How Independent Mortgage Bankers Should Prepare for an Agency Compliance Examination

Mortgage banking audit and compliance services for independent mortgage bankers should connect financial assurance, documented controls, and evidence of ongoing compliance. Preparing for an agency compliance examination therefore means building a year-round operating process, with documents assembled before notice arrives. The strongest preparation shows that policies are current, controls are functioning, and audit trails support what the firm says it does.

Why agency exams are shifting from file-by-file review to systemic readiness

Agency examinations focus more and more on underwriting quality, portfolio performance, and whether systems of control work, with less attention to small errors in the documents for otherwise sound loans. Examiners compare written policies with how the firm works, so even sound loans can leave a mismatch between the two. The mismatch is itself an examination finding. This shifts preparation from checking whether individual files are complete to demonstrating that the institution's controls work.

State examination scheduling reinforces that shift because prior ratings, complaint volume, loan volume, and compliance history influence when and how a firm is examined. Thin documentation and past findings can bring an earlier return visit. Washington DFI's examination guidance emphasizes organized records and preparation before notice arrives as ways to reduce the examination burden. Gathering documents at the last minute cannot show that controls have worked over time.

The financial standing requirements that must be continuously met, not just met at year-end

HUD-approved mortgagees and Ginnie Mae issuers must satisfy applicable adjusted net worth, liquidity, and capital thresholds continuously. Fiscal year-end is not the only test. An IMB that falls below a required threshold during the year has compliance exposure even if its position recovers before closing its books. For single-family issuers, Ginnie Mae requires a base net worth, a liquidity floor, a leverage ratio, and a risk-based capital ratio to be satisfied simultaneously. The liquidity floor is the greater of a fixed floor or a basis-point percentage of the servicing portfolio.

Owner distributions can make those overlapping requirements harder to meet because a mortgagee must keep a set share of required adjusted net worth in liquid assets. A distribution can therefore create a breach between reporting dates. The practical response is to track net worth and liquidity at least monthly and reconcile both before approving a material distribution. An issuer that loses good standing as a Fannie Mae- or Freddie Mac-approved servicer must notify Ginnie Mae's Office of Issuer & Portfolio Management immediately and certify standing annually through its Audit Guide Reports.

What should an IMB look for in a mortgage banking audit firm

For profit-motivated HUD program participants, the annual audit must include both a financial statement audit and a compliance audit of major HUD programs under HUD's Audit Guide. These are distinct required components. The compliance opinion addresses adherence to applicable laws, regulations, and contract provisions, giving examiners assurance that financial results alone cannot provide. A report that fails to satisfy this dual requirement creates examination exposure independently of the underlying results.

For an IMB choosing an audit firm, the relevant distinction is therefore knowledge of HUD's Audit Guide and GAGAS requirements in addition to familiarity with GAAP. Ginnie Mae's Issuer Application Checklist requires audited financial statements for the three most recent fiscal years, including an Adjusted Net Worth Schedule, an Auditor's Report on Internal Control, and an Auditor's Report on Compliance with Major HUD Programs. Treating the audit as a commodity purchase overlooks whether its scope and reports will meet the requirements of the next agency application or examination.

How policies and procedures function as the examiner's primary lens

The compliance audit's focus on laws and contracts extends into the examination of everyday operations through written policies. Required areas include origination and production, processing, underwriting and credit policy, closing, funding and warehouse operations, mortgage servicing, and third-party origination. Anti-money laundering, information security and cybersecurity, and MERS quality assurance also require attention. A gap in one area remains individually citable even when the rest of the policy framework is complete.

The test is not simply document coverage. Examiners also assess whether policies are current, accessible, and aligned with how the IMB actually operates. A sound practice can still generate a finding when the written policy describes something different. Policies therefore need editable, updatable formats so that regulatory changes can become documented requirements without a structural delay. A locked template or static document that cannot be revised leaves the firm unable to keep its compliance file synchronized with its obligations.

The Quality Control plan as a standalone deliverable that examiners evaluate on its own merits

The Quality Control plan receives separate scrutiny because it describes how the IMB evaluates its own work. Its scope must fit the business model. Non-delegated and broker plans differ from delegated and lender plans, while Ginnie Mae issuers face additional post-closing requirements specific to HUD programs. The plan must address Fannie Mae and Freddie Mac pre-funding audit requirements, fraud red flag detection and prevention, and CFPB-readiness language separately, using the agency standards that apply to each. Generic language cannot replace those distinctions.

A complete plan must also have evidence from pre-funding or post-closing reviews that shows the firm has carried it out. Writing the plan does not establish its operation. An IMB that adds servicing must expand its production-only plan to address servicing quality control separately. To document maintenance, the firm should date-stamp revisions, retain prior versions, and record whether each update followed a regulatory change, agency guide revision, or examination finding. That maintenance history becomes evidence of a functioning compliance program.

Anti-money laundering and cybersecurity as non-negotiable, independently audited requirements

Residential mortgage lenders and originators are financial institutions under the Bank Secrecy Act, including 31 CFR Part 1029.210. Their AML programs must fit their size, the products they offer, and how complex their business is, and must include an independent audit. A written plan alone does not satisfy the requirement. Washington DFI's FAQ confirms the need for a firm-specific program and an independent audit recent enough to be current for examination purposes. Annual AML training certificates are a parallel obligation, and missing records can be cited independently of the plan's quality.

Cybersecurity controls also need their own assessment, even when broader QC work is in place. Borrower-facing portals and digital payment systems expand the exposure that the assessment must address. An assessment predating a newly deployed platform is stale. The preparation response is to schedule AML audits and cybersecurity risk assessments on a fixed annual calendar, independent of examination cycles. These requirements need attention throughout the full compliance lifecycle because gaps can lead to separate enforcement actions as well as lending-related findings.

Staff training records as audit evidence, not just an HR function

Training certificates connect written policies to the people expected to execute them. They are both examination evidence and HR records. The required training differs among loan originators, underwriters, closers, and servicers, so a single undifferentiated record does not establish that each role's requirements have been met. Certificates of completion provide the evidence artifact that verbal assurances or participation logs without certificates cannot replace. Employees hired after the last annual cycle also need their own onboarding training records, since annual records for established staff do not demonstrate new-employee training. The practical implication is to store certificates in the same organized, retrievable compliance file as policies, QC plans, and audit reports. If the firm cannot produce them within an examination request's response window, the examiner's record contains a gap whether or not the training occurred.

SOC 1 reporting for servicers and its significance to GSEs and investors

A servicer's control environment also faces scrutiny through its counterparties' financial statement audits. Under SSAE 18, AT-C Section 320, an external auditor needs assurance that the service-organization controls that matter to a user entity's Internal Control over Financial Reporting work. A SOC 1 report provides that assurance. Without a current report, an investor's auditor must either test directly at the servicer's facility or issue a scope limitation on the investor's financial statement audit. Both outcomes impose costs and signal counterparty risk that a state examination cannot resolve after the fact.

A Type II report also needs an observation period, so work to prepare for it must start in advance. It cannot manufacture an unmonitored control history retroactively. Auditors are moving toward continuous evidence rather than point-in-time records, so quarterly configuration screenshots are increasingly insufficient for the evidence density required. To meet that demand, servicers need to be able to use compliance automation or continuous control monitoring. Those operating borrower-facing web or mobile portals may also receive SOC 2 requests from prospects and regulators, but SOC 2 addresses different control domains and does not replace SOC 1.

Related-party transactions and MSR accounting as specific exam pressure points for closely held IMBs

Closely held IMBs face additional questions where tax decisions intersect with financial reporting and regulatory capital. How a loan sale is structured affects how gain on sale is recorded, and owners' tax elections can create temporary differences. Those differences need a clear documentary explanation. Installment treatment and mark-to-market elections for MSRs can produce discrepancies between GAAP financial statements and regulatory capital schedules that agency reviewers will probe. The financial audit must also show related-party balances and inter-entity transactions in a way that agrees with how they appear in the regulatory presentation.

Beyond checking the available liquidity before approval, reviewers examine when distributions occurred and how they were documented relative to the net worth calculation period. Preparation should therefore include reconciling related-party balances, documenting the arm's-length basis for inter-entity transactions, and confirming that no distributions occurred while the liquidity floor was at risk. These decisions happen throughout the operating year. Proactive, year-round tax advisory addresses that timing in a way that an annual return-preparation exercise cannot.

Building the continuous preparation process that replaces pre-exam scrambling

To turn these requirements into an operating cycle, an IMB should assign a named owner and calendar trigger to each compliance domain. That includes QC plan maintenance, policy updates, the AML program and independent audit, cybersecurity risk assessment, SOC 1 observation-window management, training, and net worth and liquidity monitoring. Ownership makes the calendar an operating responsibility. Regulatory change management should feed policy updates as changes occur rather than leaving revisions until an examination approaches. Fragmented regulatory sources and missed updates otherwise leave documented procedures behind current requirements.

Once a year, an internal review should use the same information-request framework that examiners use. Companies can use QuickIR in the State Examination System to browse standard requests and prepare their responses ahead of time. This gives the review a concrete test. Working through those requests can show where documents are missing or evidence is incomplete before the examiner asks for them. The exercise also tests whether the firm can find and retrieve the compliance file it has put together.

Financial statement audit timing should be coordinated with that calendar because late or incomplete schedules and reports create gaps in downstream applications and examinations. Advertising and social media compliance also need ongoing review because digital advertising changes faster than a yearly policy review can keep up with. The cycle reaches beyond the annual audit. With current documents, scheduled assurance work, and evidence of control operation already in place, the examination does not have to reveal whether the IMB is ready.