Top Mortgage Banking Audit Firms for Independent Lenders and Regional Banks

Mortgage banking audit and compliance services for independent mortgage bankers require a firm matched to the lender’s obligations. Richey May has documented work as a specialist in IMB internal audit, while larger firms meet a wider range of banking needs and specialists handle HUD and AI assurance. The right shortlist turns on mortgage accounting fluency, independent controls testing, and demonstrated capability in each additional track the lender faces.

Why mortgage banking audits have grown more complex for independent lenders and regional banks

Independent mortgage banks and regional banks face three sets of regulatory demands that overlap: GSE oversight of seller-servicer controls, HUD requirements for audited financial statements, and new expectations for AI governance. These pressures run simultaneously where the lender’s activities bring them into scope. They do not ask the same question. Controls work looks at design and operating effectiveness, financial statement work deals with accounting judgments, and AI assurance looks at risks that a standard security review does not fully cover.

A lender may need both financial statement assurance and independent controls testing even before it has to deal with HUD or AI. HUD-insured healthcare real estate introduces program-specific reporting, while AI/ML in origination or servicing introduces questions about purpose, use, and safeguards. Experience in general commercial audit alone does not show that a firm can meet all those obligations.

The complexity also extends beyond the lender itself. Origination and servicing systems are part of the controls environment, and Fannie Mae’s AI/ML disclosure expectations extend to subcontractors and vendors. What, then, counts as adequate audit coverage? Adequate audit coverage requires the auditor to understand the lender’s operations well enough to distinguish these obligations.

What GSE-mandated controls attestation actually requires from a mortgage banking auditor

GSE controls requirements call for an independent check that controls are well designed and work as they should. An internal compliance review is not an equivalent substitute. Fannie Mae and the CFPB have emphasized comprehensive, written internal audit plans for evaluating and monitoring origination and servicing quality. A compliance officer or quality control plan alone does not meet the independence requirement.

That distinction determines how the work must be organized. A mortgage banking internal audit needs a risk assessment framework, an audit program addressing relevant policies and procedures, and ongoing assessment and testing reported to the audit committee. Each stage has a different purpose. Risk assessment establishes the areas requiring attention, while testing supplies evidence about whether the controls work.

Co-sourcing with an existing internal team is permissible, but the outside auditor must remain free from operational influence over the functions being tested. IT general controls testing, IT risk assessments, and security audits are also part of mortgage banking internal audit because loan-level controls work through origination and servicing systems.

What the financial statement audit layer demands from a firm serving independent mortgage banks

Mortgage servicing rights valuation, gain-on-sale accounting, warehouse line treatment, and interest rate risk disclosures make an audit of mortgage banking financial statements different from a standard commercial engagement. These are areas where the auditor needs enough industry fluency to challenge management’s estimates and recognize material judgments. Familiarity with controls documentation does not, by itself, demonstrate that ability.

Revenue is heavily tied to origination volume and the rate environment, so going-concern assessments, reserve adequacy, and fair value measurements require an understanding of that concentration. What assumptions are reasonable in a cyclical business? The auditor must assess those assumptions as well as check whether management has put them in writing.

Regional banks add an institutional layer when they operate mortgage banking subsidiaries or hold significant held-for-sale portfolios. The OCC, FDIC, and Federal Reserve expect audit coverage to integrate with the bank’s overall risk-based audit approach. Documentation must support that integration. Workpapers need traceability from control requirements through testing steps to evidence that regulators and audit committees can review, making approval-ready documentation a functional requirement.

How HUD Section 232 requirements add a third audit obligation for lenders in healthcare real estate

HUD-insured healthcare real estate introduces a separate program obligation beyond GSE controls attestation and GAAP-only financial statement work. The applicable HUD program requires an annual financial statement audit following HUD’s own audit guide, with specific disclosures. General accounting competence is not enough here. Relatively few CPAs are qualified for HUD audits, and an auditor without active program experience cannot simply adapt a standard GAAP engagement.

HUD 232/LEAN and 223(a)(7) borrowers must submit GAAP financial statements within the required period after fiscal year-end. The updated Section 232 Handbook has provisions that take effect January 5, 2026, and apply to all new loan applications. For freestanding skilled nursing facilities, the CMS-2540-24 Medicare cost report applies to cost reporting periods ending on or after September 30, 2025.

HUD OIG’s April 2, 2026 audit, Report #2026-BO-0001, found that the Office of Residential Care Facilities was not promptly mitigating financial risks reported in borrowers’ audited financial statements. The finding puts the use of audited information under scrutiny. It should not be confused with a finding that every underlying audit was deficient.

HUD OIG is also revising the Consolidated Audit Guide, Handbook 2000.04, chapter by chapter. This moving guidance makes current HUD-specific professional development important. Lenders with HUD-financed assets therefore need coverage that preserves depth in both mortgage banking and HUD work.

What AI governance requirements mean for mortgage banking auditors right now

Fannie Mae’s LL-2026-04 covers security controls as well as the purpose, manner of use, and risk safeguards of AI/ML systems. When asked, seller-servicers must promptly disclose that information, and vendors and subcontractors must meet the same standards. A SOC 2 Type II report cannot answer every such question. For lenders using AI in origination or servicing, assurance now includes how those systems behave as well as the security environment around them.

AIUC-1 launched in mid-2025 as a certifiable standard for AI agents developed by a consortium of CISOs and security leaders. It involves live testing across thousands of risk and attack combinations, including hallucinations, data leakage, and manipulative requests. Its six principles cover data and privacy, security, safety, reliability, accountability, and society. The technical testing distinguishes it from a policy review.

The AICPA and AIUC announced a joint SOC 2 and AIUC-1 assurance offering on October 19, 2026, with a full launch expected in early 2027. Both require annual renewal, while AIUC-1 also requires quarterly technical retesting. The announcement moves AI assurance toward a CPA-led engagement model. It does not establish that every CPA firm can deliver that model today.

Independence remains a legitimate due diligence question. AIUC writes the standard, accredits auditors without an external accreditation body, runs technical evaluations, issues certificates, and sells related insurance, while independent accredited firms perform the audits. The partnership announcement also leaves unclear whether AIUC-1 becomes part of the CPA’s opinion or a separate certificate, and who performs quarterly retests.

Schellman was named AIUC-1’s first accredited auditor in February 2026, providing a concrete reference point for accreditation. A lender evaluating auditors should now ask about that accreditation status specifically.

How do you evaluate a mortgage banking audit firm against these three tracks?

The practical evaluation groups financial statement and GSE controls work into one capability assessment, HUD qualification into a second where applicable, and AI assurance readiness into a third. Strength in one does not establish the others. For the mortgage banking track, evidence should include professionals who work in that field, loan-level exception coding, and audit-trail links that run from sampling through remediation. Workpapers should be structured for regulator and audit committee review.

For HUD work, the assessment turns on direct experience with the audit guide and current professional development. Active membership in the Affordable Housing Association of Certified Public Accountants, or AHACPA, and the BKR Affordable Housing practice group can signal that specialization. The engagement team still needs experience with the applicable program.

For AI assurance, the questions concern accreditation, joint engagement capability, and responsibility for quarterly retesting. Scale also affects fit across the tracks. Enterprise lenders may need a firm that covers a wide range of regulatory needs, while more focused IMB and regional bank engagements may benefit from a named specialist partner and a team that stays on the work.

Independence cuts across those comparisons. A lender should ask how audit personnel are separated from advisory work for the same client.

Firms with demonstrated mortgage banking audit capability, matched to lender type and track

Richey May is the clearest documented specialist here for the IMB internal audit track. It has nearly 40 years of experience serving lenders and offers co-sourced and fully outsourced internal audit. It works in three phases: risk assessment, audit program design, and ongoing assessment and testing for CFPB and GSE compliance. As part of its IT internal audit services, it offers IT general controls testing, security audits, and compliance reviews.

Deloitte offers mortgage audit and compliance assurance built around control objectives, the procedures tested, and the evidence used for verification. Its documentation supports governance approvals, controlled baselines, and remediation. PwC emphasizes traceable testing, approval workflows, and documented remediation, with coverage spanning the credit lifecycle and IT general controls. These capabilities fit broader regulated banking operations. For regional banks, PwC’s linkage between findings, control expectations, and operational workflows is particularly relevant.

KPMG offers mortgage assurance that covers controls mapping, verification evidence, and change-control governance, with loan-level exception coding that links sampling to remediation. It also has an AIUC-1-certified capability, providing a documented AI reference point without establishing auditor accreditation by inference. EY’s mortgage audit and compliance advisory work emphasizes traceability from control requirements to evidence, structured approvals, consumer protection, and servicing governance. Both address lender and servicer operations. Their relevant distinction is the documented work scope.

BDO’s mortgage lending and servicing audits emphasize controlled testing artifacts, governance documentation, and verification evidence packages. It also performs SOC examinations for financial services clients. Grant Thornton focuses on control design and operating effectiveness, evidence that can be traced, and change management that meets governance needs. RSM links standards, control objectives, and evidence in mortgage audits and compliance engagements. For middle-market institutions, RSM is a named option for external audit, internal audit, and loan review under one engagement.

Schellman & Company serves the SOC and AI assurance track rather than standing in for a mortgage financial statement specialist. It issues more than 2,000 SOC reports annually and offers a single-assessor approach for concurrent SOC 2 and ISO 27001 work. Its accreditation provides the AI-specific credential discussed above. For lenders coordinating parallel assurance requirements, that combination is relevant to the technology portion of the engagement.

The CJ Group has a practice built around HUD multifamily and affordable housing audits, with active AHACPA and BKR Affordable Housing membership and HUD-specific professional development. Sikich CPA LLC has a different documented HUD credential. HUD OIG contracted it to audit FHA’s fiscal year 2025 financial statements and report on internal control over financial reporting and compliance. That establishes government-level HUD audit depth. For lenders spanning mortgage banking and HUD, a full-service firm still needs dedicated expertise in both practices.

Questions a lender should ask before signing an engagement letter

Who is the engagement partner, and how many mortgage banking audits has that partner personally led in the past three years? Can the firm share a sample workpaper that links control objectives through testing procedures to verification evidence? Does it offer co-sourced and fully outsourced internal audit, and how does it preserve independence from advisory work for the same client?

HUD borrowers need a separate set of answers. Does the firm hold active AHACPA membership or equivalent HUD-specific credentials, and how do its professionals stay current on Handbook revisions? Has it audited borrowers under the provisions effective January 5, 2026? Can it cover the CMS-2540-24 cost report obligation for skilled nursing facilities as well as the Section 232 financial statement audit?

Does the firm hold AIUC-1 accreditation, and can it deliver a joint SOC 2 and AIUC-1 engagement? Who performs quarterly technical retesting, and how is that work documented? How will the proposed scope cover LL-2026-04 disclosures about the purpose, manner of use, and safeguards of AI/ML?

Will a partner manage the work, and what is the policy on continuity across audit cycles? Can the timeline accommodate the 90-day post-fiscal-year-end submission deadline for HUD borrowers and the GSE ongoing monitoring cycle? Firms that answer confidently with named practitioners, documented methodologies, and active regulatory credentials are worth shortlisting, regardless of size or brand recognition.