We completed an audit of U.S. Department of Housing and Urban Development (HUD) Single Family Program Development Office’s automated underwriting process. We assessed whether HUD had in place appropriate and effective management controls over its automated underwriting process. The audit was performed as part of the HUD Office of Inspector General’s (OIG) fiscal year 2010 annual audit plan and supported the audit plan objective to contribute to improving the integrity of the single-family insurance program.

HUD’s Program Office did not have appropriate and effective management controls in place over the automated underwriting process. Specifically, it implemented changes to the Federal Housing Administration (FHA) Technology Open to Approved Lenders Scorecard’s (Scorecard) review rules without properly assessing the associated risk and?
appropriately documenting the changes. As a result, loans valued at more than $6.1 billion were automatically approved for FHA insurance despite having debt ratios that exceeded established thresholds for automated underwriting. Without evaluating the risks associated with the higher ratios allowed by the automated underwriting system, HUD cannot provide assurance regarding whether these loans had conditions that might have posed an increased risk of losses to the FHA Mutual Mortgage Insurance Fund. In addition, the Program Office did not perform adequate monitoring of its automated underwriting process, including the use of authority to override automatic referrals for manual underwriting.

We recommend that the Deputy Assistant Secretary for Single Family Housing develop or expand, as applicable, and implement written policies and procedures for (1) assessing the risk of proposed changes to the Scorecard’s algorithm and review rules; (2) formally supporting, authorizing, and updating corresponding system documents for changes made to the automated underwriting process; and (3) continuous monitoring of the automated underwriting process through the normal course of business including the use of authority to override automatic referrals and, as applicable, periodic reviews, reconciliations, or comparisons of the automated underwriting processed data. Additionally, we recommend that the Program Office conduct a risk analysis to determine the appropriate front-end and back-end ratios for the Scorecard’s review rules and institute the appropriate changes.

The OIG has determined that the full contents of this report would not be appropriate for public disclosure and is releasing this redacted version to the public.