SECURITIES AND EXCHANGE COMMISSION
                          Washington, D.C.  20549

                                  FORM 10-K



                    Pursuant to Section 13 or 15(d) of the
                        Securities Exchange Act of 1934


(Mark One)
[ x] Annual Report Pursuant to Section 13 or 15(d) of the Securities
Exchange Act of 1934
For the fiscal year ended DECEMBER 31, 2002

 or

[    ] Transition Report Pursuant to Section 13 or 15d of the Securities
Exchange Act of 1934
For the transition period from _____________  to ________

Commission file Number   333-44300-04

Asset Backed Securities Corporation
(Exact name of registrant as specified in its charter)

Delaware                          13-3354848
(State or other jurisdiction      (I.R.S. Employer
of incorporation or organization)  Identification No.)

11 Madison Avenue, Park Avenue Plaza
New York, New York                                       10010
(Address of Principal Executive Offices)         (Zip Code)

Registrant's telephone number, including area code:           212 325-1811

Origen Manufactured Housing Contract Senior/Subordinate
Asset Backed Certificates Series 2002-A
(Title of each class of securities covered by this Form)

Securities registered pursuant to Section 12(b) of the Act:  NONE
Securities registered pursuant to Section 12(g) of the Act:  NONE

Indicate by check mark whether the registrant (1) has filed all reports
required to be filed by Section 13 or 15(d) of the Securities Act of 1934
during the preceding 12 months (or for such shorter period that the registrant
was required to file such reports), and (2) has been subject to such filing
requirements for the past 90 days.
      X - Yes       No


                                     PART I

Item 1. Business
      Not applicable.

Item 2.  Properties
      Not applicable on reliance of Relief Letters

Item 3. Legal Proceedings
      There were no legal proceedings.

Item 4. Submission of Matters to a Vote of Security Holders
      There were no matters submitted to a vote of the Security Holders.

                                    PART II

Item 5. Market for Registrant's Common Equity and Related Stockholder matters

	As of December 31, 2002, the Trust had less than 300 holders of record of the
	Notes, computed in accordance with Rule 12g5-1 under the Securities Exchange
	Act of 1934, as amended.

Item 6. Selected Financial Data.

	Not applicable.


Item 7. Management's Discussion and Analysis of Financial Condition and
	Results of Operations.

	Not applicable.

Item 8. Financial Statements and Supplementary Data.

	Not applicable.


Item 9. Changes in and Disagreements with Accountants on Accounting and
Financial Disclosure Information required by Item 304 of Reg. S-K.

       Not applicable.



                                    PART III


Item 10. Directors and Executive Officers of the Registrant.

	Not applicable.

Item 11. Executive Compensation.

	Not applicable.

Item 12.  Security Ownership of Certain Beneficial Owners and Management

	Not applicable.

Item 13.  Certain Relationships and Related Transactions.

	Not applicable.


                                    PART IV

Item 14. Exhibits, Financial Statement Schedules, and Reports on Form 8-K

      (a) 1.  Not Applicable
            2.  Not Applicable
            3.  Exhibits
                 99.1  Annual Summary Statement
                 99.2  Annual Statement as to Compliance.
                 99.3  Annual Independent Public
                          Accountant's Servicing Report.

      (b)   Reports on Form 8-K
      The registrant has filed Current Reports on Form 8-K with the
      Securities and Exchange Commission dated:
      April 15,2002;  May 15, 2002;  June 15, 2002;  July 15, 2002;
      August 15, 2002;  September 15, 2002, October 15, 2002;
      November 15, 2002;  December 15, 2002

      (c)    See (a) 3 above

      (d)    Not Applicable



                    SIGNATURES

Pursuant to the requirements of Section 13 or 15(d) of the Securities
Exchange Act of 1934, the registrant has duly caused this report to be
signed on its behalf by the undersigned thereunto duly authorized.

Origen Financial, LLC, as Servicer for:
Origen Manufactured Housing Contract Senior/Subordinate
Asset Backed Certificates Series 2002-A

      /s/    W. Anderson Geater

      Name:  W. Anderson Geater

      Title: Chief Financial Officer




Date:  March 31, 2003


Sarbanes-Oxley Certification

I, W. Anderson Geater, certify that:

1. I have reviewed this annual report on Form 10-K, and all reports on Form 8-K
containing distribution or servicing reports filed in respect of periods
included in the year covered by this annual report, of
Origen Manufactured Housing Contract Senior/Subordinate
Asset Backed Certificates Series 2002-A

2. Based on my knowledge, the information in these reports, taken as a whole,
does not contain any untrue statement of a material fact or omit to state a
material fact necessary to make the statements made, in light of the
circumstances under which such statements were made, not misleading
as of the last day of the period covered by this annual report;

3. Based on my knowledge, the distribution or servicing information required
to be provided to the trustee by the servicer under the pooling and servicing,
or similar, agreement, for inclusion in these reports is included
in these reports;

4. I am responsible for reviewing the activities performed by the servicer
under the pooling and servicing, or similar, agreement and based upon my
knowledge and the annual compliance review required under that agreement,
and except as disclosed in the reports, the servicer has fulfilled its
obligations under that agreement; and

5. The reports disclose all significant deficiencies relating to the servicer's
compliance with the minimum servicing standards based upon the report
provided by an independent public accountant, after conducting a review
in compliance with the Uniform Single Attestation Program for Mortgage
Bankers or similar procedure, as set forth in the pooling and servicing,
or similar, agreement, that is included in these reports.

In giving the certifications above, I have reasonably relied on information
provided to me by the following unaffiliated parties:

Bank One, National Association, as Trustee
Origen Financial, LLC, as Servicer




Date:               March 28, 2003
/s/	            W. Anderson Geater
		    W. Anderson Geater
Company:            Origen Financial L.L.C.
Title:              Chief Financial Officer


                    EXHIBIT INDEX

      Exhibit NumberDescription
               99.1 Annual Summary Statement
               99.2 Annual Statement of Compliance
               99.3 Report of Independent Accountants




       EXHIBIT 99.1 -- Summary of Aggregate Amounts or End of Year
       Amounts for the period ending December 31, 2002

      Origen Manufactured Housing Contract Senior/Subordinate
      Asset Backed Certificates Series 2002-A

STATEMENT TO CERTIFICATEHOLDERS

DISTRIBUTION SUMMARY

                        Beginning               Current Period      Accrued
           Original Current Princi   Principal   Pass-Through      Interest
Class   Face Value         Amount  Distribution          Rate Distributed (1)
A-1      35,243,000    35,243,000    12,487,688       1.62125%      443,363
A-2      24,362,000    24,362,000             0       5.22000%      953,772
A-3      14,300,000    14,300,000             0       6.17000%      661,732
A-4      23,295,000    23,295,000             0       7.17000%    1,252,689
M-1      11,475,000    11,475,000             0       7.87000%      677,312
M-2      10,800,000    10,800,000             0       8.85000%      716,850
B-1      10,125,000    10,125,000             0       9.50000%      721,406
X       135,002,848   135,002,848             0       0.00000%            0




                     Certificate        Ending
      Realized Loss      Interest  Current Prin
          Principal    Shortfall        Amount
Class
  A-1             0             0    22,755,312
  A-2             0             0    24,362,000
  A-3             0             0    14,300,000
  A-4             0             0    23,295,000
  M-1             0             0    11,475,000
  M-2             0             0    10,800,000
  B-1             0             0    10,125,000
    X             0             0   125,834,435



AMOUNTS PER $1,000 UNIT
                                                                     Ending
                             Prin           Int      Realized     Curr Prin
Class Cusip          Distribution  Distribution          Loss        Amount
A-1   68619AAL1      354.33102999   12.58016486    0.00000000  645.66897001
A-2   68619AAM9        0.00000000   39.15000000    0.00000000 1000.00000000
A-3   68619AAN7        0.00000000   46.27499790    0.00000000 1000.00000000
A-4   68619AAP2        0.00000000   53.77500193    0.00000000 1000.00000000
M-1   68619AAQ0        0.00000000   59.02500392    0.00000000 1000.00000000
M-2   68619AAR8        0.00000000   66.37500000    0.00000000 1000.00000000
B-1   68619AAS6        0.00000000   71.25000000    0.00000000 1000.00000000
X     BCC06P3B1        0.00000000    0.00000000    0.00000000  932.08726328

                           Unpaid        Unpaid
                    Int. ShortfallInt. Shortfall                     Unpaid
      Accrued              Amount        Amount               Prin. Shortfall
      Interest        Distributed     Remaining                      Amount
A-1       443362.75    0.00000000    0.00000000                  0.00000000
A-2       953772.30    0.00000000    0.00000000                  0.00000000
A-3       661732.47    0.00000000    0.00000000                  0.00000000
A-4      1252688.67    0.00000000    0.00000000                  0.00000000
M-1       677311.92    0.00000000    0.00000000                  0.00000000
M-2       716850.00    0.00000000    0.00000000                  0.00000000
B         721406.25    0.00000000    0.00000000                  0.00000000



Collateral Beginning Balance        135,002,848
Scheduled Principal Collected         1,554,757
Principal Prepayments                 6,814,722
Liquidation Proceeds                    430,030
Realized Loss of Principal              798,934               Ending Count
Collateral Ending Balance           125,834,435                        3100


                    Current                     Next
                    Percentage                  Percentage
Class A                    100.00%                     100.00%
Class M-1                    0.00%                       0.00%
Class M-2                    0.00%                       0.00%
Class B                      0.00%                       0.00%


Pool Factor                 90.36%


                                                Count         Balance
Repossd. Contracts Purch. during Due Period                 0             0
Cumulative Repossessed Contracts Purchased                  0             0
Contracts Repossessed during Due Period                    73     2,722,012

Weighted Average Net Contract Rate      10.6497%


                                                Interest Deficiency
                    Distribution Test           Amount
Class M-1           No Distrib. Required                    0
Class M-2           No Distrib. Required                    0
Class B             No Distrib. Required                    0



Targeted Overcollateralization Amount               9,450,199
Overcollateralization Amount                        8,722,124
Overcollateralization Deficiency Amount               728,076
Overcollateralization Release Amount                        0



Additional Principal Distribution       433,660



Current Realized Losses                  77,075
Cumulative Realized Losses              798,934


                                  Adjusted Principal          Class
                                  Balance                     Principal Balance
Class M-1                            11,475,000                  11,475,000
Class M-2                            10,800,000                  10,800,000
Class B                              10,125,000                  10,125,000
* Balance Not Including Liquidation Loss

                                  Actual        Dist. Test    Servicing Test

Average 60 Day Delinquency Ratio T         2.25%         6.00%         7.00%
Monthly 60+ Day Delinquency                2.88%

Current Realized Loss Ratio Test           1.49%         3.50%         5.00%
Annualized Monthly Loss Ratio              0.73%

Cumulative Realized Losses Test            0.59%         7.50%        15.00%


1 Month Delinquent *2 Months Delinquent *       3+ Months Delinquent *
    #       Balance             #       Balance             #       Balance
   70     3,296,074            23     1,088,590            23     1,070,431
  2.3%          2.6%          0.7%          0.9%          0.7%          0.9%

REO                 Modifications               Specially Serviced
    #       Balance             #       Balance             #       Balance
    34    1,461,050             12      494,420              0             0
  1.1%          1.2%          0.4%          0.4%          0.0%          0.0%

Foreclosure
    #       Balance
    3       212,649
  0.1%          0.2%

Bankruptcy
    #       Balance
    52    2,057,381
  1.7%          1.6%





       EXHIBIT 99.2 -- Servicer's Annual Statement of Compliance

	The undersigned certifies that he is the Chief Financial Officer
of Origen Financial L.L.C., a Delaware limited liability company
(the "Company"), and that as such he is duly authorized to execute and
deliver this certificate on behalf of the Company pursuant to Section 6.02
of the Pooling and Servicing Agreement (the "Agreement"), dated as of March
1 , 2002, among Asset Backed Securities Corporation, as depositor,
Origen Financial L.L.C., as seller and Servicer (in such Capacities, the
"Seller" and the "Servicer"), Vanderbilt Mortgage and Finance, Inc., as
backup servicer (the "Backup Servicer"), and Bank One, National Associatian,
as Trustee of the Trust (the "Trustee") (all capitalized terms used herein
without definition having the respective meanings specified in the
Agreement), and further certifies that:
1. The Monthly Report for the period from April 1,
2002 to March 31,2003 attached to this certificate is complete and
accurate in accordance wth the requirements of Sections 6.01 and
6.02 of the Agreement; and
2. As of the date hereof, no Event of Termination or
event that with notice or lapse of time or both would become an
Event of Termination has occurred.

	IN WITNESS WHEREOF, I have affixed hereunto my signature the 15
day of April, 2003.


ORIGEN FINANCIAL, L.L.C
By
/s/ 	W. Anderson Greater
	W. Anderson Greater
	Chief Financial Officer







       EXHIBIT 99.3 -- Report of Independent Auditors
      Service Auditor's Report
Origen Financial, L.L.C.
April 1, 2002 to March 31, 2003

Accountants and Business Advisors
INDEPENDENT SERVICE AUDITOR'S REPORT
To The Board of Directors of Origen Financial, L.L.C.:
We have examined the accompanying description of controls at Origen Financial
L.L.C. ("Origen") related to its loan processing general controls for the Texas
operation and computer controls at the Virginia Data Center in support of the
loan processing function. Our examination included procedures to obtain
reasonable assurance about whether (1) the accompanying description presents
fairly, in all material respects, the aspects of Origen's controls that may
be relevant to a user organization's internal control as it relates to an audit
of financial statements, (2) the controls included in the description were
suitably designed to achieve the control objectives specified in the
description, if those controls were complied with satisfactorily and user
organizations applied the controls contemplated in the design of Origen's
controls and (3) such controls have been placed in operation as of March 31,
2003. The control objectives were specified by the management of Origen.
Our examination was performed in accordance with standards established by
the American Institute of Certified Public Accountants ("AICPA") and included
those procedures we considered necessary in the circumstances to obtain a
reasonable basis for rendering our opinion.
In our opinion, the accompanying description of the controls of Origen's
Loan Processing presents fairly, in all material respects, the relevant
aspects of Origen's controls that have been placed in operations as of March
31, 2003. Also, in our opinion, the controls, as described, are suitably
designed to provide reasonable assurance that the specified control
objectives would be achieved if the described controls were complied with
satisfactory and user organizations and subservice organizations applied
the controls contemplated in the design of Origen's controls.
In addition to the procedures we considered necessary to render our opinion
as expressed in the previous paragraph, we applied test to specific controls,
listed in our description of the tests of operating effectiveness, to obtain
evidence about their effectiveness in meeting the related control objectives,
described in our description of those tests, during the period from April 1,
2002 to March 31, 2003. The specific controls and the nature, timing, extent,
and results of the tests are listed in the description of the tests of
operating effectiveness. This information has been provided to user
organizations of Origen and to their auditors to be taken into consideration,
along with information about the internal control as user organizations,
when making assessments of control risk for user organizations.
The Service Organization states in its description of controls that is has
controls in place to ensure that only authorized personnel have access to
critical system files. Our tests of operating effectiveness noted that a
significant number of individuals were contained in a security group that
provided update access to mission critical application directories and that
IT developers had update access to the production environment. This resulted
in the non-achievement of the control objective "Controls should
provide reasonable assurance that only authorized personnel have
access to appropriate system files." Subsequent to the issuance our
findings, Origen management immediately addressed all test exceptions,
which are detailed in section IV of this report.Origen Financial, L.L.C.
 In our opinion, except for the matter described in the preceding paragraph,
the controls that were tested, as described in our description of the
tests of operating effectiveness, were operating with sufficient effectiveness
to provide reasonable assurance, but not absolute, assurance that the control
objectives specified in our
description of those tests were achieved during the period from April 1,
2002 to March 31, 2003. However, the scope of our engagement did not
include tests to determine whether the control objectives not listed in our
description of the tests of operating effectiveness were achieved; accordingly,
we express no opinion on the achievement of the control objectives not included
in our descriptions of those tests.
The relative effectiveness and significance of specific controls at
Origen and their effect on assessments of control risk at user organizations
are dependent upon their interaction with controls and other factors present at
individual user organizations.
We have performed no procedures to evaluate the effectiveness
of the controls at individual user organizations.
The information in section II describing plans for business continuity
and disaster recovery at Origen is presented by Origen to provide additional
information and is not a part of Origen's description of controls that may be
relevant to user organization's
internal control. Such information has not been subjected to the procedures
applied in the examination of the description of the controls applicable
to the processing of transactions for user organizations and accordingly,
we express no opinion on it.The description of controls at Origen is as
of March 31, 2003, and information about tests of the operating
effectiveness of specific controls covers the period from April 1, 2002
to March 31, 2003. And projection of such information to the future is
subject to the risk that, because of change, the description may no longer
portray the controls in existence. The potential effectiveness of specific
controls at Origen is subject to inherent limitations and, accordingly,
errors or fraud may occur and not be detected. Furthermore, the projection
of any conclusions, based on our findings, to future periods is subject to
the risk that (1) changes made to the system of controls, (2) changes in
processing requirements, or (3) changes required because of the passage of
time may alter the validity of such conclusions.This report is intended
solely for use by the management of Origen, its users and the independent
auditors of its users and is not intended to be and should not be used by
anyone other than these specified parties.

Grant Thornton LLP
April 12, 2003
Southfield, Michigan
27777 Franklin Road, Suite 800
Southfield, Michigan 48034
T 248.262.1950
F 248.350.3581
W www.grantthornton.com
Grant Thornton LLP
US Member of Grant Thornton International

II. Business Overview
A. Description of Organization.
Origen Financial, L.L.C. ("Origen"), a 20% owned subsidiary of Bingham
Financial Services Corporation ("BFSC"), provides loan-servicing functions
primarily for manufactured housing lenders. Origen's loan servicing operation
 is located in Ft. Worth, Texas, which facilitates the process of effectively
 providing customer service across the continental United States. Origen has
five branches located throughout the US (Michigan-HDQ, Georgia,
Virginia-Origen's data center location, Cincinnati, and Texas).
Origen services a loan portfolio exceeding $1 billion for various private
investors and has been designated by the Federal National Mortgage Association
as an approved manufactured home loan servicer.
The general focus of this SAS70 is to review the operations, technology,
and controls that support the loan servicing function.
B. Overview of Internal Control Environment.
An organizational structure exists that provides levels of management,
reporting responsibilities, and segregation of duties. Origen activities
are conducted in accordance with established policies and procedures. These
procedures are reviewed and updated as needed.
Personnel
Origen maintains formal hiring practices designed to ensure that new employees
are qualified for their job responsibilities. New position hiring must be
jointly approved by the Human Resources Department and the department manager
of the area requesting the position. Hiring policies and practices include the
following: confirming minimum education and experience
requirements, performing reference checks, conducting background and credit
investigation checks, and executing confidentiality statements.
All employees are required to subscribe to a company-established code
of ethics.  Promotions to supervisory and specialist positions
require completion  of relevant training courses and accomplishment of
specific position  core competencies. Formal performance reviews are conducted
annually and informal reviews and feedback are given to employees on a
periodic basis. In the formal annual review process, employees are evaluated
on objective criteria based on performance and assigned an overall rating
 (i.e., unsatisfactory, fair, competent, commendable, and outstanding).
Insurance
Origen's insurance coverage's are coordinated with BFSC. The terms,
conditions, and limits of liability exceed industry standards.
Physical security
Origen's premises are controlled by a card-key system, which is operational
24 hours a day. The onsite data center is also secured by a card-key system,
in which only authorized employees have access.

Contingency Planning
A business continuity plan is in place and will be activated in the event of
a disruption in the company's ability to service borrowers. Consideration has
been given to telecommunication recovery, computer systems recovery, and the
reassignment of personnel, so that interruption of services to customers can
be minimized.
The plan is reviewed annually and tested at regular intervals to ensure that
the assumptions made by management in devising the specifics of the plan
remain consistent with the current environment in which Origen conducts its
business.
C. Overview of Origen Services.
Origen's service to borrowers is designed to ensure compliance with
federal and state regulations, to maintain appropriate control over loan
servicing, and to utilize technology to ensure accuracy
and efficiency. Origen uses the Interlinq MortgageWare Servicing System
("MortgageWare"). This system offers a complete menu of loan servicing
options that include automated loan set-up with automatic "welcome letters"
and coupon book origination. Loan Processing Files and collateral documents
are also imaged which provide same-day accessibility, on-line storage system,
and an audit trail for Origen. Origen also offers title processing and escrow
analysis services in addition to its standard customer service. Finally,
Origen is a full service repossession/foreclosure and resale provider.
The following four areas are covered in the scope of this SAS70:
(1) Loan Servicing. Loan Servicing describes Origen's overall loan
process starting after origination, and ending with title processing.
Upon origination, loans are changed to a funded status, and are
processed nightly in Origen's Mortgageware system. Once the loan is funded,
titling is done.
Origen services approximately 30,000 loans, in which the majority are
simple interest loans. They also have a small portion of precomputed loans,
single-family loans, and home improvement loans.
(2) Loss Mitigation. Loss Mitigation at Origen describes the procedures
and guidelines in place for servicing delinquent loans through the
development of special relief measures and alternatives to avoid foreclosure.
(3) Remarketing. Remarketing is the process of liquidating repossessed
units in the most feasible manner within the least amount of time,
with the least amount of loss.
(4) Information Systems Environment for Support of Loan Processing.
Origen's IT Department (Data Center) is located in Glen Allen, Virginia,
with approximately 22 employees. According to IT documentation,
overall departmental efforts are focused towards three objectives:
Providing real-time, high quality support to business operations at
corporate and in the regions through the Origen Help Desk which provides
comprehensive assistance on any systems issue an employee is experiencing.

Developing or enhancing systems to support new product initiatives,
increased efficiency, and improve adaptability to change.
Evaluating and recommending implementation of new technology or processes
to provide Origen with a strategic or competitive advantage.
D. Description of Services.
1. Loan Servicing
Loan Set-Up
All loans, with the exception of repurchases from an investor, are
automatically set up in the portfolio by downloading from the Polaris
origination system. Files received on a repurchase loan from an investor
are set up manually. Information to set up the loans is verified and input
by the set up clerk.
The systems group sets up loans funded through the Polaris Origination
System ("Polaris") the day
after funding in MortgageWare. Loan Administration balances all loans set
up through the Polaris automated interface to the production reports,
correcting any fatal exceptions prior to moving the loans to a live status.
Loans that are unable to be loaded through the automated process are set
up manually by Loan Servicing Customer Service team through the loan
set-up module using a procedural checklist. Once the loan is set
up in the MortgageWare system, the Help Desk is notified so they can update
the loan information in the Polaris Origination System if not already there.
Loans requiring manual set-up generally will be limited to repurchased loans.
Upon completion of loan set-up, whether manual or automatic, a query of
newly established loans is generated through MortgageWare for processing
borrower welcome letters. Welcome letters are automatically
generated and mailed the day the loan is set up.
Loan coupon books containing 12 coupons are also automatically generated
upon completion of loan set-up and mailed to borrowers.
Coupon book requests are submitted to an outside vendor every Friday for
all loans set-up during the week. Borrowers will generally receive
coupon books within 10 days.
All files, custodian and servicing, are then scanned into a permanent
imaging file by the Imaging Department staff.
The servicing files are retained for Origen at an offsite location.
The servicing files contain the following documents which are noted on the
Transmittal cover sheet: Original contract note, cure
letter, adjustable rate loan disclosure and specification,
assumption agreement, credit application,
manufacturers invoice, placement certificate,
retail financing power of attorney dealer, title application,
insurance binder, deed of trust mortgage, title insurance policy,
and survey plat. Servicing files also include all documents from the
transmittal checklist which includes the following: loan deficiency summary,
post closing documentation, audit form, approval/condition sheet,
loan funding summary, underwriting
worksheet, credit bureau reports, underwriting condition documentation,
loan document request form, customer
purchase agreement, dealer installed options invoice, and a landlord waiver.
Custodian files are the collateral
files for Origen; they contain all documents noted on the Transmittal Cover
Page, and must be submitted to the Custodian (Bank One Irving)
in a timely manner. Upon receipt of the file from Origen, the Custodian
will return a collateral confirmation via email.
The custodian generates an exception report following all transmittals
received. The Loan Administration Manger reviews each exception item,
follows up on outstanding items, and verifies the custodian has cleared
all items submitted. The custodian emails an inventory report to the
Loan Administrator whenever a batch of files is submitted.
The Loan Administration Manger must then verify that the Custodian
has received all files; any exceptions have been reported to the
Custodian and are being monitored until resolved.
Origen submits a written request to the custodian to remove the loan
from inventory, and forwards the complete file to Origen when it is
paid in full. If Origen has borrowed against the loan balance, the
Loan Administration Manager must contact the Manager of Finance at the
Home Office to have the warehouse
line paid down by the amount of the unpaid balance of the loan.
Escrow Analysis
Loans with an escrow account are analyzed annually,
during which any adjustments needed are made. Any
overages are returned to the borrower, and shortages
are spread over the next 12 payments. An escrow
analysis statement is generated automatically and mailed
to the borrower indicating their escrow balance,
details of the analysis, and new payment amount/effective
date if applicable. Coupon books are also generated
at the time of the analysis and received by the customer
within three weeks.
Insurance
All hazard insurance policies are forwarded to a
third-party contractor who is responsible for maintaining systems
to ensure insurance is maintained on the collateral.
Cancellation, Expiration, and Non Renewal notices are
received from the insurance companies and Origen's Regional
offices via mail. When the notices are received by
Servicing, each notice, with an effective cancellation date,
is sent to Ameritrac, the third- party Contractor,
for processing. Once a policy is cancelled, Origen immediately
notifies the borrower, and must receive replacement
coverage within an allotted time frame because every borrower
must provide proof of insurance coverage.
If coverage is not provided, Origen can secure hazard
insurance coverage on behalf of the borrower. This forced
place insurance will be added to the borrower's monthly
loan payment until the premium amount is re-payed. The
renewal premium is the responsibility of the borrower.
The coverage is effective on the date of the expired policy,
and does not contain liability or personal effects coverage.
Ameritrac issues the policy. A copy of the policy
along with a cover letter is sent to the borrower directly
from Ameritrac. A lien holder copy of the policy is
sent to Origen.
Origen Financial, L.L.C. 2003 Service Auditor's Report
on Loan Processing Page 9
For all policies issued, Ameritrac sends a monthly
statement to Origen. All accounts for which coverage has been
placed will be adjusted and the collection for repayment
of the premium amount is established. The borrower is
notified of the payment amount change, and payment
coupons indicating the increased payment amount will be requested
and sent to the borrower.
Credit Bureau Reporting
The exact status of each loan that Origen services
is reported to two major credit bureaus (TransUnion L.L.C and
Equifax Credit Information Services ) on a monthly
basis. All borrowers are reported monthly regardless of good
or bad payment histories. An automated tape is
forwarded for every loan in the servicing system to the credit
bureaus on a monthly basis. on a monthly basis.
Borrowers may dispute credit report entries through the credit
bureaus. The credit bureaus identify the borrower
and outline the grounds for the dispute. A Customer Dispute
Verification Form is then sent to Origen and must
be completed and returned to the appropriate credit bureau
within 5 days according to FCRA (Fair Credit Reporting Act) requirements.
Each dispute is handled by the Customer Service
Department on a case-by-case basis. Payment history information
is updated in the Servicing System. In the event
that management requests a deletion of a file from the credit
bureau records (ex: a fraud case or an agreement from a
lawsuit), the credit bureau processor must complete the
Universal Data Form for both bureaus, and update the
Servicing System Status to "Don't Report". A copy of all
credit bureau dispute forms, deletions, and updates,
including any other correspondence with the credit bureaus
is imaged by the Imaging group and added to the appropriate file.
Payment Processing
Payment Processing is responsible for conducting the
entire Cash Management process. All forms of payment received
by the Service Center are controlled and processed
through the Payment Processing Department. The majority of all
payments are posted through a bank lockbox service;
however, Origen also utilizes electronic payment services and
receives payments in-house for manual postings. Various
forms of payment are as follows:
Manual Posting:
Payments in Full (Payoffs)
Liquidations
Mail directed to Origen's office address
Bank Lockbox Payments:
Origen's customers (borrowers) are requested to remit
their payments to the lockbox account at Bank One, Dallas,
Texas. Bank One Lockbox Department processes the payments
overnight and provides Origen Payment Processing with a
master batch sheet that outlines all payments posted as well
as any payments that were rejected. The total dollar
amount collected in the lockbox account is swept each night
and transferred to the Payment Clearing Account for
further distribution to the investor accounts.
Additional Sources of Payments:
Origen Financial, L.L.C. 2003 Service Auditor's Report on
Loan Processing Page 10
Phone Pay
Automatic Debit Processing (ACH)
Western Union
Payment Processing monitors the receipt and application of
all payments to ensure that payments are processed in
accordance with sound accounting practices. All payments
are maintained in a safekeeping area and posted on the
day of receipt.
Mail is opened immediately upon receipt, and payments are
separated from all other correspondence. Per Origen
policy, two employees must be present during this process.
All payments are date stamped, and loan numbers are
written on each check and/or money order.
Unidentified payments, which cannot be posted the same day,
are logged on the "unidentified log" for purposes
of tracking and stored in safekeeping until the checks can
be identified and posted. Any check that cannot be
identified within three business days is returned to sender.
All deposits for direct receipts are deposited the next
business day following receipt to the Payment Clearing
Account, which is monitored daily to ensure that all
deposits are posted and/or accounted for. Any unapplied item
is researched and cleared within 48 hours of identification.
All in-house receipts are imaged and delivered for
direct deposit to the Payment Clearing Account within 24 hours of receipt.
Insufficient funds are processed within 48 hours of receipt of
the NSF notification from the bank with exception
of the last business day of the month. Due to time constraints,
NSF notifications are not processed on the last
business day of month.
Payoffs
Payoffs are processed immediately upon receipt. Payoffs
can be requested via telephone or in writing.
  Telephone Payoffs
Once the name and social security number of the borrower is
verified, customer service may provide outstanding
principal balance information, emphasizing that this figure is
not the total payoff amount. If the borrower requests
a payoff, the payoff information is mailed without written
authorization to the borrower at the property or mailing
address of the record. The payoff request, which includes
accrued interest, expenses, legal fees, etc, is to be
sent within five business days of the initial request.
A copy of the request is also forwarded to imaging. Once
the payoff is received, the Servicing System Customer
Service screen is updated to "Payoff" , "Comments" are added
and a copy of the payoff is forwarded to imaging.
  Written Payoffs
All payoff requests to be sent to any address other than the
borrower's property or mailing address must be made
in writing. In addition, any request initiated by a third party
must have the borrower's signature authorization,
correct name, and social security before the payoff is released.
The payoff request, which includes accrued interest,
Origen Financial, L.L.C. 2003 Service Auditor's Report on Loan
Processing Page 11
expenses, legal fees, etc, is to be sent within five business
days of the initial request. A copy of the request
is also forwarded to imaging for the permanent file. Once the
payoff is received, the Servicing System Customer
Service screen is updated to "Payoff" , "Comments" are added,
and a copy of the payoff is forwarded to imaging.
Any payoff received that is short of the total remittance is
applied to the outstanding debt and a notification
is sent within 24 hours to the borrower advising them of the
remaining balance. A customer log will then be entered
by the Payoff Department regarding the shortfall and the date
of the notification.
Title Processing
Origen processes all title changes on existing loans. All
requests for title changes are submitted to Loan
Administration for processing. Loan Administration then
requests the title from the Custodian.
Loan Administration images the request and proof of change
(marriage, divorce, court ordered changes) and submits
any changes as indicated to the appropriate state once the
fees have been received from the borrower. Should the
borrower request additional parties be added to the title
after the original title has been submitted, Origen will
advise the borrower to contact their local title agency for
assistance. The borrower will also be advised that
Origen will not process any title changes other than those
directly related to Origen's loan documents. If the
title change is due to a Transfer of Equity, Origen will
submit the change to the appropriate state once they have
received the signed transfer papers and fees. If the title
change is due to an error on the part of Origen or the
title agency, Loan Administration will process the correction
as needed. Upon receipt of the updated title, Loan
Administration will image the title document(s) and send them
to the custodial bank for safekeeping. Loan
Administration will be notified whenever a loan is paid in
full and will immediately request the original file
from the custodial bank.
Release of Lien
Customer Service generates a payoff statement and sends it
to the borrower, new lender or agent handling the
sale. Once the payoff check is received at Origen and funds
have been verified, Loan Administration will refund
escrow and initiate the release process by requesting the
collateral documents from the Custodian. When the
loan is paid in full, Loan Administration must submit a
written request to the custodian to remove the loan
from inventory and release the collateral file to Origen.
After the release is checked for accuracy by the
Loan Administrator, the prepared release is submitted to the
Origen designee (investor) for signatures. The
executed release is notarized, if applicable, and a check is
ordered to pay for the recording fee assessed
by the county or state, if required by state guidelines.
All payoff documents are then imaged by the Imaging
Department. The executed release and check to the reorder
are mailed within 24 hours after the document
execution process. Once the county records the release and
returns it to Origen or another designee, Loan
Administration must mail the recorded release via certified
mail, return receipt requested, to the borrower
or designated third party.
2. Loss Mitigation
Origen Financial, L.L.C. 2003 Service Auditor's Report
on Loan Processing Page 12
Loss Mitigation at Origen describes the procedures and
guidelines in place for servicing delinquent loans
through the development of special relief measures and
alternatives to avoid foreclosure. A delinquent
loan must meet certain criteria for collection efforts
prior to acceptance by Loss Mitigation. Initially,
all incoming and outgoing calls are screened to determine
that the loans are eligible for consideration by
the Loss Mitigation Department. All calls determined to be
ineligible are transferred to other appropriate
servicing areas.
Once the loan is accepted by the Loss Mitigation Department,
documentation is reviewed and the borrower is
counseled concerning the loan. Guidelines are then established
for determining if the loan is eligible for
a Work-Out Plan (WP) or Payment Plan (PP) through Loss
Mitigation. The general guidelines are as follows:
  Borrower must be experiencing or have experienced financial hardship.
  Borrower must be delinquent in their monthly payments, or
in danger of imminent default.
  Borrower must complete the required documentation.
  Borrower must be cooperative and allow access to the interior
of the collateral for a home inspection, if
needed.
More detailed guidelines apply based on the specific type of
payment plan. Various types of Work-Out Plans or
Payment Plans are available at Origen for Loss Mitigation loans
including the following:
Work-Out Plans
  Short Payoff (sale)
  Make Whole Pre-Foreclosure (sale)
  Loan Modification
  Hardship Loan Assumption
  Deed-In-Lieu of Foreclosure
Payment Plan
  Repayment Plans
  Reinstatement partial
  Forebearance-Short Term
  Forebearance-Long Term
The modification/refinance programs listed above are intended
to assist delinquent borrowers who have fallen
behind in their payment as a result of a long term or permanent
financial situation that normal default
services is unable to resolve. The modification/refinance programs
are only offered to customers who
demonstrate willingness and financial ability to honor their new
payment program. The borrower can only
restore a delinquent loan to current status by paying the total
amount delinquent, including accrued
interest, legal cost, and other expenses.
The modification/refinance program must be documented in
MortgageWare and a Modification Approval Form must be
processed including the reason for account delinquency
and proof of long-term or permanent change of borrower's condition.
A signed Credit Application, appropriate
Origen Financial, L.L.C. 2003 Service Auditor's Report on
Loan Processing Page 13
loan agreements and required title documents must be obtained
prior to processing the modification/refinance.
Modification/Refinance programs must be reviewed monthly by an
independent function that reports directly to
the Senior Vice President of Servicing Operations and Executive
Vice President of Origen. The Loss Mitigation
Manager reviews the programs that are within his/her approval limit,
which are listed on the Loss Mitigation
Credit Authorization Matrix. Any programs over his/her approval limits
must be approved by Executive Vice President of Origen.
Repayment plans must be added to the Servicing System, and once the
borrower has met his/her full obligation under
the repayment plan schedule, the plan is considered completed.
The repay status on the account is then changed
to "Completed", and a comment must be added to the account stating,
"Completed repayment plan". After completing
a repayment plan on an account, Customer Service is notified by email,
after which they also change the status to "Completed".
Repayment plans are tracked and managed by utilizing the following
three reports:
Repayment Plan Active Status provides payments received for all
active repayment plans.
  Repayment Plan Report provides the entire payment history on a
repayment plan.
  Repayment Plan Summary Report provides repayment plan information
for all repayment plans. Report is grouped by
plan status (active, pending, etc)
Controls are in place to ensure that the Loss Mitigation Department
is making satisfactory progress toward their goals,
are using their resources efficiently, and are ensuring that actual
activities conform to planned activities. Steps in
this process are as follows:
  Establishing standards and methods for measuring performance
  Comparing standards to actual performance
  Measuring performance
  Initiating corrective action, as necessary
Loss Mitigations Key Performance Areas are based on, and should
be tracked at, each of the following levels:
Quantity
  Number of referrals
  Number of final approvals
  Number of funded approvals
Quality
  Number of re-looks
  Scores on funded loans (high, low, average)
  Post-funding audits
  Time
  Time lapsed between Initial Referral and Final Decision

  Time lapsed between Final Approval and Closing/Funding
As part of the tracking process, various data is accumulated that must
be reported to management in order to ensure
that departmental results are consistent with Origen objectives.
Tracking is done at the agent level, showing assigns
and completions each month. A summary report of required information
for the department, Loss Mitigation Monthly Report,
is generated for management use.
3. Remarketing
Once a home is confirmed vacant, and all legal notices have expired,
the remarketing process begins. Remarketing receives
the files from collections, which include the reason for repossession,
the original contract, etc.
However, before Origen can legally repossess a property, they must
have the original title. If the original title is
not available, the Loan Administration Department will order a
duplicate title or apply for the original title.
In some states, a repossession title is also required prior to
selling the manufactured home. Immediately upon
notification that a manufactured home has been possessed, the
Repossession Title Clerk begins the title retrieval
process, which is tracked and maintained on the "ERS-Repossession Title"
document tracking system. All updates
and status will be maintained on this system until the title is released.
Once the title is released, it will be
noted on the document tracking system as a repossessed loan and to
whom the title was released. The title clerk
also updates the Polaris system (to show the title was received),
and the DRS (to cut check fees if necessary).
Once remarketing receives all pertinent files, including a repossession page,
a conditions and inspection report,
and photos of the home, a sign off sheet must be completed by the manager.
The file is then transferred to the
Delinquency and Repossession System by remarketing,
a notice of sale is issued, and the status is changed to
repossession'. Remarketing then pulls copies of the original
title and contract and begins a marketing
analysis to determine the amount of loss. After preparing a
marketing analysis, a marketing plan is created
in attempt to re-sale the home at either wholesale or retail.
Once the home is resold, new paperwork, title,
and a contract are prepared.
4. Information Systems
Overview
Origen's IT Department (Data Center) is located in Glen Allen, Virginia.
The IT departmental efforts are focused around three objectives:
Providing real-time, high quality support to business operations
through the Origen Help Desk
Development or enhancement of systems
Evaluating and recommending implementation of new technology

Customer Support
The help desk supports Origen users by providing comprehensive assistance
on any systems issue an employee is
experiencing. This includes issues related to networking, email,
telephones, in-house applications, third party
applications, and general systems questions. Issues are received
and entered as  tickets  into tracking software
purchased from Network Associates, Inc. The help desk consists of
three levels of help, with the second and
third levels providing increasing levels of expertise as may be
needed to solve a users problem. The majority
of tickets are resolved at the first level. Tickets of a project
or enhancement nature are forwarded to
management for inclusion on the Origen project list for future
consideration and analysis, thereby ensuring
systems staff continue to work on only those projects approved
by management. Reporting is available from
the help desk tracking software, which allows management the ability
to monitor the timeliness of responses,
as well as the satisfaction of users regarding the resolution of their ticket.
Technology
To remain competitive and identify opportunities to improve Origen systems,
the technology department devotes
significant resources to researching the cost-effectiveness and viability
of new technology. In addition,
existing systems, development tools, and processes within the
Origen are continually evaluated to identify opportunities for increased
efficiency and other improvements. Once an opportunity is identified, a
proposal for action is developed and submitted to the Origen Systems
Committee for review. The committee
then makes a determination whether or not to pursue the opportunity.
If a proposal is accepted, action
is scheduled and project resources are allocated in the same way as
other systems projects.
System Architecture
Windows 2000 Servers Windows NT Servers Windows 2000 Workstations
Citrix MetaFrame Servers Local Area
Network Frame Relay WAN [private] ISDN [backup to Frame Relay]
Microsoft Exchange Nortel 81C Phone
System Microsoft SQL Server 2000
Applications by Business Line
Business Line Application Service Vendor/Developer Origination
Polaris Origination Origen CRS1 Credit
Retrieval Interface Origen
1 Credit Reporting System

Portal TNG Credit Scoring Origen TLH Mortgage Originations
EllieMae ERS2 Production Reporting Origen
Servicing MortgageWare Servicing and Collections Interlinq
Concerto Contact and Call Management Concerto
Servicing Reports Servicing Reports Origen Imaging Loan
Document Imaging System Origen Document Tracking
Loan Document Tracking System Origen Remarketing DRS Remarketing
Analysis, cash management, and sales
tracking Origen ERS Repossession Reporting Origen Systems Rational
Analyst Studio Development Lifecycle
Management Rational Software Visual Sourcesafe Version Control,
Software Security Microsoft Borland
Delphi Application Development Borland Procarta Process/Procedure
Development Procarta
Application Descriptions
Loan Servicing Applications
MortgageWare. MortgageWare is a third party application that
is used to perform the loan servicing functions,
and is called the MortgageWare Loan Servicing System. The system
is a client server design, using Microsoft
SQL Server 2000 for database storage and management functions,
and Windows 2000 for the workstations. Release
5.6 is currently in production.
MortgageWare Loan Servicing is a full-featured system that allows
for loan setup, customer service,
collections, escrow processing, payment processing and ARM processing.
There are several interfaces
to the loan servicing system including a daily interface that
automatically adds newly funded loans
from Polaris, posts lockbox payments, and posts payments made
via Western Union Quick Collect.
ContactPro. Origen uses ContactPro, developed by Concerto, for
outbound dialing, Integrated Voice
Response (IVR), and blended campaign management. Origen implemented
this system in the fall of 2002.
Initial implementation included integrating MortgageWare with outbound
dialing campaigns, and implementing
IVR scripts.
2 Enterprise Reporting System

Decision Support and Management Reporting
The decision support system for Origen is called the Enterprise
Reporting System("ERS"). ERS is a
distributed application that provides server based reporting to
all Origen personnel in all lines
of business. Users utilize the client to view listings of available
reports, specify customized versions
using filters and criteria, and store the versions for easy re-use.
When a report is ordered, the server
module runs the report or data request, and delivers the report back
to the client via several delivery
channels, including direct to client, email, or Internet, and in
delivery formats that include RPT,
MS Excel, RTF, and PDF.
Databases
Origen uses Microsoft SQL Server 2000 for all database storage
and management functions. Origen believes
SQL Server provides excellent performance, cost effectiveness,
and replication/backup capabilities.
Origen also utilizes the Analysis Services functionality within
Microsoft SQL Sever 2000 for the
development and deployment of data warehouse capabilities.
Proclarity is the front-end tool used to
access custom data warehouse cubes and perform online analytical processing.
Development and Change Control Procedures
Development
Projects are assigned by management and follow a pre-defined
process encompassing the full life cycle
of development thru implementation to guarantee a quality release
and a quality product. Each month,
corporate management meets to discuss the status of systems
 projects, discuss new requests for work, and
allocate or re-allocate resources as needs dictate. Management
is kept abreast of the progress of systems
by a project list distributed prior to each meeting, and periodically
between meetings. Once work has
been approved, project managers and senior programmer analysts are
 assigned to work with the responsible
business resources to begin the analysis phase of each project.
Requirements and specifications are then
developed, and once approved, the design phase of the project begins.
Proposals outlining possible
solutions are developed by systems, and reviewed and approved by the
business resources prior to the
beginning of work. Deliverables are then identified, and important
milestones identified and scheduled
for review. At this stage, development commences, using the development
procedures and tools approved
for the department. Information on development standards,
approved tools, and processes is available
on the Origen Intranet for use by systems personnel. Once
development has been completed, testing is
performed by developers, help desk personnel, and end-users
to ensure the resulting product satisfies
the requirements and specifications, as well as conforms
to the standards of the department. Finally,
documentation is developed as needed, and the project is
released into production.
Change Control Procedures
The majority of applications used at Origen are custom,
in-house developments. Because of this, source
code control and safety is critical. Origen uses Microsoft
Visual SourceSafe 6.0 for software source
code version control. MS Visual SourceSafe provides
Origen Financial, L.L.C. 2003 Service Auditor's Report on
Loan Processing Page 18
version functionality, integrated security with Microsoft
Windows 2000, checkout/check in functions,
and the ability to compare, search, merge, and report on
multiple versions.
General Information Systems Security Controls

Security Policy/Procedure Documents
General information systems security controls operating within
the framework of documented policies and
procedures are as follows:
general information systems security policies,
physical and logical access controls,
userid/password policies,
remote access policies,
 acceptable use policies,
 e-mail policies,
 backup and recovery policies/procedures,
 disaster recovery and/or business continuity plans,
 system development life cycle methodology for in-house software
development,
 change control management.
An Information Assurance Specialist is responsible for
assuring that IT security compliance is met
at all times. The position is responsible for maintaining,
updating, reevaluating and rewriting IT
security policies and procedures.
Computer Usage Guidelines
Various previously stated IT security policy/procedures
are in place. Additional policies include
the following:
 Software Usage: Users are not allowed to install software
on their PCs without appropriate approvals
from the IT department.
 Acceptable Use Policy: The employee handbook has a section
for the acceptable use of Origen equipment,
which also contains the e-mail policy as well.
 User Account Rules:
 Accounts are automatically locked out after a specific number
of unsuccessful login attempts.
o Each user is given a unique user ID and is forced to
change their network password on a scheduled basis.
Microsoft Security Update Service ("SUS") has been deployed on
the network for the centralized distribution
of security updates on Origen's network. Management reviews
each security update and those that are
applicable are automatically pushed out to all network machines.
Physical Security
Electronic key cards control physical access to Origen IT facilities.
 Access to the computer rooms
and data centers in both Texas and Virginia is restricted to
authorized individuals. The main data
center in the Virginia office is controlled by a combination
lock on the door. The server room at the
Texas facility is controlled with an electronic
Origen Financial, L.L.C. 2003 Service Auditor's Report on
 Loan Processing Page 19
key card. A similar electronic key card like that is used
 in Texas controls the computer room in the
Michigan office.
Environmental Security
Fire extinguishers are located throughout the office complex
in Virginia and Texas. Fire and smoke
detectors are located in the office complexes and are directly
connected to local fire departments.
All hardware devices are rack mounted.
The following environmental controls are also in place in the
computer/server rooms:
 Virginia (primary data center) Liebert 50KVa UPS/battery
 for backup power. This device provides
enough power to run the Virginia server room for approximately
 three hours. A Liebert 15-ton
downflow-type of air conditioner is in place with a nine inch
 raised floor. The AC unit has two 7.5-ton
motors, so it is still functional in the event of one motor
 going bad.
 Texas  Ceiling mounted 1.5 ton Liebert AC unit. Rack mounted
UPS/batteries for each server cabinet.
The server room in Texas is also tied into the building generator,
 so the room could be powered indefinitely.
B. Overview of Internal Control Environment.
Remote Access
Internal Origen employees have the following remote access capabilities:
 Dialup  A Max4000 Ascend access device is used by Origen
employees for remote access. A remote account
and password is required for network access. The dialup account
and password are different from their
network account and password.
 Direct Citrix over the Internet  For users with Internet
 connections, Citrix can be used to connect
directly over the Internet. Citrix is configured to use 128-bit
security with this method.
Outlook Web Access (OWA) For users needing e-mail, OWA is
 used. Users must have their own Internet
connection. They can then browse to the URL using an HTTPS connection.
Intrusion Detection/Attack Penetration Tests
Origen is currently testing an enterprise-side intrusion detection
system using SNORT, with logging and
reporting to be done with MySQL. The plan is to have the network
 sensors (DMZ and internal network)
in place by April, 2003.
Periodically, an external and internal security penetration test
is performed on Origen's network.
A vendor (Strategic Technologies) performed an external security
penetration test and network vulnerability
assessment during 2002. The network security issues identified by
the vendor have been addressed by IS management.
Backups
Multiple backup jobs run nightly to ensure that critical applications
and data are appropriately backed up
for recovery purposes. Computer Associates Arcserve 2000 is

used to backup the network. Tapes follow a grandfather-father-son rotation
and all tapes are stored off-site
in a secure facility. In addition to the main backup process,
a disaster recovery backup is performed of
specific critical directories and files.
The disaster recovery backup tapes are also rotated off-site on
a daily basis.
Disaster Recovery
The Origen IT Servicing Business Continuity Plan is designed
to provide immediate response and subsequent
recovery from any unplanned business interruption, such as a
loss of a critical service
(computer processing, telecommunications), a loss of building
access (contamination, etc.) or physical
facility catastrophe (fire, sabotage, etc.). A centralized
group, referred to as the Incident Management
Team ("IMT"), will oversee response and recovery activities,
as well as support the recovery of affected
operations.
The Minimum Acceptable Recovery Configuration ("MARC") is a
listing of the minimum recovery resources
required by a recovering business unit over time. Resources
include space for personnel, PC's, and telephones.
This information will be used by the IMT to ensure that
strategies are developed for the acquisition of
essential resources at time of disaster.
The IMT provides overall coordination of response and recovery
support activities. At time of incident,
the IMT evaluates which response and recovery actions should be
invoked based on the severity of the
incident. As members of the IMT, designated personnel
will provide centralized support to affected
departments in acquiring necessary recovery resources
(e.g., office space, PC's, telephones). The
IMT is comprised of Business Continuity Team members from all
areas of the business.
The Incident Manager is a member of the IMT and is designated
by the IMT as the central point of
contact for an incident. The Incident Manager will be responsible
for ensuring that effective
communication between all teams takes place and will ensure that
the appropriate teams and resources
are activated as needed. The Incident Manger will be responsible
for ensuring that all IMT members
are kept informed of incident status.
The Initial Response Team ("IRT") consists of those members of the
Management Team who will assemble
at the disaster site for initial assessment of the situation.
Based upon the severity of the incident,
the IRT will assemble the full Management Team, who will then
determine the level of plan activation,
and communicate their findings and event status to the IMT.
The Incident Command Center is a local or off-premise meeting area
from which initial assessment,
evaluation, coordination and decision making activities take place.
The Incident Command Center houses
the IMT during the initial phases of response and recovery.
The Data Center Recovery Plan is designed to provide immediate response
and subsequent recovery from any
unplanned computing services interruption, such as a loss of utility
 services, building evacuation, or
catastrophic event such as a major fire.
The IRT is a subset of the Data Center Management Recovery Team.
This team is the first group notified
of an incident affecting computer services. They will perform initial
assessment activities, and if
necessary activate the entire Data Center Management Recovery Team.
The Data Center Management Recovery Team provides the overall coordination
of response and recovery
support activities. Once an incident occurs, the Data Center Management
Recovery Team evaluates which
response and recovery actions should be invoked based on the severity
of the incident. As members of
the IT Management Recovery Team, designated personnel will provide
centralized support to affected
departments in acquiring necessary recovery
 resources (e.g., office space, PC's, telephones).
In the event of an incident, the Data Center
Recovery Team will activate designated support personnel
who will provide support during response and
recovery activities (e.g., Corporate Communications to handle
the media, Human Resources to notify family
members in the event personnel are injured). Support areas'
responsibilities and tasks are documented within
the Data Center Management Recovery Team Plan.
The Data Center Recovery Team is activated by
the IRT following detection of an incident, which could
potentially interrupt business. Each recovery
team has representation on the IRT. This team will implement
recovery strategies and procedures, defined in
this recovery plan, as approved by the Data Center Recovery Team.
Disaster Recovery Tests were performed on July 12, 2002,
November 26, 2001, and June 19, 2001. Upon the
completion of each disaster recovery test, a summary
memo was created for management that stated the
test goals, overall results of the tests and
recommendations for the next test. .
Norton Antivirus
Norton Antivirus ("NAV") is used on the file servers,
 e-mail servers, and all local workstations. NAV
loads automatically on any new PC that joins the
domain and cannot be uninstalled without a password.
NAV runs in auto-protect mode and the latest virus
definitions are automatically downloaded from a
centralized console server on the Internet. The
 virus definitions are then automatically distributed
to each PC, server and e-mail server from the centralized
 console.
Origen Financial, L.L.C. 2003 Service Auditor's Report
 on Loan Processing Page 22
Control # Controls Specified By Origen Test Performed
by Service
Auditor Results of Testing 1.1 New loans are set up
in the Loan Servicing System and a percentage is
audited monthly to verify accuracy of information.
Reviewed a statistical sample of new loans in the
servicing system, and verified that all information
is correct. Reviewed: (1)"Funded Loans Report" for
 Manufactured Homes from ERS
(2) "Funded Loans Report" for Land Homes from TLH
(3) "Total New Loans Report"
-Balanced a sample of loans from (3)-Total Report
to (1) and (2) reports, and verified loan information
accuracy in MortgageWare system under the Customer
 Service tab.
Reviewed two randomly selected months of internal
audit work papers, as performed by the Servicing
Compliance Manager position for new loans in the
Loan Servicing System. No relevant exceptions were noted.
No relevant exceptions were noted.

No relevant exceptions were noted. 1.2 All files
 are inventoried for document contents, and imaged.
Verified a sample of loan files and reviewed
corresponding imaged documents on the Imaging System. No
relevant exceptions were noted.
III. Control Objectives
(A) Loan Servicing
1. Controls should provide reasonable assurance
that new loan information is properly recorded and maintained.
Origen Financial, L.L.C. 2003 Service Auditor's
Report on Loan Processing Page 23
1.3 Original loan files are retained offsite by
a custodian. Verified receipt confirmations of loan
files obtained by the custodian.
Reviewed custodian loan receipt confirmation documents
"Investor Submission Reports" for the past
6 months. No relevant exceptions were noted.
No relevant exceptions were noted.
1.4 Loan term changes are verified before they are
processed. (i.e. extensions) Verified a random
sample of loan extensions from the Modifications Report
on MortgageWare, noting record of manager
approval and customer authorization in the corresponding
Imaged files for each loan. No relevant
exceptions were noted. 1.5 Coupon book requests are
 generated upon completion of new loan setup, and
orders are sent once a week.
Verified that coupon book requests were generated for
 a random sample of loans through the MortgageWare
system, customer service tab (System shows dates coupon
book requests were generated)
Reviewed the "Coupons Ordered Report" from the ERS system,
 and the "Coupon Production Report" from the
vendor, NCP Solutions verifying that requests from
 MortgageWare are received and processed. No relevant
exceptions were noted.
No relevant exceptions were noted.
Origen Financial, L.L.C. 2003 Service Auditor's Report
on Loan Processing Page 24
2. Controls should provide reasonable assurance that all
loan information is properly reported to the
credit bureaus on a timely basis.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 2.1 Origen reports to the credit
 bureau agencies (TransUnion and Equifax) on
all loans on a monthly basis through electronic transmission.
 Reviewed a sample of loans in MortgageWare
Event Manager, verifying that information is sent to the Credit
 Bureaus on a monthly basis. No relevant
exceptions were noted.
2.2 A copy of all credit bureau dispute forms, deletions,
and updates, including any other correspondence
with the Credit Bureau, is forwarded to Imaging for scanning.
Reviewed a random sample of loans with credit
disputes. All changes are done through the E-Oscar system,
which is the online Credit Bureau reporting
system. Verified a sample of loans that were updated/modified/disputed
through the E-Oscar system, which
had corresponding imaged files in MortgageWare. No relevant
 exceptions were noted.
3. Controls should provide reasonable assurance that collection
information is properly reported to the
credit bureaus on a timely basis.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 3.1 All (collection) information must
 be documented in the Comments section
of the Servicing System. Viewed a random sample of loans in
collections, and verified that the comments
section of the account in the Servicing System was appropriately documented.
No relevant exceptions were noted.

3.2 Once a loan becomes sixty days delinquent, the collector must
send a Notice of Default to the borrower.
Verified that Notice of Default letters were used. Identified loans
that were delinquent and selected a
sample to compare to the Default Letter file. No relevant exceptions
were noted.

4. Controls should provide reasonable assurance that loan payoff
information is properly reported and
payoff letters are generated correctly.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 4.1 Release of liens are held for 30
days to ensure that funds are collectible;
unless the specific state dictates certain filing deadlines or the
customer requests an immediate release
of lien and is paying with certified funds.
Verified a random sample of release of lien loans in the Polaris
 Document Request System. The servicing
notes section details all information on the payoff, and
shows the date the release of lien was sent along
with a USPS tracking number.
ERS Release of Lien report shows Loan ID, Payoff Date,
Paid-In-Full Column, and Completed Date.
No relevant exceptions were noted. 4.2 Payoff statements
are generated to inform the borrower the
total amounts due to pay off the loan on a given date.
Verified a random sample of paid off loans
collateral imaged files, ensuring that Payoff statements
were generated and mailed with the correct
payoff amounts from the MortgageWare Payment Balancing
Report. No relevant exceptions were noted. 4.3
Total payoffs are entered into the system upon receipt.
Verified that 'receipt of payoffs' are properly
applied in the system by observing the date of payoff and
amount on collateral source files back to the
system. No relevant exceptions were noted.

5. Controls should provide reasonable assurance that the insurance
information is properly recorded.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 5.1 Real estate tax information is monitored
 by an outsourced tracking service.
The tax information is entered on the servicing system on all escrow
loans and subsequently verified.
Viewed record of verification of input data in the MortgageWare
 System comparing to source documents
for a randomly selected sample of escrowed loans.
No relevant exceptions were noted. 5.2 Insurance information is
entered into the MortgageWare system,
and subsequently verified. Viewed insurance information comparing
to source documents for a random sample
of escrowed loans. Verified for accuracy. No relevant exceptions were noted.
6. Controls should provide reasonable assurance that the escrow
information is properly recorded.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 6.1 Escrow analysis is performed correctly,
and information that is entered in
the MortgageWare servicing system is subsequently verified. Reviewed
a random sample of hard-copy escrow
file documents that are kept for each escrowed loan, and verified
for accuracy. No relevant exceptions were
noted. 6.2 Coupon books are generated at the time of the analysis.
Verified that coupon books were generated
from MortgageWare requests by reviewing the Coupons Ordered
Report' from MortgageWare against the
Coupon Production Report' from the vendor, NCP Solutions.
No relevant exceptions were noted. 6.3 An
initial aggregate analysis is prepared
Verified preparation and accuracy of No relevant exceptions were

for each borrower only on escrowed loans. initial aggregate analysis
for escrowed
loans by reviewing collateral source file documents, noting the Initial
Escrow Account Disclosure Statement.
noted.
6.4 Any escrow shortages identified in aggregate analysis are prorated
and set up to be collected over the
next 12-month period. Reviewed annual analysis procedure to determine
escrow shortages, verifying accuracy
of analysis on the MortgageWare System.
Verified a sample of loans online with the Customer Service Manager.

Verified that any escrow shortages are collected and properly recorded
by reviewing a randomly selected
sample of paper escrow files in the Customer Service area. No relevant
exceptions were noted.
No relevant exceptions were noted.
No relevant exceptions were noted. 6.5 Any escrow surplus is refunded
to the borrower in compliance with
agreed upon procedures.
Reviewed annual analysis procedure to determine escrow surplus,
verifying accuracy of analysis.
Verified that escrow surpluses are refunded and recorded within
the designated time frame by online observation,
and review of check copies in the Customer Service files.
No relevant exceptions were noted.
No relevant exceptions were noted.

7. Controls should provide reasonable assurance that the duties
of Origen personnel are adequately described and segregated.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 7.1 Origen has a defined organization structure.
Verify job descriptions are
documented and adequately describe the position.
Obtain an organization chart and in conjunction with the review of j
ob descriptions, ensure adequate
segregation of duties is in place. No relevant exceptions were noted.
No relevant exceptions noted.
8. Controls should provide reasonable assurance that all payments
are processed in accordance with
written policies and procedures.
Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 8.1 Mail is processed and a batch tape
is run to compute the amount of
payments received. Verified that mail is processed according to
 policy/procedure documents by interviewing
the mail clerk and staff in various areas verifying that all mail
is distributed by 10:30 am daily.
Verified preparation of batch tape, correct batches (groups of 30)
and MortgageWare balance reports
for the past 4 by reviewing past report copies stored in binders
filed in the Payment Processing area.
 No relevant exceptions were noted.
No relevant exceptions were noted.

8.2Origen's payments are posted through BankOne's Lockbox service,
Phone Pay, Western Union -Quick Collect,
 and in-house payments. Verified that all payments are properly
recorded and that totals are accurate:
-Compared the past 4 months, BankOne lockbox reports against the
batch totals on the "Bank Activity Report"
on the servicing system.
-Verified that the total of the Phone Pay report matched the report
that was transmitted by Payment Processing.
-Verified the accuracy of Western Union's "quick collect" tape which
is electronically submitted to Origen to be
 downloaded into the Servicing System.
Verified that the Daily Work Report balanced back to the Daily
Balances Transmittal Report and the Bank Account
Activity Report from MortgageWare for all payment types (Lockbox,
in-house, Phone pay, and quick collect).
No relevant exceptions were noted.
No relevant exceptions were noted.
No relevant exceptions were noted.
No relevant exceptions were noted.
9. Controls should provide reasonable assurance that only valid data
is entered into the system and is supported
by the appropriate documentation.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 9.1 MortgageWare application prohibits the
entry of invalid data. Attempt to enter
 invalid data into various fields on various screens (ex. No relevant
exceptions were noted.

Name in the account number field, etc).
(B) Operations
10. Controls should provide reasonable assurance that the policies and
procedures, both new and revised, require
formal review and approval by senior management before implementation.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 10.1 All new or revised procedures shall require
signature approval from the Managers
of the affected departments. Reviewed a judgmental sample of new and revised
procedures, which had appropriate signatures.
No relevant exceptions were noted. 10.2 Each approved procedure should
indicate the effective date of the procedure.
 Review a randomly selected sample of approved procedures, noting effective
date in the header of approved procedures
 on the Intranet. No relevant exceptions were noted. 10.3 Approved procedures
shall be included in the Policies and
 Procedure manual on the intranet website within five business days of the
approval date. Verified a random sample
of approved procedures, noting that manager sign-off date
and date entered onto the Intranet were within 5 days. Most
procedures were entered the same day as approval. No relevant
exceptions were noted.
11. Controls should provide reasonable assurance that all
incoming mail is routed through a central control.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 11.1 The Mail Department sorts
all mail and identifies incoming payments that are distributed
directly to the Payment Processing Department. Verified
that all payment processing mail is taken to the secure area
in Payment Processing through observation and interviews
with the mail clerk and the Payment Proc. Mgr No relevant
exceptions were noted.

11.2 Coordination for mail receipt and distribution shall be completed
promptly on the same day as received. Reviewed
 and observed mailroom procedures, noting that all mail is distributed
by 10am. Verified with various groups including
 payment processing, collections, and customer service that they
receive their mail each day by 10am.
Also noted at 3pm that no mail was in the "Outgoing Mail" boxes
in the mailroom. No relevant exceptions were noted.
 11.3 Accurate mail records for bulk mail shall be maintained
for audit purposes. Viewed bulk mail records that are
 maintained in a binder in the mailroom. They have been retained
since they started in Oct 2002. Verified accuracy
 of bulk mail binder, noting no exceptions. According to US
Postal Service, Bulk Mail Coding Accuracy Support System
Summary Reports (CASS) must be on file, on-site for one year.
No relevant exceptions were noted.
12. Controls should provide reasonable assurance that credit
authorization levels have been set with prudent consideration
 of experience levels. Authorization matrixes are reviewed annually.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 12.1 Credit authorization levels
have been set with prudent consideration of experience
 levels. Authorization matrixes are reviewed annually.
Verified that credit authorization matrixes are appropriate
for each area in scope (Loan Services, Default Services,
 Loss Mitigation, and Remarketing) based on experience levels,
and sign off No relevant exceptions were noted.

approval by senior management.
13. Controls should provide reasonable assurance that critical
correspondence or issues that have legal implications
 are routed to the Legal Department immediately.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 13.1 All legal requests are routed
through the Operations Department where they are logged
and tracked for resolution. Verified legal request tracking log
from Jan 2003 current with the Operations Dept
 Servicing Compliance Manager.
Reviewed email reference documents and documents on the shared
drive for the legal request-tracking log. No relevant
 exceptions were noted.
No relevant exceptions were noted.
( C) Loss Mitigation
14. Controls should provide reasonable assurance that adequate
tracking and reporting of accounts is considered
 in the area.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 14.1 All loans in the loss mitigation
area must satisfy certain criteria before being
 allowed. The general guidelines are as follows:
 Borrower must be experiencing or have experienced financial hardship.
 Borrower must be delinquent in their monthly payments, or in danger
of imminent default.
 Borrower must complete the required
Reviewed a random sample of Loss Mitigation loans online in MortgageWare
 Collections verifying that all Loss
 Mitigation loans satisfy Origen's policy. No relevant exceptions were noted.

documentation.
 Borrower must be cooperative and allow access to the interior of the
collateral for a home inspection, if needed.

14.2 In the Loss Mitigation area, new modification/refinance programs
must be documented on the Servicing System and
 a Modification Approval Form must be processed including the reason for
account delinquency and proof of long-term
or permanent change of borrower's condition. A signed Credit Application,
appropriate loan agreements and required
 title documents must be obtained prior to processing the
modification/refinance. Verified files for the sample of
 loans tested in the previous control step. All loans had applicable
reference files that included Modification Approval
 Forms, Signed Credit Applications, and other forms from the Loss
Mitigation packet. No relevant exceptions were noted.
 14.3 Modification/Refinance programs must be reviewed monthly by
an independent function that reports directly to the
 Senior Vice President of Servicing Operations and Executive Vice
President of Origen Financial L.L.C.
Verified a sample of modification/refinance loan approvals noting
signature approval by VP Origen. Also, reviewed
modification/refinance loan approval audit plan and recent audit
notes for areas such as Loss Mitigation with the
Servicing Compliance Manager. No relevant exceptions were noted.
15. Controls should provide reasonable assurance that the loss mitigation
plans in place provide a high probability
of resolving defaults, prevent repossessions, and maintain a revenue flow.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 15.1 Loss Mitigation uses the following
Key Areas to track performance:
Reviewed the ERS (Daily Que Reports) for the three Loss Mitigation
Specialists. The report listed all No relevant
exceptions were noted.

Quantity
No. of Referrals
No. of Final Approvals
No. of Funded Approvals
Quality
No. of Re-looks
Scores on funded loans
Post-funding audits
Time
Lapsed time between Initial Referral and Final Decision
Lapsed time between Final Approval and Closing/Funding accounts
 for the respective individual, type of account,
 date initiated, and stage of account. The Loss Mitigation
supervisor runs this report weekly along with the Workflow
Activity Report and the PIVOT report to monitor and track
the performance of the Loss Mitigation Specialists.
(D) Remarketing
16. Controls should provide reasonable assurance that all
repossessions are processed according to legal guidelines.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 16.1 All remarketing, repossessed
accounts are updated, maintained, and tracked on the
delinquency and repossession system (DRS). Reviewed a random
sample of repossessed accounts on the Delinquency and
 Repossession system for accuracy.
No relevant exceptions were noted. 16.2 At Origen, once a
home is confirmed vacant, the inspection and condition
report along with the "Repossession Set Up Request" shall
be forwarded to the Remarketing Department from the Default
 Verified a random sample of "Repossession Set Up Request
Forms" for loans on the Remarketing Group Inventory Report.
No relevant exceptions were noted.
Origen Financial, L.L.C. 2003 Service Auditor's Report on
Loan Processing Page 35
Services Department.
Also, verified that each Remarketing Loan has an accompanying
file with required documentation including the
original contract, reason for repossession, etc)
No relevant exceptions were noted. 16.3 Remarketing Department
will review the "Repossession Set Up Request"
 to determine that all appropriate authorizations are present
on the form. Once verified, the remarketing process
 begins. Verified appropriate authorizations on "Repossession
Set Up Request Forms" forms from the sample listed
 above. No relevant exceptions were noted.
17. Controls should provide reasonable assurance that deficiency
balances (after liquidation) are accurate
and properly recorded.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 17.1 All deficiency balances after
liquidation are entered into the MortgageWare
 Servicing System including comments. Viewed a random sample of
loans with deficiency balances (after liquidation)
 for accuracy, verifying the MortgageWare system against the
Daily Work Report for Repo Charge-Offs. No relevant
 exceptions were noted.

I/T Controls
(E) Systems Development and Maintenance
18. Controls should provide reasonable assurance that the development
and implementation of new applications
and changes made to existing applications are authorized, tested and
documented.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 18.1 Application development and/or change
procedures are documented/maintained in
 the System Overview document. Reviewed IT policies and
procedures to ensure procedures have been documented
for system development methodologies, system documentation
and application software change controls.
Also inquired of IT staff the current procedures in place to
validate the documented policies and procedures.
Development standards guidelines are documented for developers
and Change Control policies are documented for
database changes.
However, no formal change control documentation exists for
application or system development changes and
there are no procedures in place to ensure development
standards are being followed. 18.2 The IT dept manages
change control by tracking all updates, changes, etc in MS. Visual
SourceSafe Verify MS. Visual SourceSafe is
being used, and all changes are being properly tracked.
Verified supporting documentation is in place for software changes.
No exceptions noted.
No exceptions noted.

(F) Logical Assess Controls
19. Controls should provide reasonable assurance that all transactions
are authorized by appropriate client
 employees and are supported by proper documentation.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 19.1 Policies have been established to
establish new user accounts, as well as to
revoke user access when no longer with Origen. Reviewed new user
account policies and procedures to ensure
 they are complete and current.
Verified selected terminated employees no longer have access to
Origen's network. No relevant exceptions were
noted
No relevant exceptions were noted. 19.2 Management approval of a
New User Setup Form is required to establish
a new account and for the assignment of the appropriate security levels.
Reviewed documented new hire procedures
and inquired of IT staff the procedures to establish new user access,
based upon the New User Setup Form.
Evidenced completed and approved New User Setup Forms for new employees
and that the security levels assigned were
correct. No relevant exceptions were noted.
No relevant exceptions were noted.
20. Controls should provide reasonable assurance that only authorized
personnel have access to appropriate system files.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 20.1 Windows operating system options
are activated to ensure that the software
identifies and authenticates users through Observed users log into
the network and Loan Processing applications
and that in all cases, an authorized user ID and No relevant exceptions
were noted.

the use of an access identifier and password. password were required.
Observe administrators log into core network devices and that in all cases;
an authorized user ID and password were required.
No relevant exceptions were noted. 20.2 Network user account parameters are
in compliance with Origen policy:
 Password minimum length: 6 characters
 Password must contain alphanumeric or special characters
 Password expiration: 90 days
 Password uniqueness: xx
 Account lockout enabled after 3 unsuccessful logon attempts
 Account lockout duration is appropriate.
The Password Policy Enforcer tool is used to enforce compliance with
Origen policy. Inquired of the network
administrator the operating system parameters and observed the options
in effect to authenticate users and the
 corresponding security settings for:
 Minimum password length
 Use of special characters
 Password expiration
 Password uniqueness
 Number of allowed invalid password attempts prior to lockout
Verified that password parameters used by the Password Policy Enforcer
tool correspond with the documented policy.
 No relevant exceptions were noted.
No relevant exceptions were noted.
20.3 Access to Loan Servicing production files and data on the
production servers is adequately controlled so
 that only authorized users in IT have edit access Observed on-line
with network engineer, user and group access
 rights to production servers and application directories, so to
ensure only authorized users have access to
production files. Access rights to key application directories including
access to the MortgageWare and Polaris
directories contain the group "everyone" with update access to
tested directories. 20.4 Domain administrator
access is limited to specific personnel based upon job function.
View domain administrator group setting to ensure
group is limited to appropriate personnel.
All IT staff have domain administrator rights.


20.5 Virus protection software is installed on all network servers
and workstations and virus definition
files are updated on a frequent and consistent basis. Verify through
observation that virus protection software
is installed on all network servers and workstations.
Verify through observation that virus definition files are updated
on a frequent and consistent basis. No
 relevant exceptions were noted.
No relevant exceptions were noted.
21. Controls should provide reasonable assurance that data
transmissions between Origen and its user
organizations are complete, accurate, and secured.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 21.1 External access to Origen's network
is controlled through an industry standard
 firewall and a corresponding set of firewall rules are configured
to only allow authorized users to
access the network Reviewed firewall rules with network engineer to
ensure all rules were needed for business
 purposes and no unnecessary ports were being used. No relevant
exceptions were noted. 21.2 Ensure that FTP
 transmission between Origen and specified partners is limited and
requires authorization. Review specific
firewall rules to ensure that ftp traffic is limited to specific
IP addresses and logon authorization is needed
to perform FTP transmission. No relevant exceptions were noted.
22. Controls should provide reasonable assurance that only authorized
employees have access to the system for
loan servicing functions.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 22.1 IT Policies and Procedures document
relevant security controls and procedures.
Reviewed IT Policies and Procedures for completeness and accuracy and
to ensure documented security policies are
 No relevant exceptions were noted

in place. 22.2 All Loan Servicing application security levels are
assigned to authorized users at Origen, based
 upon business needs. Reviewed a random sample of users across job
functions for access to Loan Servicing applications
 and verified security levels is commensurate with the employee's
position for the following:
  MortgageWare
  DRS
  Polaris
  ERS
  Imaging
No relevant exceptions were noted.
(G) Contingency Planning
23. Controls should provide reasonable assurance that data in mission
critical applications is appropriately
backed up and that backup tapes are stored in a secure off-site storage
facility.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 23.1 All mission critical computer files
and programs are backed up to tape and
retained for specified periods of time to prevent loss of data due to
a disaster to the server room. Reviewed
 Origen "Backup Policy and Procedures" to ensure completeness.
Reviewed documented backup policy and procedures for the data center
to ensure retention policy corresponded
 with backup requirements.
Reviewed current backup job schedule to verify mission critical files
are being backed up to tape. No relevant
 exceptions were noted.
No relevant exceptions were noted.
No relevant exceptions were noted. 23.2
Backup tapes are stored off-site and Reviewed backup receipt and log
No relevant exceptions were

rotated on a grandfather-father-son basis: daily tapes: 6 days; weekly tapes:
5 weeks; monthly tapes: 1 year;
 End of year: indefinite. provided by offsite storage facility to ensure
retention policy corresponded with
 backup requirements.
Inquired of IT staff the frequency and success and/or failure of data
restores.
Inquired of IT staff if backup tapes are tested on a scheduled basis to
ensure data readability and recoverability.
Reviewed contract with off-site storage facility to ensure it is current.
noted.
Backup restores are performed based on user requests. All data restores
have been successful.
Backup tapes are not tested.
No relevant exceptions were noted.
(H) Physical Security and Environmental Controls
24. Controls should provide reasonable assurance that access to the server
room, telecommunication rooms
and surrounding facilities are restricted to authorized personnel and that
environmental controls are in place
 to protect physical assets.
Control # Controls Specified By Origen Test Performed by Service
Auditor Results of Testing 24.1 Electronic key cards control physical
access to Origen facilities. Observe
key cards restrict physical access to Origen office and only appropriate,
authorized individuals have key cards.
No relevant exceptions were noted. 24.2 Access to the server rooms is
limited, based upon business needs. Observe
electronic key cards restrict physical access to TX server room.
Observed physical access to VA server room is restricted by a combination
door lock. No relevant exceptions
 were noted.
No relevant exceptions were noted.

Obtained a listing of employees who are authorized to access the server
room and inspected for
appropriateness of the employee's access
All IT employees at the data center location have access to the server room.
No visitor log is kept of visitors for the server room, but all visitors
must be escorted while in the server
room. 24.3 Fire alarms, fire and smoke sensors, water sprinkler system and
fire extinguishers are in place
throughout the facility. Performed a walkthrough of the Origen
facilities and observed theenvironmental controls
that are installed and operational. No relevant exceptions were
 noted. 24.4 Fire and smoke sensors, as well as
 hand-held fire extinguishers protect the server room. Performed
a walkthrough of the Origen server room and
observed the environmental controls that are installed and operational.
No hand-held fire extinguishers are present
 in the server room, but other environmental controls present
included raised floors and a dedicated A/C unit. 24.5
 Battery UPS systems regulate electrical power fluctuations and
provides for the graceful shutdown of servers in the
event of a loss of commercial power. Observed that computer
systems maintained in the server room are connected to
various battery UPS systems. No relevant exceptions were noted.

IV. Origen's Management Comments Regarding Testing Exceptions
Control # Controls Specified By Origen Results of Testing Origen
 Management's Comments 18.1 Application development
 and/or change procedures are documented/maintained in the System
Overview document. Development standards guidelines
are documented for developers and Change Control policies are
documented for database changes.
No formal change control documentation exists for application
or system development changes.
Procedures are not in place to ensure development standards are
being followed. No relevant exceptions were noted.
IT policies and procedures have been developed and implemented
on 04/10/03 for:
 Development Standards and Code Review Policy
 Software Change Control Policy.
Control # Controls Specified By Origen Results of Testing Origen
Management's Comments 20.3 Access to Loan Servicing
 production files and data on the production servers is adequately
 controlled so that only authorized users in IT have
edit access Access rights to key application directories including
access to the MortgageWare and Polaris directories
 contained the group "everyone" with update access to tested
directories. Origen's network administrators have begun
 removing "everyone" access rights for key applications including
MortgageWare and Polaris. The project is scheduled
to be completed 4/11/03.

Control # Controls Specified By Origen Results of
Testing Origen Management's Comments 20.4 Domain administrator
access is limited to specific personnel based upon
 job function. All members of IT were set up with domain
administrator rights including development groups. As
of 4/11/03, domain administrator rights have been removed
from the development group. A screen print of Domain
 Administrator Rights for "Dept_Systems_Dev" verifies the
development group has been deleted from the active
 directory folder. Management is currently researching alternative
 ways for the development group to provide support.
Control # Controls Specified By Origen Results of
Testing Origen Management's Comments 23.2 Backup tapes are stored
off-site and rotated on a grandfather-father-son basis:
daily tapes: 6 days; weekly tapes: 5 weeks; monthly tapes:
1 year; End of year: indefinite. Backup restores are
performed based on user requests, approximately 2 to 3 times
 per month. A weekly tape backup test policy was
implemented 04/10/03. All data restores and backup tape tests will
be documented in the Test Restore Log
Control # Controls Specified By Origen Results of Testing
Origen Management's Comments 24.2 Access to the server
 rooms is limited, based upon business needs.
All IT employees at the data center location have access to the server room.
No visitor log is kept of visitors in and
The server room combination lock has been changed and IT developers will
 not have unsupervised access to the server room.
Management will research various card key systems for the computer
 room to enhance monitoring capabilities.
A Data Center log has been

Origen Financial, L.L.C. 2003 Service Auditor's Report
on Loan Processing Page 45
out of the server room, but all visitors must be escorted
in the server room. created, and is being used for both
employees and visitors that enter the Data Center.
Control # Controls Specified By Origen Results of Testing
Origen Management's Comments 24.4 Fire and smoke sensors,
 as well as hand-held fire extinguishers protect the server room.
No hand-held fire extinguishers are present in the
server room, but other environmental controls present
included raised floors and a dedicated A/C unit.
Fire Extinguishers were purchased on 4/10/2003, and are mounted
in the server room.