Business Insights

Internal Audits: Why Every Lender Needs Safeties and Cornerbacks

Mortgage companies respond to myriad audits throughout the year, including internal and external audits, and many find it hard to decipher among them. Most don’t know what an internal audit is or why they even need one. 

So what is an internal audit, anyway? Audits are common industry practice. But internal audits serve a special function that gives senior management comprehensive assurance of the effectiveness of internal controls based on the highest level of objective review.  

While internal audits seem complicated, think of them as a line of defense for your mortgage operation. Just as a football team needs a third line of defense to protect the team, a mortgage company needs a third line of defense to protect the business. Here’s what a coordinated defense strategy looks like in the mortgage lending world: 

• The first line manages day-to-day operations. Like defensive linemen, unit managers uphold quality and maintain effective controls, helping “players” execute against them.  
• The second line oversees risk. They’re the linebackers who look for risks and monitor department functions, typically the job of the compliance department or QC function. 

• The third line provides the internal audit function. Like safeties and cornerbacks, they have the widest field of view, so they’re in the best position to provide objective assurance of the effectiveness of internal controls. 

Because they’re focused on day-to-day operations, that wide lens is something key players in your organization may not have. The goal of an internal audit, similar to the goal of a safety, is to see what’s coming down the line in terms of regulations or changes in the environment and protect your operation.    

Who needs an internal audit? Everyone needs an internal audit to protect themselves and grow their business with a healthy risk appetite. Risk has a place in every mortgage company. Without it, you can’t grow or move forward, so you never want to eliminate it entirely. But every mortgage firm has a unique risk appetite, and an internal audit can help minimize risk, so it meets your risk appetite and enables you to run a successful business. 

Any lender licensed to originate Fannie Mae loans is required to have an internal audit. Unfortunately, many firms don’t know they need one until they get hit with a finding from Fannie Mae. Richey May recommends all lenders, big and small, make an internal audit function a strategic priority — especially if you want to gain (or maintain) Fannie Mae approval status. 

What’s the role of risk in an internal audit? An internal audit provides an unbiased source of independent advice and the assurance that your company is meeting and adhering to regulatory requirements and demonstrating good faith business practices. “And it just helps you sleep better at night,” said Richey May Internal Audit Manager Mignonne Davis on The Chrisman Commentary. 

What does an internal audit process look like? A good internal audit is tailored to your organization’s unique characteristics and perspectives – everything from your documentation to your culture. In a mortgage operation, your culture often dictates how you provide your service. The audit should factor that in, along with any risks you may face and how to guard against them. 

Many competitors have a standard program that lenders either pass or fail. No accounting for cultural or departmental real-life interactions. No negotiation. No collaboration. The best internal audits promote communication and collaboration and follow a risk-forward approach that features these steps: 

1. Build a risk and control matrix based on a thorough risk assessment that includes a review of documents, policies and procedures. 

2. Conduct reviews with department heads to document business functions in the real world, not just on paper.  

3. Apply risk ratings to functional areas using insights gleaned from those reviews, like how often clients audit specific areas. 

4. Collaborate with clients to learn their perspective on risk factors. 

5. Collaborate on an internal audit plan, taking all the unique aspects of the operation into account. 

6. Conduct the audit, a transparent process that involves working very closely with clients.  

Richey May has a process for reviewing findings with clients prior to issuing the audit report to make sure all factors are taken into consideration and any items needing extra attention can be addressed prior to publishing the findings. Based on the findings, Richey May will work with the client to develop an audit plan that minimizes risk and enables the operation to accomplish its goals in an ever-changing environment.   

What can you start doing today to prepare for an internal audit? First, decide if you have the resources internally to develop the internal audit function or if you need to outsource it. Then identify your lines of defense. If you haven’t documented your policies and procedures yet, start now. Then gather all that information into one central location and review it.  

“If you can gather all that information together, we can help with the rest,” says Davis. “Working with clients I’ve found that the consultative insight we’re able to provide really helps them and is where the game is won or lost.” 

Learn more about Richey May’s internal audits or speak to one of our experts today.