10/5/2016 A Day At The Zoo :: Secondary Marketing Executive Issue Library

http://issues.secondarymarketingexec.com/article/a­day­at­the­zoo/ 1/5

Search

The magazine for mortgage banking professionals.

HomeCurrent IssueLibrary

October 2016

A Day At The ZooBy Stephen McGurl

Probably more than 50% of the U.S. population has been to a zoo at some point. It may have been a local petting zoo, a metropolis zoo that has a few exotic animals, or a large, nationalzoo, such as the National Zoo in Washington, D.C. Recently, there were two horrific zoo incidents when people were attacked by animals: one in Chile and one in Cincinnati. In bothcases, the majestic animals were euthanized. Tragically, in Chile, the man who entered the lion habitat wanted to commit suicide and was successful.

10/5/2016 A Day At The Zoo :: Secondary Marketing Executive Issue Library

http://issues.secondarymarketingexec.com/article/a­day­at­the­zoo/ 2/5

These are just two of many similar zoo incidents that have happened around the world in the last 25 years. In almost every case, good internal controls at these zoos could havedramatically reduced the risk. For instance, if a particular animal is capable of mauling or killing a patron, as was the case in Chile, then the zoo should evaluate the risk and match thatrisk against the behavior of the patrons. If a three­year­old can scale a fence or barrier, then the zoo has not eliminated its risk. In fact, it might not have even mitigated the risk at all.Like a zoo manager, a lender should know what its risks are, who its patrons are and how that combination correlates to risk. Safe habitats trump pretty habitats every time. A zoo staffcan create all of the internal controls it can think of, but those controls will not provide the level of safety needed unless they are evaluated for effectiveness and monitored regularly.

Back in 2002, Sarbanes­Oxley was enacted to improve financial controls and investor confidence in publicly traded companies. Remember Tyco, Enron and WorldCom? In this article,we will explore operational controls in mortgage and how they can mitigate risk, control costs and provide for an operational framework for lenders.

Stephen McGurl

Most mortgage companies operate on a scalable business model. In order to be profitable, a lender’s model must be able to scale up and, at times, down in order to take advantage of themarket. All mortgage CEOs need to be able to rely on their senior managers in order to make appropriate business decisions for the good of the organizations. Internal controls are usedas a tool that can measure whether these senior managers have effectively delegated their authority down to their subordinates.In order to be scalable, the controls put in place must be cost­effective, not costly. The benefit that any manager derives from using the control must not be exceeded by implementing thecontrol. For example, if the cost of the control failing is $25.00 per loan, and the failure rate has never exceeded 100 loans per month, then a control that costs $5,000 per month toimplement is not cost­effective.When a lender is evaluating the effectiveness of its operational controls, the first step is to have a description of what the controls are. Evaluate each control’s objective, and make surethat objective is still relevant and all of the components are active – for example, that the reports that are relied on for data are still produced for the control or that the physical asset thatis monitored is still in existence. Any automated control can become “stale” because it is no longer using relevant data from the lender’s systems.Frankly, business processes change all the time; however, the “reviewers” don’t always update their data sources to go along with the process change. There have been circumstanceswhen clients have updated their source data only to find that they can save a day or two on the process. Saving days in a workflow eases up bottlenecks and almost always createssavings.

10/5/2016 A Day At The Zoo :: Secondary Marketing Executive Issue Library

http://issues.secondarymarketingexec.com/article/a­day­at­the­zoo/ 3/5

Next, a lender should be aware of whether a particular control mechanism is important or non­important, or, for the purpose of this article, “key” or “non­key.” This will be important to alender’s process later, when it decides how it is going to reduce costs.A lender should also evaluate which controls are manual and which are automated. It is a red flag when a lender discovers that it has too many manual controls. Manual controls tend tolead to more errors than properly designed automated controls. However, there are times when only manual controls will work – such as checking fences for holes at a zoo.“A good continuous process improvement program should include consistent assessments of manual processes,” said Ellen Rose, senior director of process improvement, redesign andreengineering at Newbold Advisors. “When evaluating manual processes, key controls must be identified at every point in the process. A level­five process map should include allcontrols for evaluation of ‘key’ versus ‘non­key’ control and any systems used to support the processes.”

“Since mortgage servicers serve multiple audiences, from investors such as Fannie Mae/Freddie Mac, to regulatory agencies such as [the] Consumer Financial Protection Bureau[CFPB], determining which control framework to implement is a challenge in itself,“ added Alexander Sidoryansky, an independent accounting and mortgage controls professional.“When in doubt, it is imperative for servicers to design controls to ensure that the borrower is not harmed, whether through an untimely underwriting decision, to inaccurate loanmodification solicitation efforts. Most mortgage servicers will notice that if they design their controls to satisfy the CFPB requirements, they will also satisfy their own and investorrequirements, whether it is Fannie Mae/Freddie Mac, to the private­label investors.”Internal or operational controls are designed to reduce risk. The risk can be of a regulatory nature, fraud or loss nature, or even reputational nature. For the sake of this article, let’s keepinterest rate risk and credit risk in the internal “financial” controls bucket. (Maybe that’s an article for another day.)Operationally, if a lender has not evaluated its controls to see that they meet its objectives, now is a good time to start. What follows are some of the many categories of operationalcontrols:

Segregation of duties;Authorization of transactions;Retention of records;Monitoring of operations;Top­level reviews; andApplications and data.

A lender’s goal should be to evaluate these categories, if applicable to the business, to determine which controls are manual and which controls are automated. A lender may need to addits own categories.After these categories are broken down by their automation status, one can then determine whether they are “key” or “non­key.”A lender must also determine if certain controls are producing a lot of exceptions. Keep in mind that an exception in a control at a zoo is bad. An exception in a control at an ice creamshop is not. Giving away an extra ounce of ice cream is not nearly as dangerous as allowing a three­year­old to fall into a gorilla habitat.So, what can one do with all of this data in order to mitigate operational risk? Lenders should review their controls by type, starting in the upper­left quadrant of the following chart:

10/5/2016 A Day At The Zoo :: Secondary Marketing Executive Issue Library

http://issues.secondarymarketingexec.com/article/a­day­at­the­zoo/ 4/5

A lender should break out its controls that are “key” and have a majority of the processing of those controls handled manually. An example would be a post­closing reviewer manuallyreviewing a closing package that has been scanned into the lender’s document management system. Although the file documents have been converted into a PDF and are being reviewedin an application or system, it is still a manual process. The reviewer must perform a “stare and compare” process that, even with best efforts, is prone to errors that will show up asexceptions.A “key” control that is highly manual is ripe for automation. Even if a portion of the “stare and compare” process is reduced through automation, it can translate into lower risk throughfewer exceptions. Although not every process can be automated 100%, many have room to improve at least 25%. As mentioned previously, continuous monitoring will highlight when adata source changes, and even new technology can improve controls.

By performing this in­depth review, improvements will include elimination of “non­key,” or inhibitive, controls and streamline the process. If the manual process being evaluatedinvolves hand­offs between departments, for example, the need for the hand­off should be evaluated first, and if the hand­off is required, what controls are in place to ensure thatinformation is not lost during the hand­off should be evaluated second.Using the zoo analogy, if the manual finding of a hole in the fence is entered into a repair tracking system, but a data element in the tracking system identifying the location of the hole isnot required and is not filled in, there will be multiple steps in the process – e.g., finding where the hole is, re­inspecting the zoo’s fencing, etc. – that are wasteful. An easy fix to thetracking system to make the location a required field eliminates the potential waste.Finally, an improved risk profile doesn’t just improve from the key/manual controls review. Evaluate the non­key/automated controls to see if they even need to exist. Key/automated andnon­key/manual controls can also render cost savings while not increasing a lender’s risk profile.

Stephen M. McGurl, CMB, is managing director of McGurl Risk Advisors LLC, a consultancy specializing in compliance and regulatory and operational risk; expert witness testimony;litigation support (including forensic underwriting); operational structure and transformation; compensation plans; policy and procedures development; and training programs for themortgage industry. He can be reached at stevemcgurl@mcgurlriskadvisors.net.