Audits and Evaluations

2021

FHFA Did Not Always Follow its Policies for Monetary Awards, Recruitment Bonuses, and Retention Allowances during Fiscal Years 2019 and 2020; FHFA’s Excellence Awards Were Not Included in Agency Policy (AUD-2021-008) -
FHFA’s Failure to Define and Clearly Communicate “Supervisory Concerns” Hinders the Enterprise Boards’ Ability to Execute Their Oversight Obligations Under FHFA’s Corporate Governance Regulation and Renders the Regulation Ineffective as a Supervisory Tool (EVL-2021-003) -
Despite FHFA’s Acknowledgement that Enterprise Reliance on Third-Parties Represents a Significant Operational Risk, No Targeted Examinations of Fannie Mae’s Third-Party Risk Management Program Were Completed Over a Seven-Year Period (AUD-2021-007) -
Audit of an FHFA Sensitive Employment-Related Case Tracking System: FHFA Followed its Access Control Standard, But its System Is Adversely Impacted by Two Security Control Weaknesses (AUD-2021-006) -
FHFA’s Failure to Include the Financial Crimes and Model Components in its CSS Risk Assessment Is Inconsistent with a Risk-Based Approach to Supervision (AUD-2021-005) -
For Nine Years, FHFA Has Failed to Take Timely and Decisive Supervisory Action to Bring Fannie Mae into Compliance with its Prudential Standard to Ensure Business Resiliency (EVL-2021-002) -
FHFA Followed OMB Guidance in Implementing its Enterprise Risk Management Program But its 2020 Risk Profile Failed to Identify a Significant Action Underway to Address Acknowledged Supervision Risk (AUD-2021-004) -
Corporate Governance: Fannie Mae Senior Executive Officers and Ethics Officials Again Failed to Follow Requirements for Disclosure and Resolution of Conflicts of Interest, Prompting the Need for FHFA Direction (EVL-2021-001) -
Audit of FHFA’s Design of Procedures and Guidance to Prevent and Reduce Improper Payments (AUD-2021-003) -

2020

Audit of the Federal Housing Finance Agency’s Information Security Program (Fiscal Year 2020) (AUD-2021-001) -
Audit of the Federal Housing Finance Agency Office of the Inspector General’s Information Security Program (Fiscal Year 2020) (AUD-2021-002) -
Weaknesses in FHFA’s Monitoring of the Enterprises’ 97% LTV Mortgage Programs May Hinder FHFA’s Ability to Timely Identify, Analyze, and Respond to Risks Related to Achieving the Programs’ Objectives (AUD-2020-014) -
FHFA Failed to Follow its Cloud-Based Computing Requirements when it Did Not Validate the Implementation of Minimum Security Requirements for Cloud-Based Tools and Did Not Include Required IT Security Provisions in Some of its Cloud Service Contracts (AUD-2020-013) -
More than Eight Years After Issuing its Advisory Bulletin, FHFA Has Not Held the Enterprises to its Expectations on Charging off Delinquent Loans or Communicated New Expectations (EVL-2020-003) -
FHFA Completed All of its Planned Ongoing Monitoring Activities for Freddie Mac for 2019 (AUD-2020-012) -
FHFA Completed Most of its Planned Ongoing Monitoring Activities for Fannie Mae and CSS for 2019; However, FHFA Failed to Follow its Requirements When it Changed Examination Plans for Non-Risk-Based Reasons and Failed to Obtain Deputy Director Approval (AUD-2020-011) -
DBR’s Examinations during the 2017 through 2019 Examination Cycles Generally Complied with its Guidelines, but Some Exceptions to those Guidelines Were Not Documented and/or Approved, and DBR’s Quality Control Branch Failed to Identify these Shortcomings (AUD-2020-010) -
FHFA Examiners’ Lack of Assessment and Escalation of Shortcomings Identified by an Enterprise in its Servicer Fraud Risk Management Framework Limited the Agency’s Supervisory Oversight (EVL-2020-002) -
FHFA Cannot Assure that All Electronic Media Approved for Destruction in October 2018 Was Destroyed, and it Continues to Lack Adequate Controls over Electronic Media Targeted for Disposal (AUD-2020-009) -
FHFA Needs to Strengthen Controls Over its Records Management Program to Comply with OMB and NARA Requirements (AUD-2020-008) -