FHFA’s Targeted Examinations 

of Fannie Mae:

Less than Half of the Targeted 

Examinations Planned for 

2012 through 2015 Were Completed and 

No Examinations Planned for 2015 

Were Completed Before the Report of 

Examination Issued

Audit Report  AUD-2016-006  September 30, 2016

Federal Housing Finance Agency 

Office of Inspector General
AUD-2016-006

September 30, 

2016

Executive Summary 

The Federal Housing Finance Agency (FHFA or the Agency) is responsible for, 

among other things, ensuring that the Federal National Mortgage Association 

(Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac) 

(together, the Enterprises) operate in a safe and sound manner. Within FHFA, 

the Division of Enterprise Regulation (DER) is responsible for the supervision 

of the Enterprises. Led by an Examiner-in-Charge (EIC), a core team of DER 

examiners is assigned to conduct supervisory activities for each Enterprise. 

Like other federal financial regulators, FHFA maintains that it uses a risk-based 

approach to carry out its supervisory activities. Based on the analysis in its risk 

assessments, DER is to prepare an annual supervisory strategy followed by a 

supervisory plan that schedules the specific supervisory activities it intends to 

conduct during the year. Those supervisory activities include targeted examinations 

and ongoing monitoring. According to FHFA, targeted examinations enable 

examiners to conduct a deep or comprehensive assessment of selected areas of 

high importance or risk, while the purpose of ongoing monitoring is to analyze 

real-time information and to use those analyses to identify Enterprise practices 

and changes in an Enterprise’s risk profile that may warrant supervisory 

attention. DER is to summarize its examination results in an annual report of 

examination (ROE) issued to the relevant Enterprise’s board of directors. The 

purpose of an ROE is to clearly communicate what FHFA found and its 

supervisory concerns for board action. 

FHFA Office of Inspector General’s (OIG) February 2016 Audit and Evaluation 

Plan identified FHFA’s supervision of its regulated entities as a significant risk 

area. Earlier this year, we assessed the process used by DER to develop its risk 

assessments and recommended a number of measures to improve the 

preparation of these risk assessments. Building on that work, we conducted this 

audit to determine whether DER (1) supported its 2014 and 2015 high-priority 

planned targeted examinations identified in its annual supervisory plans with 

risk assessments and completed those planned high-priority examinations; (2) 

performed its planned targeted examinations for Fannie Mae from 2012 through 

2015 and, if it did not, whether FHFA documented the deviations from its plan 

in accordance with policies and procedures; and (3) performed its planned 

targeted examinations for Freddie Mac from 2012 through 2015 and, if it did 

not, whether FHFA documented the deviations from its plan in accordance with 

policies and procedures. We are issuing three reports from this audit today. 

The first report, FHFA’s Supervisory Planning Process for the Enterprises: 

Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted 

Examinations Did Not Trace to Risk Assessments and Most High-Priority 

Planned Examinations Were Not Completed (September 30, 2016) (AUD-2016-
AUD-2016-006

September 30, 

2016

005), analyzes whether the high-priority planned targeted examinations 

identified by DER in its annual supervisory plans for 2014 and 2015 for each 

Enterprise were supported by risk assessments and whether those planned highpriority targeted examinations were completed. 

This report, the second of three, analyzes whether DER examiners performed 

the planned targeted examinations for Fannie Mae from 2012 through 2015 and, 

in those instances where the planned targeted examinations were not completed, 

whether DER documented the deviations from its plan in accordance with 

policies and procedures. The third report, FHFA’s Targeted Examinations of 

Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 

through 2015 Were Completed (September 30, 2016) (AUD-2016-007), 

undertakes the same assessment for DER’s targeted examinations for Freddie 

Mac. 

Our audit found that DER planned 102 targeted examinations for Fannie Mae 

from 2012 through 2015. Of these 102, we found that 43 were completed. 

Based on our review of the documents provided to us by DER, we determined 

that of the remaining 59 planned targeted examinations: 19 were cancelled, 

9 were deferred, 14 were converted to ongoing monitoring, 7 were commenced 

but were not completed, and 10 lacked documentation as to their disposition, as 

of the end of our fieldwork on June 17, 2016. Overall, we found that both the 

number and percent of completed targeted examinations that were identified in 

the annual supervisory plans decreased significantly during this four-year 

period. 

According to FHFA, examination results, conclusions, findings, and 

supervisory concerns from the supervisory activities completed during the 

annual supervisory cycle are summarized in a ROE, which is issued to the 

relevant Enterprise’s board of directors. Because targeted examinations involve 

a “deep or comprehensive assessment” of areas deemed by DER to be of the 

highest importance or risk to the Enterprise, each ROE is intended to clearly 

and concisely summarize the targeted examination activities and findings 

during the annual supervisory cycle, report the results of ongoing monitoring, 

and discuss deficient practices and excessive risks giving rise to supervisory 

concerns. For Enterprise directors to carry out their oversight responsibilities 

under FHFA’s regulations and guidance, they must be made aware of the 

overall condition and risk profile of the Enterprise from the examination results 

and findings during the annual supervisory cycle. 

For the 2014 supervisory cycle, DER planned 53 targeted examinations. Of 

these 53 planned targeted examinations, DER completed only 8 before the ROE 

for that supervisory cycle issued. As a consequence, the ROE issued for the 
AUD-2016-006

September 30, 

2016

2014 supervisory cycle was based on only 15 percent of the 53 targeted 

examinations planned for that cycle. 

For the 2015 supervisory cycle, DER’s performance was more dismal. For this 

cycle, DER planned 11 targeted examinations, but completed none before the 

2015 ROE issued on March 23, 2016. As a consequence, the 2015 ROE was 

based on zero percent of the 11 targeted examinations planned for that cycle. 

The only targeted examinations for which findings were reported in the 2015 

ROE were 3 examinations planned for the 2014 supervisory cycle and 

completed in the 2015 supervisory cycle.

As of the end of our fieldwork on June 17, 2016, DER examiners continued 

work on 4 targeted examinations planned for the 2014 supervisory cycle, all 

commenced in 2014, and on 3 targeted examinations planned for the 2015 

supervisory cycle, commenced in 2015. At the earliest, the findings for these 7 

targeted examinations, planned for 2014 and 2015, will first be included in the 

2016 ROE to be issued in March 2017. 

Effective January 1, 2014, DER requires that changes to supervisory plans 

must be risk-related, approved by the EIC, and documented. Of the 64 targeted 

examinations that were planned for 2014 and 2015, DER documentation 

showed that 33 were not conducted as of June 17, 2016, and DER provided no 

documentation to show the disposition of 7. While DER’s documentation for 

the 33 reported the change in status for each of them, it only included riskrelated reasons for changing 11 of the 33. When the 7 planned targeted 

examinations for which DER provided no documentation to explain the 

change in status are added to the 22 for which no risk-related basis was 

provided for a change in status, a total of 29 planned targeted examinations 

out of 40 (73 percent) lacked a documented risk-related basis for a change, in 

contravention of DER requirements. 

In past evaluation reports, we found that DER (as well as FHFA’s Division of 

Bank Regulation) lacked a sufficient number of examiners and that FHFA 

lacked an adequate number of commissioned examiners. In response to our 

prior reports, FHFA committed to add, and has added, examiners. This audit 

shows that DER failed to conduct and complete more than half of the planned 

targeted examinations for the past four supervisory cycles for Fannie Mae. The 

reason repeatedly provided by DER examiners and the then-current EIC for this 

failure was resource constraints, notwithstanding the consistent position of DER 

leadership, and recently reiterated by FHFA senior leadership, that DER has 

an adequate complement of examiners. For a federal financial regulator, 

responsible for supervising two Enterprises that together own or guarantee 

more than $5 trillion in mortgage assets and operate in conservatorship, to fail 

to complete a substantial number of planned targeted examinations, including 
AUD-2016-006

September 30, 

2016

failure to complete any of its 2015 planned targeted examinations for Fannie 

Mae within the 2015 supervisory cycle, is an unsound supervisory practice and 

strategy. 

Our audit work was hampered by the lack of DER’s supervisory documentation, 

maintained in its official system of record. In our judgment, the lack of such 

documentation creates a significant risk exposure. This significant risk 

exposure, coupled with the other deficiencies identified in this audit, threatens 

FHFA’s ability to fulfill its statutory mission to ensure that the Enterprises 

operate in a safe and sound manner. 

We make five recommendations to address the findings identified in this report. 

In its written comments to our draft report, FHFA agreed with one 

recommendation, stated that it issued internal guidance in May 2016 that it 

believes confirmed its general agreement with two other recommendations, 

partially agreed with one recommendation, and disagreed with one 

recommendation. FHFA management’s comments and our response are 

provided in the body of this report. 

Key contributors to this report were Robert Taylor, Assistant Inspector General 

for Audits; Tara Lewis, Director; Pamela L. Williams, Auditor; Terese 

Blanchard, Senior Auditor; and Anya Philbert, Senior Auditor. We appreciate 

the cooperation of FHFA staff, as well as the assistance of all those who 

contributed to the preparation of this report. 

This report has been distributed to Congress, the Office of Management and 

Budget, and others and will be posted on our website, www.fhfaoig.gov. 

/s/ 

Marla A. Freedman 

Deputy Inspector General for Audits 
OIG  AUD-2016-006  September 30, 2016 6

TABLE OF CONTENTS.........................................................................

EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................8

BACKGROUND .............................................................................................................................9

Effective Supervision by FHFA Is Vital to Ensure Fannie Mae’s Safety and 

Soundness .................................................................................................................................9

FACTS AND ANALYSIS .............................................................................................................12

Analysis of FHFA’s Fannie Mae Planned Targeted Examinations for 2012 through 

2015 ........................................................................................................................................12

Methodology ...................................................................................................................12

Analysis ..........................................................................................................................14

Changes to Supervisory Activities and Plans Were Not Always Documented, and 

When Changes Were Documented, the Reasons Provided Were Largely Not RiskRelated ....................................................................................................................................19

FINDINGS .....................................................................................................................................22

1. DER completed less than half of its 2012 through 2015 planned targeted 

examinations and did not complete many of its planned targeted examinations for 

each supervisory cycle prior to the issuance of the respective cycle’s ROE. .........................22

Less than half of planned targeted examinations for the period 2012-2015 were 

completed. ...............................................................................................................22

The usefulness of ROEs is diminished when planned targeted examinations for 

a supervisory cycle are not completed until after the ROEs issue. .........................22

2. The number of planned targeted examinations that were completed has dropped 

significantly since 2012, and no planned targeted examinations for the 2015 

supervisory cycle were completed within that supervisory cycle. .........................................23

3. DER’s official system of record for its supervisory activities for Fannie Mae is 

not complete and could not be relied upon, and DER lacked documentation to 

account for all of its supervisory activities. ............................................................................23

4. DER examiners did not always document changes to supervisory plans and, 

when changes were documented, the reasons provided were largely not risk related, 

in contravention of DER requirements. ..................................................................................24
OIG  AUD-2016-006  September 30, 2016 7

CONCLUSION ..............................................................................................................................25

Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records ...............25

RECOMMENDATIONS ...............................................................................................................27

FHFA COMMENTS AND OIG RESPONSE.................................... ...............................29

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................35

APPENDIX A ................................................................................................................................37

FHFA’s Comments on OIG’s Findings and Recommendations ............................................37

ADDITIONAL INFORMATION AND COPIES .........................................................................42
OIG  AUD-2016-006  September 30, 2016 8

ABBREVIATIONS ....................................................................... 

DER Division of Enterprise Regulation 

EIC Examiner-in-Charge 

Enterprises Fannie Mae and Freddie Mac 

Fannie Mae Federal National Mortgage Association 

FHFA or Agency Federal Housing Finance Agency 

Freddie Mac Federal Home Loan Mortgage Corporation 

IMS Information Management System 

MRA Matter Requiring Attention 

OESO Office of Enterprise Supervision Operations 

OIG Federal Housing Finance Agency Office of Inspector General 

OPB Operating Procedures Bulletin 

ROE Report of Examination 
OIG  AUD-2016-006  September 30, 2016 9

BACKGROUND..............................................................................

Effective Supervision by FHFA Is Vital to Ensure Fannie Mae’s Safety and Soundness

FHFA, created by Congress in 2008, is charged by the Housing and Economic Recovery Act 

of 2008 with, among other things, the supervision of the Enterprises and the Federal Home 

Loan Banks. Its mission as a federal financial regulator includes ensuring the safety and 

soundness of its regulated entities so that they serve as a reliable source of liquidity and 

funding for housing finance and community investment. FHFA maintains that it uses a riskbased approach to plan and execute its supervisory activities. Supervision by risk requires a 

comprehensive, risk-focused view of each regulated entity so that supervisory activities can 

be tailored to the risks with the highest supervisory concerns. 

FHFA’s DER is responsible for supervision of the Enterprises. Pursuant to DER’s Operating 

Procedures Bulletin (OPB), Supervisory Planning Process (2013-DER-OPB-03.1), effective 

January 1, 2014, the Deputy Director of DER is responsible for developing a supervisory 

framework for the Enterprises and ensuring that the supervisory planning is documented and 

incorporated into official agency records. Implementation of that supervisory plan is the 

responsibility of each EIC who is assigned to lead a core team of examiners for each 

Enterprise. 

According to FHFA’s Examination Manual, risk assessments provide the foundation for 

DER’s annual supervisory strategy for each Enterprise. These semiannual risk assessments 

should be revised based upon an updated view of risk developed through supervisory 

activities. Using the risk assessments, a supervisory strategy is prepared for each Enterprise 

by the DER core teams.1 Once the annual supervisory strategy is approved, the strategy is 

implemented through an annual supervisory plan, prepared by the EIC for each Enterprise and 

approved by the Deputy Director of DER. 

The annual supervisory plan for each Enterprise sets forth the objectives for carrying out the 

supervisory strategy and identifies the supervisory activities, both targeted examinations and 

ongoing monitoring, for the year. FHFA expects that DER’s supervisory activities will be 

prioritized based on the risk that a specific practice poses to the Enterprises’ safe and sound 

operations or to their compliance with applicable laws and regulations. FHFA guidance 

contemplates that the risk assessments prepared for each Enterprise will identify those areas 

of high importance or risk. 

 

1

 FHFA expects EICs to periodically review each supervisory strategy and update it to reflect any changes in 

supervisory objectives, the Enterprise’s financial condition, and/or trends in risk exposures. Any risk-based 

changes to the supervisory strategy must be approved by the Deputy Director of DER. 
OIG  AUD-2016-006  September 30, 2016 10

Using that identification, each annual supervisory plan sets forth the planned supervisory 

activities for the year, consisting of ongoing monitoring and targeted examinations. According 

to FHFA, ongoing monitoring and targeted examinations serve complementary purposes. The 

purpose of ongoing monitoring is to analyze real-time information and to use those analyses 

to identify Enterprise practices and changes in an Enterprise’s risk profile that may warrant 

supervisory attention. Ongoing monitoring is also “used to determine the status of the 

Enterprise’s compliance with supervisory guidance, MRAs [Matters Requiring Attention], 

and conservatorship directives[.]” Targeted examinations complement ongoing monitoring: 

they enable examiners to conduct “a deep or comprehensive assessment” of the areas found to 

be of high importance or risk. Because each of these supervisory activities has a separate 

purpose, they are not interchangeable. 

DER examiners may identify supervisory concerns or deficiencies occurring at an Enterprise 

as a result of targeted examinations or ongoing monitoring. According to FHFA, only the 

most serious supervisory deficiencies are categorized as MRAs.2 Most of the MRAs issued by 

DER have issued out of targeted examinations. FHFA guidance also contemplates that special 

“ad hoc” supervisory activities may be initiated throughout the year as a product of ongoing 

monitoring. As these supervisory activities are not planned, they are not added to the annual 

supervisory plan. 

Because supervisory planning is a continuous process, FHFA expects that each EIC will 

adjust the applicable supervisory plan to add newly emerging risks that require attention 

during the current supervisory cycle. Beginning in 2014, DER guidance instructs that 

approved supervisory plans shall only be adjusted for risk-based reasons and justifications for 

the adjustments must be approved by the EIC (after consultation with the Deputy Director of 

DER, as warranted) and fully documented in the work papers. Adjustments include adding or 

deleting supervisory activities, or changing the objective, scope, and methodology of a 

supervisory activity. 

According to FHFA guidance, examination results, conclusions, findings, and supervisory 

concerns from the supervisory activities completed during the annual supervisory cycle are 

summarized in a ROE, which is issued to the relevant Enterprise’s board of directors. Each 

ROE is intended to clearly and concisely convey the overall condition and risk profile of the 

 

2

 According to FHFA, MRAs are the most serious supervisory matters and they include, among other things, 

such matters as non-compliance with laws or regulations that result or may result in significant risk of financial 

loss or damage to the regulated entity; repeat deficiencies that have escalated due to insufficient action or 

attention; unsafe or unsound practices; and matters that have resulted, or are likely to result, in a regulated 

entity being in an unsafe or unsound condition. MRAs also include breakdowns in risk management, 

significant control weaknesses, or inappropriate risk-taking. 
OIG  AUD-2016-006  September 30, 2016 11

Enterprise, summarize examination activities and findings during the annual supervisory 

cycle, and discuss deficient practices and excessive risks giving rise to supervisory concerns.3

 

3

 For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing 

ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify 

Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the 

Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns 

(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG, 

FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain 

Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those 

Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).
OIG  AUD-2016-006  September 30, 2016 12

FACTS AND ANALYSIS ..................................................................

Analysis of FHFA’s Fannie Mae Planned Targeted Examinations for 2012 through 2015 

Methodology 

Because targeted examinations constitute a critical component of FHFA’s supervisory 

activities, we examined, as part of this audit, whether DER examiners conducted and 

completed the targeted examinations identified in each supervisory plan for Fannie Mae 

from 2012 through 2015, the review period for this audit. For the last two years of the review 

period, 2014 and 2015, the two annual supervisory cycles when DER required that any 

changes to the supervisory plans be risk-related, approved by the EIC, and documented, we 

sought to determine whether DER examiners complied with these requirements when a 

planned targeted examination was either (1) not conducted because it was converted to 

ongoing monitoring, cancelled, or deferred, (2) commenced but not completed, or 

(3) documentation was not provided for us to determine its disposition. 

For purposes of this audit, we considered a targeted examination to be “commenced” when 

DER issued a request letter.4 We considered a targeted examination to be “completed” when 

DER issued a conclusion letter to Fannie Mae.5 We considered a targeted examination to be 

“not conducted” when DER documents demonstrated that the status of that examination was 

changed to ongoing monitoring, cancelled, or deferred. We considered a targeted examination 

to be “commenced but not completed” based on DER’s representation that the examination 

was in progress in one of three phases: fieldwork, management review, or quality review, 

absent any other conflicting documentation provided or discovered during our review of DER 

documentation. We considered a targeted examination to be “disposition not documented” 

when DER did not provide any documentation regarding the disposition of the targeted 

examination in response to our requests. 

To perform our audit, we developed a list of Fannie Mae targeted examinations planned by 

DER for the review period from annual supervisory plans and other information that was 

gathered by our Office of Evaluations in support of another assignment6and supplemented 

 

4

 DER, Operating Procedures Bulletin, DER Supervisory Activities (Sept. 19, 2013) (2013-DER-OPB-04). 

5

 Once the fieldwork for a targeted examination has been completed and the examination team develops its 

findings, the EIC communicates those findings to the affected Enterprise through issuance of a conclusion 

letter. 

6

See OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear 

Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at 

www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).
OIG  AUD-2016-006  September 30, 2016 13

that information with records from FHFA’s Information Management System (IMS), DER’s 

official system of record. We then sought to track whether each planned targeted examination 

was commenced and later completed. In some instances, IMS did not contain sufficient 

information to permit us to complete the tracking exercise. We also found evidence that some 

targeted examinations were completed but had not been identified on the annual supervisory 

plan. 

We asked DER’s Office of Enterprise Supervision Operations (OESO)7

to confirm whether 

(1) the universe of planned targeted examinations for the review period that we had identified 

was complete, (2) the information we obtained about the commencement and completion of 

each planned targeted examination was complete and accurate, and (3) to explain the reasons 

why specific targeted examinations were conducted and completed but were not on any 

supervisory plan. OESO responded that it could not provide such a confirmation because 

there had been a significant shift in DER’s senior management and managers, and DER had 

“significantly refined” its records management processes since then. 

Because we were not able to track the status of all planned targeted examinations from the 

documentation either in IMS or provided to us by DER, we asked the then-current EIC for the 

Fannie Mae core team for his recollection of the disposition of planned examinations that we 

were unable to track. For example, we asked him about the status of four planned targeted 

examinations for which there was no documentation provided by DER and he reported that all 

had been cancelled. When we sought documentation from him to support his recollection, he 

explained to us that the Fannie Mae core team of examiners tracked targeted examinations in 

SharePoint – which is not the official system of record. To test the accuracy of the tracking 

information in SharePoint, we reviewed the SharePoint entries for each of these four planned 

targeted examinations. SharePoint reported “no change” in the status for each, meaning that 

each continued to be planned. The contradiction between the tracking information in 

SharePoint and the then-current EIC’s recollections calls into question the reliability of 

DER’s controls to track the status of each planned targeted examination in each supervisory 

plan for Fannie Mae. 

Apart from the tracking information in SharePoint, no DER official told us about any other 

controls used by DER examiners to track the status of targeted examinations and our audit did 

not identify any such controls. DER examiners typically track the status of planned targeted 

examinations in SharePoint by reference to the title of the examinations. However, when a 

title of a planned targeted examination is changed during the supervisory cycle, DER lacked 

 

7

 Within DER, the purpose of OESO is to provide support for the activities of all DER offices and to promote 

consistency, efficient business operations, and adherence to FHFA standards. OESO is responsible for 

development of DER policies and procedures for program activities, administration of DER’s quality control 

program, and coordination of DER responses to oversight entities such as OIG. Among other things, OESO 

coordinates work to ensure DER compliance with FHFA records management and other policies. 
OIG  AUD-2016-006  September 30, 2016 14

any control to track the status of that examination and relied on the recollections of the EIC 

and other examiners. 

Analysis 

DER planned 102 targeted 

examinations for Fannie Mae 

during the four-year review 

period. Of these 102 planned 

targeted examinations, we 

found, as of the end of our 

fieldwork on June 17, 2016: 

43 targeted examinations were 

completed (42 percent); 42 were 

not conducted (41 percent); and 

7 were commenced but not 

completed (7 percent). Of the 

42 that were not conducted, 

DER documentation established 

that 19 were cancelled, 9 were deferred, and 14 were converted to ongoing monitoring (see 

Figure 4). For the remaining 10 planned targeted examinations, DER did not provide any 

documentation for us to determine their disposition (10 percent).8 As we discuss in greater 

detail below, a number of targeted examinations planned for one supervisory cycle were 

completed by DER examiners in subsequent supervisory cycles, so the completion data is 

as of the end of our fieldwork, not the end of each supervisory cycle. Figure 1 captures the 

information for all years in graphic format. 

Looking at the number of planned targeted examinations by year, we found that the 2012, 

2013, and 2015 supervisory cycles ranged from 11 to 22, with a spike in the number of 

planned targeted examinations for the 2014 supervisory cycle to 53. DER produced its written 

Supervisory Strategy for 2014 to us which stated, 

We found no documentation to explain the reasons for the spike in planned 

targeted examinations from 16 in 2013 to 53 in 2014. During our fieldwork, we asked DER’s 

then-current EIC for Fannie Mae to explain the reasons for a spike. He told us that those 

numbers could represent a number of things. He explained that some managers break out each 

 

8

 We also found evidence in IMS of 13 targeted examinations during the review period that were not included 

in any annual supervisory plans and DER reported to us that it identified an additional 3 targeted examinations 

outside of the supervisory plans and IMS. Of these 16 targeted examinations that were not contained in the 

supervisory plans, DER provided documentation that 15 were completed. The disposition of the other 

examination was not documented. 

FIGURE 1. EXECUTION BY DER OF 102 PLANNED TARGETED 

EXAMINATIONS OF FANNIE MAE 2012 THROUGH 2015

43

42

7

10 Completed

Not Conducted

Commenced But Not

Completed

Disposition Not

Documented
OIG  AUD-2016-006  September 30, 2016 15

targeted examination by objective, whereas others would have multiple objectives within one 

examination, which could lead to greater or fewer targeted examinations in each year. He 

posited that some years could include a higher number of planned targeted examinations and 

a lower number of ongoing monitoring activities and others could reflect the opposite. Last, 

he reported that the Fannie Mae core team lost about half its examination staff in 2013, 

approximately 15 people. On its face, this last explanation is not convincing to us; a loss of 

roughly 50 percent of examiners from the Fannie Mae core team in 2013 would not support a 

rise in the number of planned targeted examinations from 16 in 2013 to 53 in 2014. 

After our fieldwork ended and we submitted a draft report to DER for its technical comments, 

DER provided a different explanation for the spike. DER advised that the spike in 2014 was 

anomalous, driven by a request from then-senior DER management to examination managers 

to “list all issues that could reasonably be topics of targeted examinations, regardless of 

resource constraints and including all risk levels.” DER’s explanation, if accurate, would 

reduce the risk-based planning process for the 2014 supervisory cycle to a nullity because the 

supervisory plan would amount to an unprioritized wish list. 

Our analysis of DER’s execution of 

its planned targeted examinations 

for each year of the review period 

found significant disparities from 

year to year regarding the number 

of completed targeted examinations. 

Overall, we found that both the 

number and percent of completed 

targeted examinations identified 

in the annual supervisory plans 

decreased significantly, even 

when DER is credited with the 

completion of planned targeted 

examinations after the supervisory 

cycle ended. As noted, DER 

completed 18 of 22 planned 

examinations (82 percent) for the 

2012 supervisory cycle, which declined to 8 of 16 planned examinations (50 percent) for the 

2013 supervisory cycle, before further declining to 13 of 53 planned targeted examinations 

(25 percent) for the 2014 supervisory cycle. For the 2015 supervisory cycle, 4 of 11 planned 

targeted examinations (36 percent) were completed as of the end of our fieldwork on June 17, 

2016. Figure 2 captures this information graphically. 

FIGURE 2. DER’S PLANNED TARGETED EXAMINATIONS FOR 

FANNIE MAE—PERCENT COMPLETED AS OF JUNE 17, 2016*

* Includes targeted examinations completed after the respective 

ROE issued.

82%

50%

25%

36%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

2012 2013 2014 2015
OIG  AUD-2016-006  September 30, 2016 16

As Figure 2 reflects, the percentage 

of completed targeted examinations 

identified on the supervisory plans 

ticked up slightly from 2014 to 

2015, from 25 to 36 percent. 

However, the actual number of 

completed targeted examinations 

dropped significantly from 13 for 

2014 to 4 for 2015. Figure 3 

captures this information by year 

for the review period. 

As discussed earlier in this 

report, DER is to summarize 

its examination results and 

conclusions, findings, and 

supervisory concerns from the 

supervisory activities completed during the annual supervisory cycle in an annual ROE 

issued to the relevant Enterprise’s board of directors. The purpose of an ROE is to clearly 

communicate to the board of directors of the Enterprise: the examination results and 

conclusions; findings and other supervisory concerns, such as deficient, unsafe, and unsound 

practices; and the composite and component ratings assigned in accordance with FHFA’s 

rating system. For Enterprise directors to carry out their oversight responsibilities under 

FHFA’s regulations and guidance, they must be made aware of the overall condition and 

risk profile of the Enterprise from the examination results and findings during the annual 

supervisory cycle.9 According to FHFA’s performance plan, DER must approve the final 

ROE for the prior supervisory cycle for each Enterprise by March 31. 

According to FHFA, it uses targeted examinations to conduct deep or comprehensive 

assessments of areas found to be of high importance or risk and most of the MRAs issued 

by DER, for the most significant supervisory deficiencies, have been issued as a result of 

findings from targeted examinations. 

 

9

 For a thorough discussion of FHFA’s requirements for the content of ROEs and DER’s practice in issuing 

ROEs to the Enterprises for the past five supervisory cycles, see OIG, FHFA’s Failure to Consistently Identify 

Specific Deficiencies and Their Root Causes in Its Reports of Examination Constrains the Ability of the 

Enterprise Boards to Exercise Effective Oversight of Management’s Remediation of Supervisory Concerns 

(July 14, 2016) (EVL-2016-008) (online at www.fhfaoig.gov/Content/Files/EVL-2016-008.pdf) and OIG, 

FHFA Failed to Consistently Deliver Timely Reports of Examination to the Enterprise Boards and Obtain 

Written Responses from the Boards Regarding Remediation of Supervisory Concerns Identified in those 

Reports (July 14, 2016) (EVL-2016-009) (online at www.fhfaoig.gov/Content/Files/EVL-2016-009.pdf).

FIGURE 3. FHFA’S NO. OF COMPLETED, PLANNED TARGETED 

EXAMINATIONS FOR FANNIE MAE AS OF JUNE 17, 2016*

* Includes targeted examinations completed after the respective 

ROE issued.

0

10

20

30

40

50

60

2012 2013 2014 2015

18 of 22

4 of 11

13 of 53

8 of 16
OIG  AUD-2016-006  September 30, 2016 17

For the 2014 supervisory cycle, DER planned 53 targeted examinations, significantly higher 

than the number of targeted examinations planned in prior cycles.10 Of these 53, DER 

completed only 8 before the ROE for that supervisory cycle issued. As a consequence, the 

ROE issued for the 2014 supervisory cycle was based on only 15 percent of the 53 targeted 

examinations planned for that cycle. 

Three (3) of the 53 targeted examinations planned for 2014 were completed after the 2014 

ROE issued and were included in the 2015 ROE issued March 23, 2016.11 An additional 2 of 

the 53 targeted examinations planned for 2014, which were commenced in April and July 

2014, were completed in May 2016 and will first be included in the 2016 ROE, to be issued in 

March 2017.12 Based on our review of DER records, four targeted examinations planned for 

the 2014 supervisory cycle were commenced in 2014, but not completed as of the end of our 

fieldwork on June 17, 2016. While there may be some usefulness to completing a targeted 

examination planned for one supervisory cycle in a subsequent cycle, there is also a risk that 

the examination fieldwork could be outdated by the time the conclusion letter, with findings, 

is issued to the Enterprise. 

Assuming the understanding expressed by FHFA senior leadership that the 2014 supervisory 

plan was an outlier and an unfair baseline against which to assess completion of targeted 

examinations, DER’s completion of targeted examinations during the 2015 supervisory cycle 

against those on the 2015 supervisory plan was dismal even when compared to its 2013 

performance. For the 2013 supervisory cycle, DER planned 16 targeted examinations and 

completed 8, all before the ROE for that cycle issued. For the 2015 supervisory cycle, DER 

planned only 11 targeted examinations and completed none before the ROE for that 

supervisory cycle issued. The only findings from planned targeted examinations included in 

the 2015 ROE were from the three targeted examinations planned for the 2014 supervisory 

cycle and completed in April and September 2015 and March 2016. As FHFA has explained, 

the purpose of an ROE is to summarize results and conclusions, findings, and supervisory 

concerns from completed supervisory activities during the cycle. Because no targeted 

examinations planned for 2015 were completed for the 2015 supervisory cycle before the 

ROE issued, that ROE could not and did not include the results and conclusions, findings, and 

supervisory concerns on these areas deemed by DER to be of the highest importance or risk 

planned for the 2015 supervisory cycle. Of the 11 targeted examinations planned for 2015, 

 

10 As previously discussed, the explanation for this spike in planned targeted examinations for the 2014 

supervisory cycle provided by the then-current EIC, during our fieldwork, was different than the explanation 

subsequently provided by DER after it reviewed our draft. 

11 Conclusion letters for the three targeted examinations were dated April 23, 2015; September 23, 2015; and 

March 1, 2016. 

12 Conclusion letters for these two targeted examinations were dated May 9, 2016; and May 23, 2016. 
OIG  AUD-2016-006  September 30, 2016 18

DER only completed 4 of them, after the ROE for that supervisory cycle issued on March 23, 

2016.13 Three additional targeted examinations planned for the 2015 supervisory cycle 

commenced before the 2015 ROE issued but were not completed as of the end of our 

fieldwork, June 17, 2016. 

To illustrate a consequence of DER’s desultory supervision, MRAs were identified in the 

conclusion letters issued for the four targeted examinations planned for the 2015 supervisory 

cycle and completed after the 2015 ROE issued. None of those MRAs were available to 

inform that ROE.14

Effective with the 2013 ROE, FHFA has used the CAMELSO rating system to report 

examination findings and conclusions to the Enterprise’s board of directors.15 The 

CAMELSO rating for Fannie Mae for the 2014 supervisory cycle was informed by eight 

targeted examinations planned and completed during the 2014 cycle. The CAMELSO rating 

for Fannie Mae for the 2015 supervisory cycle was informed by three targeted examinations 

planned and commenced in the 2014 supervisory cycle, for which the conclusion letters 

issued in April and September 2015, and in March 2016. The small number of targeted 

examinations completed during each of these two supervisory cycles necessarily limited the 

basis for the CAMELSO ratings for each cycle. 

Figure 4 captures, by year, the disposition of DER’s planned targeted examinations for Fannie 

Mae.

 

13 Conclusion letters for these four targeted examinations were dated April 8, 2016; April 13, 2016; April 27, 

2016; and June 8, 2016. 

14 The 2015 ROE reported new MRAs identified through ongoing monitoring activities conducted during 

the 2015 supervisory cycle. 

15 The term CAMELSO is the acronym used to describe the following seven components: Capital, Asset 

Quality, Management, Earnings, Liquidity, Sensitivity to Market Risk, and Operational Risk. The CAMELSO 

rating system consists of: (1) an overall condition of each regulated entity (the composite rating), and 

(2) individual components of financial condition and risk management (the component ratings). The composite 

and component ratings are on a scale from “l” to “5”, with a “1” indicating the lowest degree of supervisory 

concern and a “5” the highest. 
OIG  AUD-2016-006  September 30, 2016 19

FIGURE 4. SUMMARY OF FHFA’S PLANNED TARGETED EXAMINATIONS FOR FANNIE MAE

2012 THROUGH 2015, AS OF JUNE 17, 2016

2012 2013 2014a/ 2015 Totals

Planned Targeted Examinations 22 16 53 11 102

Completed 18 8 13 4 43

Before ROE for that Supervisory Cycle Issued b/ 12 8 8 0

Before ROE for Subsequent Supervisory Cycle Issued b/ 6 0 3 4

Before ROE to be Issued for Current Supervisory Cycle 

(2016) 0 0 2 0

Commenced But Not Completed 0 0 4 3 7

Not Conducted 4 5 30 3 42

Cancelled 1 0 16 2

Deferred 0 0 9 0

Converted to Ongoing Monitoring 3 5 5 1

Disposition Not Documented 0 3 6 1 10

a/ The explanation for this spike in planned targeted examinations for the 2014 supervisory cycle provided by the 

then-current EIC, during our fieldwork, was different than the explanation subsequently provided by DER after it 

reviewed our draft. 

b/ For 2012 and 2013, there was not a requirement that targeted examinations be completed before the ROE 

issued. 

Changes to Supervisory Activities and Plans Were Not Always Documented, and When 

Changes Were Documented, the Reasons Provided Were Largely Not Risk-Related

Because supervisory planning is a continuous process, supervisory plans need to be adjusted 

during each year to address newly emerging risks that require attention during the current 

supervisory cycle. Beginning with the 2014 supervisory cycle, DER’s guidance in 

2013-DER-OPB-03.1 directs that approved supervisory plans shall only be adjusted for riskrelated reasons and justifications for the adjustments must be approved by the EIC (after 

consultation with the Deputy Director of DER, as warranted) and fully documented in the 

work papers. 

As shown in Figure 4 above, a total of 64 targeted examinations were identified on DER’s 

supervisory plans for 2014 and 2015. Of those 64 planned targeted examinations, 17 were 

completed and 7 were commenced but not completed at the end of our fieldwork in June 

2016. Forty (40) of the 64 (63 percent) planned targeted examinations for 2014 and 2015 were 

either not conducted or their disposition was not documented. Of these 40, DER produced no 

documentation relating to the disposition for 7. DER had ample opportunity to provide us 

with such documentation: beginning in December 2015, we asked DER, on multiple 

occasions, to provide us documentation for specific planned supervisory activities that we 

could not find in its official system of record. DER provided us with some documentation 
OIG  AUD-2016-006  September 30, 2016 20

related to other planned supervisory activities but no documentation to show the disposition of 

these 7 planned targeted examinations. 

For the other 33 of the 40 planned targeted examinations, DER provided written materials 

explaining the change in status: 18 were cancelled, 6 were converted to ongoing monitoring, 

and 9 were deferred.16 We sought to determine whether a documented risk-related reason 

existed for the change in status for each, as required by 2013-DER-OPB-03.1. DER produced 

documentation that, in our view, provided risk-related reasons for changes to 11 of these 33.17

For the remaining 22 of the 33, the documentation provided by DER relating to the change in 

status did not provide risk-related reasons, in contravention of 2013-DER-OPB-03.1.18 For 

example, a July 2014 memorandum titled “Rationale for Changes to 2014 Supervisory Plan – 

Credit Risk” included the following explanation for removing 11 medium-priority and 2 lowpriority targeted examinations from the supervisory plan at the end of the first quarter of 

2014: 

The original approved supervisory plan called for twenty-seven (27) Targeted 

Examinations based on the risks and resources present at the time. As a result 

of contracting issues, the credit team lost a key subject matter expert (SME) 

that was critical to the execution of a significant number of [targeted 

examinations] that included credit risk assessments and testing for credit 

quality, accuracy of risk ratings etc. The SME was also expected to fulfill the 

role of on-the-job instructor for the less experienced members on the credit 

(and other) team allowing the other experienced examiners time and 

opportunity to execute [targeted examinations] in relatively short order. Upon 

departure by the SME and with an improved understanding of the credit risk 

profile of the Enterprise, the Credit Team Examination Plan was updated and 

 

16 Those written materials included internal memoranda, a mid-year update document, and a reassessment 

letter issued to Fannie Mae. 

17 The risk-related reasons for the change in status for 11 planned targeted examinations were: process changes 

at the Enterprise (3), Enterprise integration implementation delays (2), increased supervisory comfort gained 

by an enhanced internal credit program (1), lower risk than anticipated (1), change in direction and policy per 

FHFA (1), insignificance of a process to credit risk management (1), objective of the planned targeted 

examination was largely covered by another targeted examination (1), and Enterprise’s organizational structure 

was reevaluated (1). 

18 The documentation produced by DER to explain the change in status for the 22 planned targeted 

examinations reported: cancelled for resource constraints (12); deferred for resource constraints (1); changed 

from a higher to a lower priority, without any explanation for the change in priority (2); removed from the 

supervisory plan, without any reason documented (4); and cancelled because area covered by ongoing 

monitoring, without a risk-related explanation (3). 
OIG  AUD-2016-006  September 30, 2016 21

activities were re-prioritized by simply dropping the low and medium priority 

[targeted examinations]... 

Because DER’s guidance instructs that changes to an approved supervisory plan for 2014 and 

2015 must be risk-related and approved by the EIC, we asked the then-current EIC for the 

Fannie Mae core team if he could recall any risk-related reasons underlying the change in 

status for these 22 planned targeted examinations. He only offered resource constraints as the 

reason by explaining that several key examination managers and staff left FHFA, which 

caused DER to cancel planned targeted examinations. 
OIG  AUD-2016-006  September 30, 2016 22

FINDINGS ................................................................................. 

1. DER completed less than half of its 2012 through 2015 planned targeted 

examinations and did not complete many of its planned targeted examinations 

for each supervisory cycle prior to the issuance of the respective cycle’s ROE.

Less than half of planned targeted examinations for the period 2012-2015 were 

completed. 

DER prepares an annual supervisory plan that identifies the supervisory activities it intends 

to conduct during the year. According to FHFA, targeted examinations enable examiners to 

conduct a deep or comprehensive assessment of selected areas of high importance or risk. Our 

audit found that DER planned 102 targeted examinations for Fannie Mae from 2012 through 

2015 but completed only 43 (42 percent). 

After it received our draft report, DER management asserted to us that the 2014 supervisory 

plan was an outlier and an unfair baseline against which to assess completion of targeted 

examinations. Even when the planned and completed targeted examinations from the 2014 

supervisory cycle are removed from the analysis, DER completed 30 of 49 (61 percent) 

planned targeted examinations for three of the four supervisory cycles in this review (2012, 

2013, and 2015), and none of the 11 planned targeted examinations for the 2015 supervisory 

cycle were completed within the 2015 supervisory cycle. 

The usefulness of ROEs is diminished when planned targeted examinations for a 

supervisory cycle are not completed until after the ROEs issue. 

DER summarizes its examination results in an annual ROE issued to the relevant Enterprise’s 

board of directors. The ROE is intended to clearly and concisely convey the overall condition 

and risk profile of the Enterprise, summarize examination activities and findings during the 

annual supervisory cycle, and discuss deficient practices and excessive risks giving rise to 

supervisory concerns. 

While the ROE for the 2012 supervisory cycle was based on 12 targeted examinations 

planned and completed during that cycle, the ROE for the 2014 supervisory cycle was based 

on eight targeted examinations planned and completed during that cycle and the ROE for 

the 2015 supervisory cycle was based on three targeted examinations planned for and 

commenced during the 2014 supervisory cycle and completed prior to the issuance of the 

2015 ROE. No targeted examinations planned for the 2015 supervisory cycle were completed 

prior to the 2015 ROE. 
OIG  AUD-2016-006  September 30, 2016 23

According to FHFA, the purpose of an ROE is to summarize results and conclusions, 

findings, and supervisory concerns from completed supervisory activities during the cycle. 

Because no targeted examinations planned for 2015 were completed during this cycle, 

the 2015 ROE could not and did not include the results and conclusions, findings, and 

supervisory concerns on these areas deemed by DER to be of the highest importance or risk 

for that supervisory cycle. 

2. The number of planned targeted examinations that were completed has 

dropped significantly since 2012, and no planned targeted examinations for the 

2015 supervisory cycle were completed within that supervisory cycle. 

FHFA views targeted examinations as the opportunity to conduct a deep or comprehensive 

assessment of selected areas of high importance or risk. During the 2012 supervisory cycle, 

DER completed 12 of the 22 planned targeted examinations for Fannie Mae and completed an 

additional 6 during the 2013 supervisory cycle. In contrast, during the 2015 supervisory cycle, 

DER completed none of the 11 planned targeted examinations for Fannie Mae during that 

supervisory cycle and completed only 4 of the 11 during the 2016 supervisory cycle, as of the 

end of our fieldwork. 

The explanation provided by DER officials, including the then-current EIC, for this 

significant decrease in the number of completed targeted examinations varied and included 

the loss of some of the Fannie Mae core team examiners and managers in 2013 and 2014. We 

found that the loss of examiners during the 2013 supervisory cycle, when eight targeted 

examinations planned for that cycle were completed, does not provide a convincing 

explanation of the reasons why no targeted examinations were completed for the 2015 

supervisory cycle. 

3. DER’s official system of record for its supervisory activities for Fannie Mae is 

not complete and could not be relied upon, and DER lacked documentation to 

account for all of its supervisory activities. 

DER was unable to provide us with documentation to show the disposition of 10 of 102 

targeted examinations (10 percent) planned during the four supervisory cycles of our review 

period. 

According to its operating procedures, DER is to ensure that the supervisory planning is 

documented and incorporated into official agency records. IMS is DER’s official system of 

record for documentation of its supervisory activities. Our efforts to track through IMS 

whether each planned targeted examination was commenced and completed were not 

successful because IMS did not contain sufficient information to permit us to complete the 

tracking exercise. Despite repeated requests, DER was unable to provide any documentation 
OIG  AUD-2016-006  September 30, 2016 24

for the disposition of 10 targeted examinations planned during the four supervisory cycles in 

our review period. Lacking any documentation to show the disposition of these 10 planned 

targeted examinations, we asked the then-current EIC to explain the disposition. His 

recollection was in conflict with tracking information maintained on planned targeted 

examinations by the Fannie Mae core team in SharePoint. We found that DER had no 

operating controls in place to ensure that supervisory documentation in IMS was complete 

and to accurately track the status of planned targeted examinations through disposition. 

4. DER examiners did not always document changes to supervisory plans and, 

when changes were documented, the reasons provided were largely not risk 

related, in contravention of DER requirements. 

Beginning with the 2014 supervisory cycle, DER requires that all changes to supervisory 

plans must be risk-related, approved by the EIC, and documented. Forty (40) of the 64 (63 

percent) planned targeted examinations for 2014 and 2015 were either not conducted or their 

disposition was not documented. Of these 40, DER provided documentation to show a change 

in status for 33. Our review of this documentation identified risk-related reasons to support 

the change in status only for 11 of the 33. DER provided no documentation to explain the 

disposition of 7 of these 40. When the 7 planned targeted examinations for which DER 

provided no documentation to explain the change in status are added to the 22 for which no 

risk-related basis was documented in the materials provided to us by DER, a total of 29 

planned targeted examinations out of 40 (73 percent) lacked a documented risk-related basis 

for a change, in contravention of DER requirements. 
OIG  AUD-2016-006  September 30, 2016 25

CONCLUSION ............................................................................ 

For the four supervisory cycles assessed in this audit, DER planned 102 targeted examinations 

but completed only 43 (42 percent). Because a significant number of targeted examinations 

planned for the 2014 and 2015 supervisory cycles were completed after the supervisory cycle 

ended, the results were not discussed in the ROE or factored into the CAMELSO rating for 

those supervisory cycles. For the 2014 and 2015 supervisory cycles, DER examiners were 

only permitted to make changes to supervisory plans for risk-related reasons and were 

required to obtain approvals for those changes and document the risk-related reasons. 

However, this requirement was often not followed: of the 64 planned targeted examinations 

for these cycles, 40 were not conducted or their disposition was not documented, and only 11 

of the 40 documented risk-related reasons for the changes in the supervisory plans. 

In past reports, we found that that FHFA lacked a sufficient number of examiners. In 

response, FHFA committed to add examiners and has added examiners.19 As this assessment 

shows, DER failed to conduct and complete more than half of the planned targeted 

examinations for the past four supervisory cycles. The reason repeatedly provided to us by 

DER officials for this failure was resource constraints, notwithstanding the consistent position 

of DER leadership as recently reiterated by FHFA senior leadership that DER has an adequate 

complement of examiners. For a federal financial regulator, responsible for supervising two 

Enterprises that together own or guarantee more than $5 trillion in mortgage assets and 

operate in conservatorship, to fail to complete a substantial number of planned targeted 

examinations, including completing none of its 2015 planned targeted examinations for 

Fannie Mae within the 2015 supervisory cycle, is an unsound supervisory practice and 

strategy. 

Significant Risk Exposure Regarding the Quality of DER’s Supervisory Records

We consider the lack of DER’s documentation supporting its supervisory activities, as it 

relates to this audit, to create a significant risk exposure. This condition impacted the 

 

19 OIG, Evaluation of Whether FHFA Has Sufficient Capacity to Examine the GSEs (Sept. 23, 2011) (EVL2011-005) (online at www.fhfaoig.gov/Content/Files/EVL-2011-005.pdf); OIG, Update on FHFA’s Efforts to 

Strengthen its Capacity to Examine the Enterprises (Dec. 19, 2013) (EVL-2014-002) (online at 

www.fhfaoig.gov/Content/Files/EVL-2014-002.pdf). See also FHFA, FY2015 Performance and Accountability 

Report (Nov. 16, 2015) (Memorandum to Director Watt from Inspector General Wertheimer re: Fiscal Year 

2016 Management and Performance Challenges) (online at 

www.fhfa.gov/AboutUs/Reports/ReportDocuments/FHFA-2015-PAR.pdf) (accessed Aug. 2, 2016). 
OIG  AUD-2016-006  September 30, 2016 26

objectives of this report as well as those in its two companion reports, which were also issued 

today.20

According to DER’s operating procedures, DER is to ensure that the supervisory planning is 

documented and incorporated into official agency records. IMS is DER’s official system of 

record for documentation of its supervisory activities. Our efforts to track documentation of 

the planning and execution of DER’s supervisory activities through IMS were not successful 

because a significant amount of documentation was not retained in IMS. During our audit, we 

needed to make multiple information requests to DER for basic documentation relating to 

supervisory plans and their execution because such documentation was not always found in 

DER’s official system of record. Although DER located some documentation outside the 

official system of record, it was not able to find all requested documentation. 

DER often relied on the recollections of the then-current EICs to explain the universe of 

planned targeted examinations and the disposition of those planned targeted examinations for 

the supervisory cycles within the review period of this audit (2012-2015), which, at times, 

were later found to be inaccurate. DER’s inability to retrieve all supervisory documentation 

from its official system of record, its difficulty in finding documentation outside its official 

system of record, and its significant reliance on the imperfect individual recollections of 

personnel delayed us from the timely and efficient completion of our work. 

DER officials maintained to us that a significant shift in DER’s senior management and 

managers led to the lack of proper and complete documentation in IMS supporting its 

supervisory activities. That explanation surprises us. FHFA, which was created in 2008, took 

over the supervision of the Enterprises from its predecessor agency that had been operating 

since 1992, and it is not credible that a federal financial regulator, charged with supervision 

of the Enterprises, would be so impacted by a shift in senior management and managers. 

That explanation, however, is the only one offered by DER. If it is taken at face value, DER’s 

haphazard approach to creating and retaining complete documentation for its supervisory 

activities creates enormous risk. This risk, coupled with the other deficiencies identified in 

this audit, threatens FHFA’s ability to fulfill its statutory mission. 

In our judgment, deliberate urgency and resolute commitment by FHFA management to 

resolve these collective deficiencies, and to implement the recommendations in this report and 

its two companion reports, is required. 

 

20 OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 

High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments and Most High-Priority 

Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted 

Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015 

Were Completed (Sept. 30, 2016) (AUD-2016-007). 
OIG  AUD-2016-006  September 30, 2016 27

RECOMMENDATIONS ............................................................... 

In a companion report issued today, FHFA’s Supervisory Planning Process for the 

Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted 

Examinations Did Not Trace to Risk Assessments and Most High-Priority Planned 

Examinations Were Not Completed (September 30, 2016) (AUD-2016-005), we included a 

recommendation that FHFA: 

1. Revise existing guidance to require examiners to prepare complete documentation of 

supervisory activities and maintain such documentation in the official system of 

record, and train DER examiners on this guidance. 

The same recommendation applies with equal force to address the documentation deficiencies 

identified in this report on Fannie Mae targeted examinations. As a result of our audit work 

related to the targeted examinations of Fannie Mae, we are making additional 

recommendations. Specifically, we recommend that FHFA: 

2. Assess whether DER has a sufficient complement of qualified examiners to conduct 

and complete those examinations rated by DER to be of high-priority within each 

supervisory cycle and address the resource constraints that have adversely affected 

DER’s ability to carry out its risk-based supervisory plans. 

3. Develop and implement guidance that clearly requires supervisory plans to identify 

and prioritize the planned targeted examinations that are to be completed for each 

supervisory cycle, in order to fully inform the ROE and CAMELSO ratings for that 

cycle.

4. Develop and implement a control that provides for the tracking and documentation of 

planned targeted examinations, through disposition, in DER’s official system of 

record. 

5. Reinforce and hold EICs accountable to follow DER’s requirement to fully document 

the risk-based justifications for changes to the supervisory plan, and that changes to 

supervisory plans are documented and approved by the EIC. Ensure that examiners 

follow DER Operating Procedures Bulletin 2013-DER-OPB-03.1 to fully document 

the risk-based justifications for changes to the supervisory plan, and that changes to 

supervisory plans are documented and approved by the EIC. 

These recommendations also apply to the deficiencies identified in our companion report on 

targeted examinations of Freddie Mac (FHFA’s Targeted Examinations of Freddie Mac: Just 
OIG  AUD-2016-006  September 30, 2016 28

Over Half of the Targeted Examinations Planned for 2012 through 2015 Were Completed 

(September 30, 2016) (AUD-2016-007)).
OIG  AUD-2016-006  September 30, 2016 29

FHFA COMMENTS AND OIG RESPONSE....................................

OIG provided FHFA an opportunity to respond to a draft report of this audit. FHFA provided 

technical comments that we incorporated into this final report, as appropriate. On September 22, 

2016, FHFA provided its management response, which is provided in Appendix A. In its 

response, FHFA provided three general comments to our draft report. In addition, FHFA 

disagreed with recommendation 1, partially agreed with recommendation 2, stated that it issued 

internal guidance in May 2016 that FHFA believes confirmed its general agreement with 

recommendations 3 and 5, and agreed with recommendation 4. FHFA’s comments and our 

responses are below. 

FHFA General Comment 

FHFA believes that the reports21 and several of the recommendations are redundant in 

light of ongoing changes and commitments that FHFA has already made, and is in the 

process of implementing, in response to the OIG report dated January 4, 2016.22 The new 

procedures, together with existing practices and procedures, will result in an effective risk 

assessment and examination planning process that assures that supervisory resources are 

focused on the highest risks at the Enterprises. Because the risk assessment changes were 

recently made in May 2016, there were no results to be reviewed in the OIG fieldwork for 

these reports. 

OIG Response to FHFA General Comment. Our evaluation, dated January 4, 2016, found 

significant shortcomings in DER’s risk assessment process, which FHFA committed to

address. Internal guidance issued by DER in May 2016, when implemented, purportedly 

will correct those shortcomings. As we explained in one of the companion reports issued 

today, this audit sought to build on that evaluation work to determine whether highpriority planned targeted examinations were supported by risk assessments and whether 

those examinations were completed. The objective of this audit is far different than the 

objective of our prior evaluation report. 

 

21 By reports, FHFA is referring to this report and its two companion reports: FHFA’s Supervisory Planning 

Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 High-Priority Planned Targeted Examinations 

Did Not Trace to Risk Assessments and Most High-Priority Planned Examinations Were Not Completed (Sept. 30, 

2016) (AUD-2016-005), and FHFA’s Targeted Examinations of Freddie Mac: Just Over Half of the Targeted 

Examinations Planned for 2012 through 2015 Were Completed (Sept. 30, 2016) (AUD-2016-007).

22 OIG, Utility of FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of Clear 

Standards and Defined Measures of Risk Level (Jan. 4, 2016) (EVL-2016-001) (online at 

www.fhfaoig.gov/Content/Files/EVL-2016-001.pdf).
OIG  AUD-2016-006  September 30, 2016 30

We performed no work during our prior evaluation to tie planned targeted examinations 

back to risk assessments and/or to track the disposition of such examinations. The 

recommendations in the three reports from this audit flow directly from the findings of 

this audit, not from earlier work. 

FHFA General Comment 

FHFA disagrees with the reports’ premise or implication that supervisory objectives can 

be met only through targeted examinations completed within the calendar year of planning 

and that changes to work plans prevented DER from communicating supervisory concerns 

to the Enterprises through the ROEs and otherwise. Ongoing monitoring, supervisory 

engagement during the course of targeted examination work, completion of examinations 

planned in a prior year, examination work added to the plan during the year, and review of 

remediation of deficiencies all inform supervisory understanding of Enterprise operations, 

risks, and risk management. Advisory Bulletin 2012-03, FHFA Examination Rating 

System, dated December 19, 2012 (AB 2012-03), describes FHFA’s CAMELSO ratings 

system and provides that ratings take into account various factors, including findings 

issued in the current and previous calendar years, progress of remediation of previous 

findings, and a regulated entity’s responsiveness to findings by internal and external 

parties. 

OIG Response to FHFA General Comment. The premise or implication stated by FHFA 

was not made in our reports. This audit tracked the disposition of targeted examinations 

planned for four supervisory cycles in the review period and found that a significant 

number of such examinations were completed after the ROEs for those cycles issued. 

From FHFA’s response, it appears that FHFA is comfortable with the fact that a ROE was 

issued to one Enterprise for the 2015 supervisory cycle based only on the completion of 3 

targeted examinations planned for the 2014 supervisory cycle and completed in 2015, and 

no targeted examinations planned for the 2015 supervisory cycle were completed during 

that cycle. 

FHFA General Comment 

FHFA disagrees with the reports’ findings that DER’s documentation of supervisory 

activities is lacking or of poor quality. While the documentation recording the basis for 

changes to examination plans has been inconsistent at times, the report does not specify 

that type of documentation but refers generally to “supervisory documentation.” We 

specifically note that FHFA OIG observed in a 2014 report that DER maintained complete 
OIG  AUD-2016-006  September 30, 2016 31

examination documentation for 2013 targeted examinations.23 That OIG report states, 

“We reviewed DER’s workpapers for 28 targeted examinations conducted by the Fannie 

Mae and Freddie Mac Core Teams (together, the Core Teams) in 2013. We found that in 

each of these cases DER staff complied with the Agency’s recordkeeping policies and 

procedures.” Since that report was issued, DER has put in place an enhanced quality 

control review function that will help to ensure that the official records of examination 

activities are complete and maintained appropriately. 

OIG Response to FHFA General Comment. FHFA’s reliance on our 2014 report is 

inapposite. There, we reviewed the examination workpapers for 28 completed targeted 

examinations and found that DER examiners complied with FHFA’s recordkeeping policies 

and procedures. In this audit, other than to look for the presence of the request letter and 

conclusion letter, we did not review examination workpapers for completed targeted 

examinations and made no findings about the quality of those workpapers. While FHFA 

takes credit for DER’s quality control process, we note: (1) that this process was only put 

into place in July 2015, after we completed fieldwork for an evaluation which found that

DER had reneged on its commitments to put such a process into place for the prior four 

years;24 and (2) that the quality control process only reviews documentation maintained for 

examination work products.

This audit had an entirely different focus: whether DER examiners created and maintained 

records to document the annual supervisory cycle, from planning through execution. As this 

audit found, DER was unable to provide any documentation for the disposition of 18 targeted 

examinations for both Enterprises – 10 for Fannie Mae and 8 for Freddie Mac – during the 

four supervisory cycles in our review period, notwithstanding our multiple requests. 

Our 2014 report, on which FHFA relies in its comment, also states: 

...we also found that DER’s recordkeeping practices have limitations that impede the 

efficient retrieval of these workpapers by FHFA examiners, other FHFA personnel, and 

outside oversight entities such as the OIG. 

Almost two years later, these limitations have not been addressed by FHFA and hampered 

our work on this audit. FHFA’s inability to provide documentation to show the disposition of 

18 planned targeted examinations during the four supervisory cycles reviewed in this audit –

roughly 10 percent of the total planned – creates a significant risk exposure. 

 

23 FHFA is referring to OIG report Evaluation of the Division of Enterprise Regulation’s 2013 Examination 

Records: Successes and Opportunities (Oct. 6, 2014) (EVL-2015-001). 

24 OIG, Intermittent Efforts Over Almost Four Years to Develop a Quality Control Review Process Deprived 

FHFA of Assurance of the Adequacy and Quality of Enterprise Examinations (Sept. 30, 2015) 

(EVL-2015-007) (online at https://www.fhfaoig.gov/Content/Files/EVL-2015-007.pdf).
OIG  AUD-2016-006  September 30, 2016 32

FHFA Comments to Recommendation 1 

FHFA disagrees with this recommendation. DER has sufficient guidance in place for 

documentation of supervisory activities. Moreover, in mid-2015, DER put in place an 

enhanced quality control function that provides an independent review of targeted 

examination work products to assess whether written communications to the Enterprises 

are supported by documentation of examination work that meets DER standards and 

applicable FHFA guidance for preparation of written products. DER believes that existing 

internal guidance and the quality control reviews now being performed are effective to 

ensure that the official records of examination activities are complete and maintained 

appropriately. To the extent that this recommendation refers to documentation of riskbased changes to examination plans, this issue will be addressed in the course of 

implementing the May 2016 guidance referenced above. To the extent that this 

recommendation refers to tracking of examination activity status, see response to 

recommendation 4 below. 

OIG Response to FHFA Comments to Recommendation 1. As discussed in this report as 

well as in two companion reports issued today, DER’s operating procedures direct that 

supervisory planning is documented and incorporated into official agency records.25 As 

we explained in detail, our efforts to track the planning and execution of DER’s 

supervisory activities through documentation maintained in IMS were not successful 

because a significant amount of documentation was not retained in IMS. 

FHFA’s suggestion that DER’s enhanced quality control reviews will remedy these 

problems is unfounded. In accordance with DER’s quality control review process, put in 

place in July 2015, these reviews are focused on documentation for completed targeted 

examinations. This audit found lack of documentation supporting the planning and 

execution of supervisory activities. Of the 18 targeted examinations planned during the 

four supervisory cycles in our review for which DER provide no documentation to show 

their disposition, 3 were planned for the 2015 supervisory cycle, after the 2015 quality 

control reviews were put into place. DER’s inability to produce documentation to show 

the disposition of 3 targeted examinations planned for the 2015 supervisory cycle 

demonstrates that DER’s current quality control reviews are either not working as FHFA 

expected they would or working as intended but do not address this deficiency. 

 

25 OIG, FHFA’s Supervisory Planning Process for the Enterprises: Roughly Half of FHFA’s 2014 and 2015 

High-Priority Planned Targeted Examinations Did Not Trace to Risk Assessments and Most High-Priority 

Planned Examinations Were Not Completed (Sept. 30, 2016) (AUD-2016-005), and OIG, FHFA’s Targeted 

Examinations of Freddie Mac: Just Over Half of the Targeted Examinations Planned for 2012 through 2015 

Were Completed (Sept. 30, 2016) (AUD-2016-007). 
OIG  AUD-2016-006  September 30, 2016 33

As we explained in the companion reports, DER has required, since January 1, 2014, that 

all changes to supervisory plans be risk-based, documented in writing, and approved. The 

reports issued today demonstrate widespread non-compliance with that requirement. 

Instead of addressing that deficiency, FHFA promises that documentation of risk-based 

changes to supervisory plans will be addressed in the course of implementing the May 

2016 guidance and in enhancements to DER’s mechanisms for tracking changes to 

supervisory plans but does not explain how it intends to change examiner behavior. 

Simply reiterating an existing requirement that has not been followed is unlikely to 

increase compliance. 

FHFA Comments to Recommendation 2 

DER partially agrees with this recommendation. DER does not agree that current staffing 

levels have adversely affected DER’s ability to meet its supervisory responsibilities. DER 

agrees, however, that it is a sound practice to regularly assess whether staffing levels are 

sufficient to carry out DER responsibilities for fulfillment of FHFA’s mission. As part of 

the agency-wide budget process for each fiscal year, DER assesses its resource needs in 

making its submission for preparation of FHFA’s annual budget. DER will continue to 

provide this information and will seek to promptly fill open positions. 

OIG Response to FHFA Comments to Recommendation 2. FHFA’s assertion that DER’s 

staffing levels have not adversely affected its ability to meet its supervisory responsibilities 

cannot be squared with findings from this audit: DER failed to conduct and complete more 

than half of its planned targeted examinations of Fannie Mae for the past four supervisory 

cycles and almost half of its planned targeted examinations of Freddie Mac and the reason 

repeatedly provided by DER officials for this failure was resource constraints. FHFA’s 

commitment to regularly assess staffing levels and fill open positions meets the intent of our 

recommendation, provided that these assessments address the resource constraints invoked 

by DER officials as the explanation for DER’s inability to complete the targeted 

examinations it planned. 

FHFA Comments to Recommendations 3 and 5 

On May 25, 2016, FHFA issued internal guidance which FHFA believes confirms our 

general agreement with these recommendations. As we previously advised OIG staff, 

during the first quarter of 2017 FHFA will assess the effectiveness of the enhanced risk 

assessment procedures outlined in the guidance and determine whether any revisions are 

needed before the mid-year risk assessment process commences in 2017. To the extent 

that recommendations 3 and 5 contemplate steps other than those to which FHFA has 

previously agreed in response to the OIG’s January 4, 2016 report, we disagree with the 

recommendations at this time, but will consider them as part of our 2017 assessment. 
OIG  AUD-2016-006  September 30, 2016 34

OIG Response to FHFA Comments to Recommendations 3 and 5. Since FHFA is 

committed to implementing recommendations 3 and 5, either through the implementation 

of its May 25, 2016 internal guidance or as part of its 2017 assessment, we consider 

FHFA’s response to these recommendations to be an agreement. After FHFA performs its 

2017 planned mid-year assessment of the implementation of the May 2016 guidance, we 

plan to review the results of that assessment. To the extent that FHFA’s assessment finds 

that OIG’s recommendations 3 and 5 are not fully implemented by that guidance, we 

expect FHFA to take additional corrective actions. 

FHFA Comments to Recommendation 4 

DER agrees with this recommendation. By September 23, 2017, DER will establish an 

improved mechanism for tracking the status of activities included on Enterprise 

examination plans, including changes resulting from the mid-year planning update process 

and at year-end. The control will reflect approved changes and note the rationale for those 

changes. 
OIG  AUD-2016-006  September 30, 2016 35

OBJECTIVE, SCOPE, AND METHODOLOGY ................................. 

We conducted this audit to determine whether FHFA (1) supported its 2014 and 2015 highpriority planned targeted examinations with risk assessments and completed those planned 

high-priority examinations; (2) performed its planned targeted examinations for Fannie Mae 

from 2012 through 2015 and, if it did not, whether FHFA documented the deviations from 

its plan in accordance with policies and procedures; and (3) performed its planned targeted 

examinations for Freddie Mac from 2012 through 2015 and, if it did not, whether FHFA 

documented the deviations from its plan in accordance with policies and procedures. 

This report addresses the second objective – determining whether FHFA performed its 

planned targeted examinations for Fannie Mae from 2012 through 2015, and if it did not, 

whether FHFA documented the deviations from its plans in accordance with policies and 

procedures. We conducted this audit from December 2015 through June 2016 at FHFA’s 

headquarters in Washington, D.C. 

To accomplish the audit objective, we: 

 Reviewed FHFA’s Examination Manual; DER’s OPB Supervisory Planning Process 

(2013-DER-OPB-03.1); DER’s OPB DER Supervisory Activities (2013-DER-OPB04); and DER’s OPB Guidelines for Preparing Supervisory Products and Examination 

Workpapers (2014-DER-OPB-01); 

 Reviewed FHFA’s supervisory plans for 2012 through 2015 and identified planned 

targeted examinations; 

 Compared the number of planned targeted examinations for Fannie Mae – as 

described in FHFA’s supervisory planning documents – to the targeted examination 

request letters, conclusion letters, and other relevant documentation in order to 

determine the disposition of the examinations; 

 Reviewed FHFA’s Information Management System in an effort to confirm and 

identify the universe of planned targeted examinations and their disposition; 

 Reviewed FHFA’s reasons for not fully implementing its examination plans; and 

 Interviewed FHFA DER officials regarding their implementation of the supervisory 

plans. 

We held an exit conference with FHFA officials on September 12, 2016. 
OIG  AUD-2016-006  September 30, 2016 36

We conducted this performance audit in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for the findings and conclusions 

based on our audit objectives. We believe that the evidence obtained provides a reasonable 

basis for our findings and conclusions based on our audit objectives. 
APPENDIX A

FHFA's Comments on OIG's Findings and Recommendations

Federal Housing Finance Agency

MEMORANDUM

TO: Marla A. Freedman, Deputy Inspector General for Audits

FROM: Nina A. Nichols, Deputy Director, Division of Enterprise Regulation (DER)

SUBJECT: Audit Reports on FHFA’s Targeted Examinations of Fannie Mae and Freddie Mac

(Enterprises)1 for 2012 through 2015

DATE: September 2 2 , 2016

This memorandum transmits the management response of the Federal Housing Finance Agency 

(FHFA) to the FHFA OIG draft audit reports referenced above (Reports).

FHFA agrees that effective examination planning and tracking are critical components of 

FHFA’s supervision of the Enterprises, and we appreciate the FHFA OIG’s attention to this area. 

FHFA is working to make improvements to our supervision protocols and processes to ensure 

effective risk-based planning and tracking of examination activities. FHFA continues to improve 

our supervision program, taking into account FHFA OIG recommendations.

We specifically note that, in accordance with FHFA commitments made in response to a 

previous OIG evaluation report,2 in May 2016 DER issued internal guidance for conducting risk 

assessments to support risk-based supervision of the Enterprises. The guidance includes defined 

terms, measures, and formats for credit, market, and operational risk. As committed in the 

management response, DER has provided training to all Enterprise examination staff on the 

revised risk assessment procedures. As part of our ongoing evaluation process, in the first

1 The titles of the Reports are: FHFA’s Targeted Examinations o f Fannie Mae: Less than H alf of

the Targeted Examinations Planned fo r 2012 through 2015 Were Completed and No

Examinations Planned fo r 2015 Were Completed Before the Report o f Examination Issued and 

FHFA’s Targeted Examinations o f Freddie Mac: Just Over H alf o f the Targeted Examinations

Planned for 2012 through 2015 Were Completed.

2 Utility o f FHFA’s Semi-Annual Risk Assessments Would Be Enhanced Through Adoption of

Clear Standards and Defined Measures o f Risk Levels (EVL-2016-001), January 4, 2016.

OIG • AUD-2016-006 • September 30, 2016
quarter of 2017 DER will assess the effectiveness of the new approach and determine if any 

revisions are needed before the mid-year risk assessment process commences in 2017.

We make the following general responses to the Reports:

1) FHFA believes that the Reports and several of the recommendations are redundant in 

light of ongoing changes and commitments that FHFA has already made, and is in the 

process of implementing, in response to the OIG report dated January 4, 2016. The new 

procedures, together with existing practices and procedures, will result in an effective risk 

assessment and examination planning process that assures that supervisory resources are 

focused on the highest risks at the Enterprises. Because the risk assessment changes were 

recently made in May 2016, there were no results to be reviewed in the OIG fieldwork for 

these Reports.

2) FHFA disagrees with the Reports' premise or implication that supervisory objectives can 

be met only through targeted examinations completed within the calendar year of 

planning and that changes to work plans prevented DER from communicating 

supervisory concerns to the Enterprises through the Reports of Examination and 

otherwise. Ongoing monitoring, supervisory engagement during the course of targeted 

examination work, completion of examinations planned in a prior year, examination work 

added to the plan during the year, and review of remediation of deficiencies all inform 

supervisory understanding of Enterprise operations, risks, and risk management.

Advisory Bulletin 2012-03, FHFA Examination Rating System, dated December 19, 2012 

(AB 2012-03), describes FHFA's CAMELSO ratings system and provides that ratings 

take into account various factors, including findings issued in the current and previous 

calendar years, progress of remediation of previous findings, and a regulated entity’s 

responsiveness to findings by internal and external parties.

3) FHFA disagrees with the Reports’ findings that DER’s documentation of supervisory 

activities is lacking or of poor quality. While the documentation recording the basis for 

changes to examination plans has been inconsistent at times, the Report does not specify 

that type of documentation but refers generally to “supervisory documentation.” We 

specifically note that FHFA OIG observed in a 2014 report that DER maintained 

complete examination documentation for 2013 targeted examinations.3 That OIG report 

states, “We reviewed DER’s workpapers for 28 targeted examinations conducted by the 

Fannie Mae and Freddie Mac Core Teams (together, the Core Teams) in 2013. We found

3 Evaluation o f the Division o f Enterprise Regulation's 2013 Examination Records: Successes

and Opportunities (EVL-2015-001), October 6, 2014.
that in each of these cases DER staff complied with the Agency’s recordkeeping policies 

and procedures.” Since that report was issued. DER has put in place an enhanced quality 

control review function that will help to ensure that the official records of examination 

activities are complete and maintained appropriately.

In light of the above, FHFA strongly disagrees that the Reports justify any conclusion or 

implication that any process or concern raised in the Reports either “creates a significant risk 

exposure” or “threatens FHFA’s ability to fulfill its statutory mission.”

FHFA management’s responses to the recommendations are below: 

Recommendation 1:

Revise existing guidance to require examiners to prepare complete documentation o f supervisory

activities and maintain such documentation in the official system o f record, and train DER

examiners on this guidance.

Management Response to Recommendation 1:

FHFA disagrees with this recommendation. DER has sufficient guidance in place for 

documentation of supervisory activities. Moreover, in mid-2015, DER put in place an enhanced 

quality control function that provides an independent review of targeted examination work 

products to assess whether written communications to the Enterprises are supported by 

documentation of examination work that meets DER standards and applicable FHFA guidance 

for preparation of written products. DER believes that existing internal guidance and the quality 

control reviews now being performed are effective to ensure that the official records of 

examination activities are complete and maintained appropriately. To the extent that this 

recommendation refers to documentation of risk-based changes to examination plans, this issue 

will be addressed in the course of implementing the May 2016 guidance referenced above. To 

the extent that this recommendation refers to tracking of examination activity status, see response 

to recommendation 4 below.

Recommendation 2:

Assess whether DER has a sufficient complement o f qualified examiners to conduct and complete

those examinations rated by DER to be o f high-priority within each supervisory cycle and

address the resource constraints that have adversely affected D E R ’s ability to carry out its riskbased supervisory plans.
DER partially agrees with this recommendation. DER does not agree that current staffing levels 

have adversely affected DER’s ability to meet its supervisory responsibilities. DER agrees, 

however, that it is a sound practice to regularly assess whether staffing levels are sufficient to 

carry out DER responsibilities for fulfillment of FHFA’s mission. As part of the agency-wide 

budget process for each fiscal year. DER assesses its resource needs in making its submission for 

preparation of FHFA’s annual budget. DER will continue to provide this information and will 

seek to promptly fill open positions.

Recommendations 3 and 5:

Management Response to Recommendation 2:

Develop and implement guidance that clearly requires supervisory plans to identify and

prioritize the planned targeted examinations that are to be completed for each supervisory cycle,

in order to fully inform the ROE and CAMELSO ratings for that cycle.

Reinforce and hold EICs accountable to follow D ER’s requirement to fully document the riskbased justifications for changes to the supervisory plan, and that changes to supervisory plans

are documented and approved by the EIC. Ensure that examiners follow DER Operating

Procedures Bulletin 2013-DER-OPB-03.1 to fully document the risk-based justifications for

changes to the supervisory plan, and that changes to supervisory plans are documented and

approved by the EIC.

Management Response to Recommendations 3 and 5:

On May 25, 2016, FHFA issued internal guidance which FHFA believes confirms our general 

agreement with these recommendations. As we previously advised OIG staff, during the first 

quarter of 2017 FHFA will assess the effectiveness of the enhanced risk assessment procedures 

outlined in the guidance and determine whether any revisions are needed before the mid-year risk 

assessment process commences in 2017. To the extent that recommendations 3 and 5 

contemplate steps other than those to which FHFA has previously agreed in response to the 

OIG’s January 4, 2016 report, we disagree with the recommendations at this time, but will 

consider them as part of our 2017 assessment.

Recommendation 4:

Develop and implement a control that provides for the tracking and documentation o f planned

targeted examinations, through disposition, in the D E R ’s official system o f record.
DER agrees with this recommendation. By September 23, 2017. DER will establish an improved 

mechanism for tracking the status of activities included on Enterprise examination plans, 

including changes resulting from the mid-year planning update process and at year-end. The 

control will reflect approved changes and note the rationale for those changes.

Management Response to Recommendation 4:

cc: John Major, Internal Controls and Audit Follow-up Manager

OIG • AUD-2016-006 • September 30, 2016
OIG  AUD-2016-006  September 30, 2016 42

ADDITIONAL INFORMATION AND COPIES ................................. 

For additional copies of this report:

 Call: 202-730-0880 

 Fax: 202-318-0239 

 Visit: www.fhfaoig.gov

 To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to FHFA’s programs or operations:

 Call: 1-800-793-7724 

 Fax: 202-318-0358 

 Visit: www.fhfaoig.gov/ReportFraud

 Write: 

 FHFA Office of Inspector General 

 Attn: Office of Investigations – Hotline 

 400 Seventh Street SW 

 Washington, DC 20219