Audits and Evaluations

2016

Performance Audit of the Agency's Information Security Program Fiscal Year 2016 (AUD-2017-001) -
FHFA’s Targeted Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed (AUD-2016-007) -
FHFA’s Targeted Examinations of Fannie Mae: Less than Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed and No Examinations Planned for 2015 Were Completed Before the Report of Examination Issued (AUD-2016-006) -
FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments and Most High-Priority Planned Examinations Were Not Completed (AUD-2016-005) -
Kearney & Company, P.C.'s Results of the Federal Housing Finance Agency's Cybersecurity Act Audit (AUD-2016-004) -
FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those Reports (EVL-2016-009) -
FHFA's Failure to Consistently Identify Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the Enterprise Boards to Exercise Effective Oversight of Management's Remediation of Supervisory Concerns (EVL-2016-008) -
FHFA's Inconsistent Practices in Assessing Enterprise Remediation of Serious Deficiencies and Weaknesses in its Tracking Systems Limit the Effectiveness of FHFA's Supervision of the Enterprises (EVL-2016-007) -
FHFA Complied with Applicable Improper Payment Requirements During Fiscal Year 2015 (AUD-2016-003) -
Corporate Governance: Cyber Risk Oversight by the Fannie Mae Board of Directors Highlights the Need for FHFA's Closer Attention to Governance Issues (EVL-2016-006) -
FHFA's Supervisory Standards for Communication of Serious Deficiencies to Enterprise Boards and for Board Oversight of Management's Remediation Efforts are Inadequate (EVL-2016-005) -
FHFA's Examiners Did Not Meet Requirements and Guidance for Oversight of an Enterprise's Remediation of Serious Deficiencies (EVL-2016-004) -
FHFA Should Map Its Supervisory Standards for Cyber Risk Management to Appropriate Elements of the NIST Framework (EVL-2016-003) -
FHFA's Oversight of the Enterprises' Implementation of and Compliance with Conservatorship Directives during an 18-Month Period (ESR-2016-002) -
Review of FHFA's Tracking and Rating of the 2013 Scorecard Objective for the New Representation and Warranty Framework Reveals Opportunities to Strengthen the Process (AUD-2016-002) -
FHFA Should Improve its Examinations of the Effectiveness of the Federal Home Loan Banks' Cyber Risk Management Programs by Including an Assessment of the Design of Critical Internal Controls (AUD-2016-001) -
Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear Standards and Defined Measures of Risk Levels (EVL-2016-001) -

2015

Intermittent Efforts Over Almost Four Years to Develop a Quality Control Review Process Deprived FHFA of Assurance of the Adequacy and Quality of Enterprise Examinations (EVL-2015-007) -
FHFA’s Exercise of Its Conservatorship Powers to Review and Approve the Enterprises’ Annual Operating Budgets Has Not Achieved FHFA’s Stated Purpose (EVL-2015-006) -
Kearney & Company, P.C.’s Independent Evaluation of the Federal Housing Finance Agency Office of Inspector General’s Information Security Program – 2015 (AUD-2015-003) -