risks into categories, assigns an initial rating, lists the existing mitigation measures, records the residual rating, identifies the responsible party, and determines the review frequency.

We provide a tool to conduct your Risk Assessment internally. The idea is a four-step process: 1.) Identify Risk 2.) Risk Level (low, medium, or high) 3.) Where and how the risk is mitigated (e.g. policies/audits) and 4.) Post-mitigation risk.

• Advertising – Online or remote application gateways

  • Initial Risk: Medium

  • Mitigation: Advertising compliance checklist; social media policy review

  • Residual Risk: Low

  • Responsibility: Compliance Officer

  • Review: 12 months

• Advertising – Non-compliant advertising or social media use

  • Initial Risk: Medium

  • Mitigation: Advertising audit and officer oversight

  • Residual Risk: Low

  • Responsibility: Marketing Manager, reviewed by Compliance Officer

  • Review: 12 months

• Compliance – Failure to comply with published regulations

  • Initial Risk: High

  • Mitigation: Regulatory Compliance Management System, documented policies and procedures

  • Residual Risk: Low

  • Responsibility: Compliance Officer / Management

  • Review: 12 months

• Cyber-Security – Customer data exposure

  • Initial Risk: High

  • Mitigation: Red Flags Identity Theft program, written safeguarding policies, IT security plan

  • Residual Risk: Medium

  • Responsibility: IT Administrator or designated third-party vendor, overseen by Management

  • Review: 12 months

• Fair Lending – Credit decisioning risk

  • Initial Risk: Medium

  • Mitigation: Fair Lending Plan with monitoring and comparative file review

  • Residual Risk: Low

  • Responsibility: Underwriting Manager / Compliance Officer

  • Review: Annual

Responsibility for the EWRA

Responsibility for the risk assessment rests with management. In small companies without a board of directors, the owner, managing broker, or designated compliance officer typically prepares the matrix and maintains the record. Regulators expect management to review and approve the EWRA annually and when major changes occur, such as opening a branch or introducing a new loan product. Companies may hire a third party to conduct or validate the assessment, but if they follow the structured process outlined in Form 1-80, they can complete the EWRA internally without outside assistance.

Application for Small Companies

A small mortgage company must demonstrate that it applies this framework proportionately to its size.

• Policies such as the QC Plan, Compliance Manual, and IT Security Plan serve as the mitigation layer.

• Risk ownership is documented directly in the matrix to show who is accountable for each item.

• The EWRA is updated when products, vendors, or branch operations change.

• Documentation is reviewed during examinations to confirm the company has a process to identify and mitigate risks.

States That Require Enterprise-Wide Risk Assessments

Several states have explicit or implied EWRA requirements tied to licensing examinations. Current examples include:

• Texas – Department of Savings and Mortgage Lending (SML) requires annual EWRA documentation.

• Washington – Department of Financial Institutions (DFI) cites EWRA in examinations.

• South Carolina – Department of Consumer Affairs requires an IT-security-focused EWRA.

• New York – Department of Financial Services (DFS) requires risk assessments as part of cybersecurity compliance.

• Connecticut – Banking Department requests EWRA in mortgage company exams.

• California – Department of Financial Protection and Innovation (DFPI) includes EWRA in compliance review requests.

• Florida, Virginia, and Maryland – examiners frequently request EWRA documentation, even if it is not formally codified.

Next Steps - Conduct one NOW!

An EWRA is a core element of compliance for small mortgage companies. By documenting risks, mitigation, responsibilities, and review cycles in a structured matrix, the company demonstrates control of exposures across advertising, compliance, cybersecurity, and fair lending. Regulators expect to see this process in place, regardless of company size.

Gramm-Leach-Bliley FTC Safeguard Rules Updated 6/2023 - Regulators asking lots of questions

Changes published in 2021 went into final effect in June 2023. Now, regulators are stepping up their review.

We've been seeing the impact of the updated CyberSecurity examinations prompted by the December 2021 FTC rule revisions. Regulators are dumping massive checklists into the exam load, and most companies don't have the bandwidth to address it. It's a hefty load, but it's worth going through to establish a baseline. 

Click here for the updated rule 

Click here for the CSBS Model Examination Form for non-banks 

The word you will see the most in an examination citation is "implementation." This means that, no matter how good your model policy is, if you're not doing - or have evidence that you can do - the things the rule requires, you'll likely be cited. 

Like every good compliance program, policies and procedures are simply part of a complete IT Security Plan. There are 4 pillars of every compliance program: 

1. a compliance officer, 
2. policies and procedures
3. training, and 
4. testing/auditing. 

Most of the policies we've seen are precisely that - policies. There is very little procedure. In other words, the model form says, "We will comply," but doesn't say, "This is how we comply." This is the most significant difference between our products and those written by lawyers or compliance experts. 

Location of IT Security Questionnaire Items in 2-9 IT/CyberSecurity Plan

 

States Strictly Enforcing GLB Compliance

• DC
• Maryland
• Massachusetts
• Virginia
• Texas
• New York

Remember to add those non-policy items

• List of hardware (investor)
• List of software and cloud services
• List of vendors (investors, office tech, processors, etc. )
• Cyber Insurance Policy

Tools for Self-Training

MortgageManuals.com provides training for our customers' Non-NMLS employees. 

Tools for Self-Audit

We provide the tools for a self-assessment, but if you want a third party risk assessment we do that here.

The Buzz on Cyber Security

Federal Rules Expand the Scope of Your Customer's Data Protection

In case you were wondering about the onslaught of regulator or investor requests for cybersecurity plans, risk assessments, and MFA certifications, it all has to do with FTC regulations passed last year that go into effect December 9, 2022. The FTC has extended the deadline for compliance for 6 months, making the new deadline 6/9/2023.

eCFR :: 16 CFR Part 314 -- Standards for Safeguarding Customer Information

In a nutshell, our customers have all of the tools to meet these requirements in the 2-90 IT Security Plan. These include:

• Employee Training
• Risk Assessment
• Third-Party Vendor Reviews
• Data Breach Response and Remediation

Small companies - responsible individual

For small firms, you should assign a responsible individual who is knowledgeable about the technology aspects of your firm. They do not need to have a degree in cybersecurity. However, they should know all the firm's tech and communications infrastructure and have the capability to completely answer the cybersecurity questionnaire. If the individual is NOT able to answer the questionnaire, you MAY designate a third party, such as an IT consultant. We caution small companies against signing big contracts if the firm's technology consists mostly of leased cloud computing assets, such as LOS, document storage, and email. Even third-party apps, like online 1003s, should come with some tech support, and you can designate a 3rd party (even the vendor) specifically for those types of risks. 

Don't "Build Castles" - Use the Tools you Have

We really try to avoid creating additional work in the form of a separate workflow for compliance-related matters. That's why you should use some of the resources you already have to meet some or all of the requirements. 

• Credit Bureau Audits - If you have the ability to pull credit reports yourself (instead of just through your investor/wholesaler directly) you likely have a credit bureau service provider. This firm is responsible for evaluating your firm (usually annually) and providing a risk assessment based on that evaluation. That should be a foundation. Review their report against the overall questionnaire to see how many items are covered.
  
  • By the way, bureaus are conducting these audits furiously as a part of the new rule's implementation
• State Certifications - keep a copy of any questionnaire you complete to assess your technology. THIS COUNTS AS AN AUDIT or RISK ASSESSMENT
• When you sign up with a tech provider, get their SOC or ISO certification information. Use the vendor's reviews as your own.
• When getting training, make sure you keep a copy
• Read your policies and procedures - if they don't make sense, get a plain English translation!

Speaking of Plain English - here's our summary of the IT/Cyber Security Plan requirements that you can use as a checklist. 

New York Cybersecurity Certification

The Section NYSDFS 500 updates that went around earlier this year include the updates from the FTC's rule. The changes do not represent a departure from current best practices but memorialize the requirements in the FTC's Safeguarding rule.

Remember that the certification only captures information on what you are doing. Policies and procedures should reflect this information; they don't replace your implementation. 

You can request help completing your Cybersecurity Certification here

 

Advertising, VA QC Requirements, NY Compliance Plan Update

We continue to update our products as we get feedback from our customers. We list the recent updates here, some of which relate to our review of materials from our Compliance VP CMS product. You will notice three themes for this series of updates:

Advertising on the Radar

Prompted by a Washington state review this past spring, advertising for particular products have come on to the Federal government's radar. The CFPB has stated its renewed interest in protecting veterans, and so has Veterans Affairs. Specifically, the question surrounds whether the way companies advertise certain programs comprises puffery or a deceptive act.

Reporting Notices of Advertising Related Findings to HUD-FHA

A company must report any notice, sanction or citation received, from any state or federal regulator, agency or investor, relating to its advertising practices as a "Notice of Material Event" through their Quality Control plan.

Advertising
We recommend that you review all advertising (even business cards, emails and social media postings) using an advertising approval checklist. Look most carefully at unsubstantiated claims, like best rate, fastest service, or lowest cost and avoid them unless you can substantiate them.

Advertising Trigger Terms
An updated checklist reviews what text or information you have to include if your advertising includes "trigger" terms.

VA Adamant about following Updated Pamphlet

Inclusion of VA Specific Requirements in Plan
The VA now uses a checklist to validate that you have included its specific quality control plan requirements in your plan. The updated pamphlet published 2/1/2019, has a listing of QC requirements, which the VA simply has memorialized in writing. We have most of this material in the QC plan, so this update references where a reviewer can find it. The only addition focuses on the use of Staff Appraiser Reviews, which doesn't really impact Post Closing QC, but which we add to the post-closing review process anyway.

New York State DFS - Again

New York State Compliance Plan
We have prepared a New York State-specific compliance plan to align with licensing application and renewal review feedback. To meet their requirements, we stripped out a lot of material they felt was extraneous. You should not exclude other elements of your compliance plan and rely solely on the DFS' explicit requirements, because we have found myriad other implicit and explicit requirements within the rules which could also result in findings.

Other Updates also available

Fraud Prevention – Red Flag Process
We inadvertently truncated the Fraud Reporting process, as it applied to possible organized crime. Or maybe an unseen hand silenced the author?

Unfair Deceptive Abusive Acts and Practices (UDAAP)
Certain investors wanted us to include CFPB definitions of unfair, deceptive and abusive acts. Reading the definitions you realize their redundancy; all UDAAP actions really tie back to the same actions. One unfortunate side-effect of so much regulation: policies and procedures that no one can follow because lawyers write them for legal action.

Can't access the links?

Members receive free access to updates. Request access through the link if it prompts you, and we will respond with authorization once verified.

In addition, we now offer the Compliance VP compliance management system for small companies.

Aspirin for Risk Assessments - Relieving Pain for Small Mortgage Firms

What could go wrong?

Demystifying risk assessments by evaluating your solutions

New York State examiners recently began requesting Risk Assessments for NYS Department of Banking applications and some renewals. These requirements applied even to single proprietors who, naturally, felt overwhelmed and confused about what the examiners requested. In fact, risk assessments represent a prudent step in the process of building a business. It's simply asking the question: "what could go wrong?"

In that spirit, here is a sample risk assessment policy and procedure.

The CFPB provides a sample risk assessment in its examination guides, which you can access here. In our view, the CFPB assessment addresses many items, but misses some as well. There is the regulator's well-known penchant for diving into minutia in some elements (like corporate governance and certain regulations), then overly broad assessments of others. The best approach remains thinking through your process.

Risk Management Process for Mortgage Bankers and Brokers

Mortgage Companies small and large face the same risks as any company; physical damage and infrastructure damage from disasters, employee and workplace safety. But financial institutions also face risks specific to the business model: compliance, counter party risk, process management issues and particularly fraud and information security.

Even the smallest company needs to address these issues, and it can seem like an almost insurmountable task. By structuring our business with systems that regularly address these risks and then rationalizing these checks into a standard business flow, the task becomes more manageable and understandable.

The standard risk management process should look like this:

1.      Identify what risks a company faces,

2.      Identify the level of risk to the company, its customers and counter-parties,

3.      How the company mitigates those risks through procedures and other provisions

We have compiled a risk assessment for standard retail mortgage brokering or lending operations, identified the level of risk, and shown how, through policies or procedures, these companies mitigate this risk.

Risk Levels

We follow the CFPB’s model for assessing the risk to the customer.

Quality of Risk Controls

A non-system based Risk Control produces haphazard results. For instance, if there is simply an individual who is responsible for the execution of a risk mitigation procedure, it is likely to be missed. By integrating controls into processes that we already conduct, scheduling regular audits, and using pre-programmed systems like LOS, Credit Reporting tools such as fraud guards, web alerts like Google Alerts, we control these risks automatically.

At the heart of all our risk mitigation is the implementation of a “systems-based” approach that does not rely on an individual to oversee the process. For instance, checklists, step-by-step procedures, and automation all contribute to systematic risk management.

Risk Assessment For Mortgage Companies

Customers of MortgageManuals.com can download samples for their own use here: