EFIDB.

9191/303

~ FannieMae.
Internal Audit Report

Portfolio Pooling

December 19, 2008

EXHIBIT

I
Internal Audit R49 2007

#1
Confidential - Restricted

+7

EF 10 B, 9 192/303

Objectives
To assess the adequacy and effectiveness of controls over portfolio pooling

Scope

We reviewed controls over the following;

We excluded the following, as they are covered in
other audits:
o Governance and oversight
o Trade designations (FAS 65)
0
MBS disclosures
0
MBS Pool Production edits
o Pool simulation & execution
o Trade entry for newly formed pools
0
PPAs on issued pools
o Post-purchase adjustments (PPA)
0
Buy-Up/Buy-Down price calculation
o Accounting for portfolio loan securitization
o Applications and EUCs
Period covered was April 2008 - September 2008, beginning after the new pooling system was implemented

Conclusion

ICQntrol~ Require Improvement

The legacy pooling system was replaced in April 2008 by the Collateral Management and Hedging (CMH)
application. CMH resolved several prior limitations and provided greater flexibility to manage the whole loan
portfolio. While CMH provided functionality to designate new loans for pooling in a future period, there is still $137
billion of loans that were in inventory prior to implementation that cannot be pooled. In addition, CMH does not
currently have the functionality needed to pool approximately $171 billion of multifamily, adjustable rate, and
reverse mortgages. The aforementioned system limitations prevent Fannie Mae from fully leveraging whole loan
assets for liquidity, revenue, or to manage the size and composition of the portfolio.
System weaknesses were also noted with the three primary pooling applications including inadequate segregation
of duties, excessive user access, and a lack of monitoring.
Deficiencies with reconciliations and documentation were also identified. The following pages summarize control
weaknesses noted during our review.

Portfolio Pooling - 12/19/2008

Confidential - Restricted

EF 10 B. 9 193/303

Portfolio pooling securitizes loans from the

portfolio into Mortgage-Backed Securities.
Pooling volumes peaked in Q2 due to
increased functionality, favorable market
conditions, and lender anticipation of a
pricing adjustment. They leveled off in Q3,
with a notable increase in September
correlated to a large deal and efforts to
infuse the market with liquidity (see below).
Portfolio pooling is important because it is
used to manage the portfolio, provide
liquidity, and generate income while
continuing to fulfill the mission of providing
housing
finance
liquidity through
the
purchase of loans from lenders.

Whole Loan Inventory after Stock Project

(Millions as of 10/31/2008)
Reverse, $39,051, 11%l
Non-Fixed, $21,15:, 6"hl

.<'

SOP-03-3, $3,341, 1 '"~ ... \

Held Over Month End,
/.': .
$293, 0%
- , ."

Ineligible, $52,982, 15%

SF Poolable. 5137,471,

Portfolio Pooling Volumes

by Settlement Month

:;
~

;;:
::>

$5.0
$4.5
$4.0
$3.5
$3.0
$2.5
$2.0
$1.5
$1.0
$0.5
$-

37%
Source: Capilal Markets Business Initiatives

180
160
140
I!B:v"~+ 120
100
80
60
40

20
I .. I .. 1'1 - I - I '" I M 1 M 1 111 1 1M 'rM! 1 8 I ... ~
Ocl- Nov- Dec- Jan- Fell- Ivllr Apr- May- .l,m- .lJ1- Aug- Sep- Ocl07 07 07 08 08 08 08 08 08 08 08 08 08

IiiliiiiI Unpaid Principal Balance (UPB) - - Number of Pools I

~
:;;
;;

.0

:z

CMH, implemented in April 2008, provides better

information and greater flexibility to effectively
manage the mortgage loan collateral inventory
and to pool eligible loans for MBS securitization.
Functionality was expanded in 2008 to include
jumbo loans, balloon loans, and some high
balance loans.
Further enhancements are
scheduled for Q1
2009 that will provide
functionality to pool $137 billion of SF loans in
inventory ["Stock"). However, functionality has not
been implemented to pool approximately $171
billion of loans consisting primarily of MF whole
loans, reverse mortgages and adjustable-rate
mortgages (see above).

Source: Capitol M::Hkets lv'or1gage Asset Trading

Porttollo Pooling - 12/19/2008

Confidential - Restricted

EF ID B. 9 194/303

Issue

1.

Observation

Responsibility

Implementation
Timing

CMH only provides functionality to poolli.x~d-rote slngle-fqmlly loans, limiting management's abBity to pool other loan
products for liquidity or tor management at th~ size and composition of the whole loan portfolio.

While the implementation of CMH

corrected many lImitations, It does not
have the functionality to pool eligible
loans in inventory prior to
implementation ("stock" J nor to pool
non-single family fixed-rate products.
There were approximately $308 billion
of eligible assets in the portfolio as of
Oclober 31. 2008, that could not be
pooled. Without this funclionality, these
assets cannot be used for liquidity
purposes or to capitalize on favorable
market opportunities.

2.

Management Corrective Actions

Development efforts are currently underway,

management will complete implementatlon of
system functionality to pool eligible fixed-rate
stock loans.

Ramon
Decastro

March 31. 2009

Management will use the Strategic Initiative

Benefit Assessment (SIBA) template to submit a
business case to expand product eligibility for
multifamily, ARM, and reverse mortgages.

Ramon
Decastro

April 1, 2009

Excesslye functlongllty

Porttollo Pooling - 12/1 9/2008

HIGH

Plans to expand product eligibility to include

ARMS are already monitored as an FHFA open
deficiencv.

System controls are no! adequote to ensure se~regatlon of duties and appropriate user access.

There are no controls that prevent the

use of certain off-the-shelf CMH
functionality that should not be used.
Prohibited functions were not
deactivated through customizations,
rather management documented user
instructions that mandate restrictions on
these functions. One function. the reuse of temporary pool numbers, was
used and resulted in the omission of a
pool from the accounting system.
Without preventive or detective
controls there may be incomplete or
erroneous data in the pooling and
downstream applications.

Priority

Management reviewed all prohibited functions,

determined risk, and appropriately identified
mitigating controls for all but one prohibited
function, the re-use of temporary pool numbers.
The vendor, CMH, has provided a fix which is
currently being tested and will then be
implemented.

Confidential - Restricted

Don Palumbo

MEDIUM
January 9. 2009

EF 10 B. 9 195/303

Issue / Observation
2,

System controls are not adequate

Management Corrective Actions

tqensur~ segrel:lCJtlon

Excessive user access

.\..f,i~, .

'l!~>r~~,)'\'
. ;.ir~".l.;t,.
i
;' f

l, "~

.'., '.,:f

Assigned roles in CMH grant excessive

user access, One-third of users are
System Administrators, four have an
undocumented role, and two business
support personnel have Super Trader
access. Unauthorized changes could
occur if privileges are inconsistent with
business responsibilities,
19ck of secreaatlon of duties
Production support for CMH-LA (the
accounting application) is performed
by a single development team
member. This results in key person
dependency and a lack of segregation
between development and
production.
Uomonl!gred user gctlvlty
Activity in the FAS65 production
database is logged but not monitored
by the Central Monitoring team ICMT).
FAS 65 is a financial reporting
application that provides trade
designations. Unauthorized changes to
production data may not be detected
if activity is not monitored.
Unrevlewed user access
An access review for CMH-LA, a
financial reporting application, was not
conducted for 02 and 03 2008.
Unauthorized changes could occur if
users have Inappropriate access.

Portfolio Pooling - 12/19/2008

Responsibility

Implementation
TIming

MEDIUM

of duties and appropriate uSer access (continued).

All roles will be documented in the roles matrix

and user manual, business and suppori roles will
be segregated, and System Administrator access
will be limited based on business need.

Don Palumbo

February 27, 2009

The developer wiU train and fully transition

production support to the Structured Transaction
Technology production support team.

Monte Shapiro

January 31, 2009

Management will establish monitoring

requirements and enable monitoring by the
CMT.

Monte Shapiro

The business application owner wiU perform

quarterly user access reviews.

Don Palumbo

The technology application owner will perform

quarterly user access reviews.

Monte Shapiro

Confidential - Restricted

Priority

SOX
ILOW)

January 31,2009

SOX
(LOW)

January 31, 2009

SOX
(LOW)

January 31, 2009

EF 10 B. 9 196/303

Issue / Observation

3.

Management Corrective Actions

Responsibility

Implementation
Timing

Pooling reconciliations are not executed timely or documented consistently, Increasing the risk that Intended actions are not
qccurately capt!JJeq III dqwnstream systems.

Inconsistent documentation
The reconciliation between the pooling
application and the trader's record of
pooled loans is not executed and
documented consistently. There were
multiple versions of one reconciliation
and uninvestigated discrepancies. If
discrepancies are not resolved prior to
the intended pooling date, the pool
may not be formed resulting in lost
revenue. Loans will however, remain
eligible for pooling at a sUbsequent
date. Reconciliations were also saved
on local hard drives increasing the risk
of data loss if files are not backed up.
UntimelY reconciliation
The reconciliation between the trader's
intended designation enlered in CMH
and the finallrode designation in the
FAS65 system occurs 22 days after
monlh-end. While the accounting
treatment will accurately reflect lhe
designalion in lhe system of record
(FAS65), it may not refleel the trader's
intent to retain loans based on a review
of lhe underlying economics.

Portfolio Pooling - 12/1 't /2008

Management will maintain evidence of the

reconciliations and discrepancy resolution on a
centralized SherePoint site.

Laura Simmons

April 1, 2009

An automated e-mail message will be sent with

high priority to Technology Production Support to
address re-designotion interface failures

Don Palumbo

March 31. 2009

Confidential - Restricted

Priority
lOW

EFIDB.9197/303

Issue / Observation
4.

Prlc:ln~

c:lotq Is not looded timely, potentlqlly

There is no control to ensure that the

most current buy up/buy down pricing
grid is loaded into the pooling
application. The appropriate grid was
not in the system archive for two of the
three months reviewed. Best execution
will not be achieved if pricing grids are
not loaded timely and there is a
material move in the markeL It is likely
however, that material anomalies
would be identified by the trader.

5.

Management Corrective Actions

Impoctln~

Responsibility

Implementation
Timing

LOW

PQoHn'! decisions.

Management will independently verify the

manual upload of the monthly pricing grid.

Steve Shen

January 12,2009

Certqllll?9rtlQI19 P9()III'l~q()~Umlilnt9tJ0I1IS,JIl5\-1mElen!, r~~~ltJl'lg In thl!! pqtentlql !qr Inconsl~ent cqntrol ~rfon"qnce.

IDcom plet\:! procedures

Complete trade reposition and update PFP

Middle Office procedures in compliance with
the corporate framework.

Laura Simmons

April 1, 2009

Complete monitoring unpooled, unpaid

principal balance and update PFP Pool
Simulation & Closed Pool Submission procedures
in compliance with the corporate framework
and to reftect the ability to hold over month end.

Steve Shen

April 1, 2009

Also, three procedures are not fully

compliant with the corporate
framework.

Complete the Single Family Operations PFP CMH

LA JE Reconciliation procedure in compliance
with the coroorate procedure framework.

Terri Messina

April 1, 2009

Incompl\:!te doclJm\:!ntgtion trail

Management will enhance procedures and

comply with new evidence and retention
reqUirements outlined.

Don Palumbo

April 1,2009

Procedures are not documented for:

0

Trode repositions,

Monitoring unpooled, unpaid

principal balances, and

The ability to hold held-for-sale

loans over month end.

There is unclear and inconsistent

documentation retained to support the
linkage between Post Purchase
Adjustment (PPA) identification,
analysis, and resolution. Erroneous
pooling decisions could occur if a
relevont PPA is nof resolved in CMH.

Porttollo Pooling - 12/1 9/2008

Confidential - Restricted

Priority

LOW

EF 10 B. 9 198/303

Addressees
Ramon Decastro, Senior Vice President, Capital Markets Mortgage Trading

Audit Director
Leah Malcolm Skrine

li,!

\1\tJ(~~
~i,,;

~ r'.,,'.iJ
''''~~I~

~; "~,:
r, ()'.; 'C;.;" ,

It ';"""' ..

,: (if 't.~ ,tj

Distribution
Herb Allison
David Benson
Gary Friend
David M. Johnson
Linda Knight
Curtis Lu
Theresa Messina
Don Palumbo
Bill Senhauser
Monte Shapiro
Michael Shaw
Steve Shen

Laura Simmons
Jacquie Wagner
Mike Williams
Deloitte & Touche
FHFA

Internal Audit Team

Anandhi Ananthanarayanan
Aliso Davis
David Fourney
Mary Ann Gebhard
Mike Li
Peter stoyas
Mythili Vandara
Nicole Wade

Portfolio Pooling - 12/19/2008

Confidential - Restricted