Ginnie Mae operates as a unit of HUD and its administrative, staffing, and budgetary decisions are coordinated with HUD. Ginnie Mae is organized into five offices and relies on contractors for many aspects of its work. Contracted functions include certifying new MBS, administering payments to investors, data collection from issuers and risk analysis, Ginnie Mae servicing of defaulted loans, internal control reviews, issuer compliance reviews, and information systems management. Ginnie Mae staff responsibilities include policy and management functions and oversight of contractors. We discuss Ginnie Mae’s organization, staffing, and budget in greater detail later in this report. Ginnie Mae guarantees the performance of MBS, which are obligations of the issuers that are backed by mortgages insured or guaranteed by federal agencies, such as FHA, PIH, VA, or RHS. Ginnie Mae provides an explicit federal guarantee (full faith and credit of the United States) on these MBS, but it does not issue the MBS or originate the underlying mortgages. Rather, it relies on approved financial institutions (issuers) to pool or securitize the eligible mortgages and issue Ginnie Mae- guaranteed MBS. The issuers can service the MBS themselves or hire a third party to transmit the monthly principal and interest payments to investors. Ginnie Mae’s explicit guarantee can lower the cost of borrowing for issuers, which allows them to offer lower interest rates to mortgage borrowers. Issuers can obtain these mortgages by originating the loans or purchasing the loans from another institution. See figure 1 for an overview of Ginnie Mae securitization. Ginnie Mae’s guarantee is limited to the risk that issuers cannot make the required monthly principal and interest payments to investors. While other federal agencies already insure or guarantee the mortgages that back Ginnie Mae-guaranteed MBS, the private-sector issuers of these MBS are responsible for ensuring that investors that purchase these MBS receive monthly payments on time and in full, even if the borrower makes a late payment or defaults. Ginnie Mae issuers are responsible for making these advance payments to investors using their own funds and for recovering any losses from the federal agencies that insured or guaranteed the mortgages. If an issuer cannot ensure the timely payment of principal and interest to investors, Ginnie Mae defaults the issuer, acquires the servicing of the loans, and uses its own funds to manage the portfolio and make any necessary advances to investors. Ginnie Mae charges issuers a monthly guarantee fee, which varies depending on the product, for guaranteeing timely payment. Issuers also pay a commitment fee to Ginnie Mae each time they request authority (commitment authority) to pool mortgages into Ginnie Mae-guaranteed MBS. Investors in Ginnie Mae-guaranteed MBS face the risk that a mortgage will be removed from the MBS pool prematurely—either due to borrower default or prepayment of a loan—which reduces the amount of interest earned on the security. However, investors do not face credit risk—the possibility of loss from unpaid mortgages—because Ginnie Mae guarantees timely payment of principal and interest. Ginnie Mae has several different products. Its original MBS program, Ginnie Mae I, requires that all pools contain similar types of mortgages (such as single-family or multifamily) with similar maturities and the same interest rates. The Ginnie Mae II MBS program, which was introduced in 1983, permits pools to contain loans with differing characteristics. For example, the underlying mortgages can have varying interest rates and a pool can be created using adjustable-rate mortgages. Ginnie Mae’s Multiclass Securities Program, introduced in 1994, offers different types of structured products, including Real Estate Mortgage Investment Conduits (REMIC) and Ginnie Mae Platinum Securities. REMICs tailor the prepayment and interest rate risks associated with MBS to investors with varying investment goals. These products direct principal and interest payments from underlying MBS to classes, or tranches, with different principal balances, terms of maturity, interest rates, and other characteristics. Platinum Securities allow investors to aggregate MBS with relatively small remaining principal balances and similar characteristics into new, more liquid securities. The MBS aggregated into these structured products retain Ginnie Mae’s full faith and credit guarantee. In addition, Ginnie Mae guarantees the timely payment of principal and interest on the structured products and charges an additional fee to the financial institutions that create them. Ginnie Mae also requires that these institutions contractually agree to reimburse any costs Ginnie Mae may incur to guarantee these products. Ginnie Mae defines its mission as expanding affordable housing by linking capital markets to the nation’s housing markets. Ginnie Mae does this by serving as the dominant secondary market vehicle for government-insured or -guaranteed mortgage loan programs. Ginnie Mae’s guarantee benefits lenders, borrowers, and investors in a number of ways. First, the guarantee benefits lenders by increasing the liquidity of mortgage loans, which may lower the cost of raising funds and allow lenders to transfer the interest-rate risk of a mortgage to investors. Second, the guarantee benefits borrowers by lowering the cost of raising funds for lenders, which helps lower interest rates on mortgage loans. Finally, Ginnie Mae’s guarantee provides investors with a fixed-income security that has the same credit quality as a U.S. Treasury bond. Ginnie Mae relies on its fee revenues rather than appropriations from the general fund to pay for its operations and cover costs related to issuer defaults. However, the amount of MBS Ginnie Mae can guarantee each year is capped by its commitment authority level in HUD’s appropriation. For 2010 and 2011, Ginnie Mae was authorized each year to guarantee up to $500 billion in MBS. Ginnie Mae guarantees the timely payment of principal and interest on MBS. For budgetary purposes, Ginnie Mae and other federal agencies estimate the net lifetime costs (credit subsidy costs) of their guarantee program and include the costs to the federal government in their annual budgets. For Ginnie Mae, credit subsidy costs represent the net present value of expected cash flows over the life of the securities it guarantees, excluding administrative costs. Cash inflows consist primarily of guarantee fees charged to MBS issuers and cash outflows includes advance payments of principal and interest on delinquent mortgages underlying MBS from defaulted issuers. When estimated cash inflows exceed expected cash outflows, a program is said to have a negative credit subsidy rate. When the opposite happens, a program is said to have a positive credit subsidy rate, and therefore require appropriations to cover the estimated subsidy cost of new business. Historically, Ginnie Mae has estimated that its guarantee program would have a negative credit subsidy rate and, as a result, generate budgetary receipts for the federal government. These receipts have resulted in substantial balances in a reserve account, which is used to help cover unanticipated increases in those costs—for example, increases due to higher-than-expected issuer defaults or fraud. According to Inside Mortgage Finance data, from calendar year 2007 to 2010 Ginnie Mae’s share of the MBS market increased from nearly 5 percent to 25 percent as the total size of the secondary mortgage market declined and the role of private-label MBS issuers declined substantially. The size of the MBS market decreased from $2.16 trillion in new MBS in calendar year 2005 to $1.57 trillion in calendar year 2010, a decline of nearly one-third (see fig. 2). The overall market decline was driven by the housing downturn and increased defaults and foreclosures. This led to mortgage lenders tightening their underwriting standards and making fewer loans. Also, private-label MBS issuers faced a sharp decline in eligible loans and investor demand. As the demand for FHA and other federally insured or guaranteed mortgages grew during this time, financial institutions increased their issuance of Ginnie Mae-guaranteed MBS to finance these federally insured or guaranteed loans. As Ginnie Mae’s market share increased, the number of Ginnie Mae issuers generally stayed the same although their numbers declined from 2007 to 2008 and increased in 2009 and 2010 (see fig. 3). Moreover, for the three quarters of 2011, 371 financial institutions participated in the Ginnie Mae-guaranteed MBS program. While most were mortgage banks, the issuers with the largest Ginnie Mae-guaranteed MBS portfolios were commercial banks. As of June 30, 2011, three commercial banks accounted for nearly two-thirds of the dollar amount of outstanding Ginnie Mae-guaranteed MBS. According to Ginnie Mae data, concentration among issuers generally has remained the same. More specifically, in 2005, 20 issuers accounted for 92 percent of Ginnie Mae single-family MBS issuance; in 2010, 26 issuers accounted for 94 percent of single- family MBS. According to Ginnie Mae data, as Ginnie Mae’s share of the secondary mortgage market increased, the volume of Ginnie Mae-guaranteed MBS outstanding increased from $412 billion in 2005 to more than $1 trillion in 2010 (see fig. 4). Concurrently, new guarantees of Ginnie Mae- guaranteed MBS increased from about $89.3 billion to nearly $413 billion. To accommodate the securitization of an increasing volume of federally insured and guaranteed mortgages, Congress increased the statutory cap on Ginnie Mae’s commitment authority from $200 billion to $500 billion over the same period. The increases in annual volume were due to increases in the volume of mortgages insured by FHA or guaranteed by VA, PIH, or RHS that were pooled into Ginnie Mae-guaranteed MBS (see fig. 5). Of the agencies, FHA accounted for most of the increases in annual volume. FHA-insured loans pooled into Ginnie Mae-guaranteed MBS increased from $63.8 billion in 2005 to $330.2 billion in 2010—and more recently, to $182 billion during the first three quarters of 2011. Furthermore, in 2010, nearly all single-family mortgages insured by FHA or guaranteed by VA were pooled into Ginnie Mae-guaranteed MBS. In addition to issuing guaranteed MBS from loans for single-family homes, Ginnie Mae issuers increasingly produced MBS backed by other mortgage products, such as multifamily loans and reverse mortgages on single-family homes (see fig. 6). More specifically, the volume of reverse mortgages backing Ginnie Mae-guaranteed MBS increased significantly starting in 2009 when Ginnie Mae instituted its reverse mortgage securities program, which was the main securitization program available for FHA reverse mortgage loans during this time. During the first three quarters of 2011, financial institutions issued more than $8 billion in Ginnie Mae-guaranteed MBS backed by reverse mortgages. The volume of structured products backed by Ginnie Mae-guaranteed MBS increased as the total volume of MBS has increased since 2005. For instance, the volume of REMICs issued by financial institutions approved to issue Ginnie Mae structured products increased in 2009 and 2010 (see fig. 7). During the first three quarters of 2011, financial institutions issued $102 billion in REMICs, $27 billion in Platinum Securities, and $670 million in Callable Trusts. Ginnie Mae’s fee revenues also increased from these products, from $20.7 million in 2005 to $63.4 million in 2010. As of June 30, 2011, Ginnie Mae had received $45.2 million in fee revenues from structured products for 2011. Fees from these products represent a small but growing share of annual revenue for Ginnie Mae (from 2.6 percent in 2005 to 6.3 percent in 2010). Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events. We and others, including HUD’s OIG, have identified limited staff, substantial reliance on contractors, and the need for modernized information systems as operational risks that Ginnie Mae may face. Ginnie Mae also faces counterparty risk when an issuer fails or defaults, which would require the agency to service the underlying loans and ensure that investors receive monthly principal and interest payments. Ginnie Mae has taken a number of steps to address both types of risks. A complete listing of Ginnie Mae’s planned changes to address operational and counterparty risk can be found in appendix II. To help mitigate operational risk, Ginnie Mae has developed strategies to address staffing gaps, realigned its organizational structure, conducted risk assessments on its contracting, and started to improve outdated information systems. Although Ginnie Mae’s market share and volume of MBS has increased in recent years, its (noncontractor) staff levels have been relatively constant during this time despite requests for increased staffing authority. For example, in 2004, when Ginnie Mae’s MBS market share was 7 percent, HUD conducted a Resource Estimation and Allocation Process (REAP) study, which suggested that Ginnie Mae’s staff be increased from 70 to 76 full-time equivalent (FTE) positions. However, Ginnie Mae officials told us that its authorized staff levels were not increased to the levels suggested in the REAP study until 2010 when the agency was given authority for 78 FTEs. Between 2005 and 2009, Ginnie Mae’s authorized staff level fluctuated between 67 and 72.2 FTEs. Moreover, its actual staff levels trailed its authorized staff levels. Table 1 illustrates the number of requested, authorized, and actual FTEs from 2005 to 2010. Most recently, Ginnie Mae’s internal control reviews for 2009 and 2010 identified a control deficiency due to employee vacancies. In 2009, the report found multiple vacancies in certain positions relevant to internal controls, such as an internal control manager and monitoring analysts. The report also found that the vacancies caused employee workloads to increase, which could lead to negative performance. In 2010, the report stated that while key senior-level positions had been filled, vacancies had brought actual FTE levels below the level recommended in the 2004 REAP study, mainly in the Office of Mortgage-Backed Securities. In 2011, the reviews had no findings related to employee vacancies. As part of a broad effort to address and mitigate its operational risks related to staffing levels, Ginnie Mae has incorporated some principles consistent with our internal control and management tool. Internal control and human capital guidance states that agencies should develop strategies that are tailored to address gaps in the number and deployment of staff, evaluate their organizational structure, and make changes based on changing conditions. Consistent with this guidance, Ginnie Mae has identified skill gaps in staff resources, developed a plan to hire additional staff, and made changes to its organizational structure. In 2010, Ginnie Mae officials presented HUD senior management with a staffing justification that identified skill gaps in its current staffing. Ginnie Mae officials reported needing 160 staff to develop or enhance policies, procedures, and related systems to properly manage risks and bring some contracted services in-house, such as project management. The staffing justification stated that Ginnie Mae did not have sufficient or dedicated staff to mitigate certain risks internally. To identify these gaps in staffing, Ginnie Mae created a matrix that identified certain roles that were not fully staffed. For example, the matrix identified that Ginnie Mae needed:  dedicated staff to design, develop, and leverage risk-related analytic tools to reduce dependency on recommendations of contractors to manage Ginnie Mae’s risk;  dedicated staff to develop exit and replacement strategies for critical,  dedicated staff to manage and oversee operational risks;  dedicated staff to establish and manage loss reserves and portfolio sufficient staff to develop and maintain systems manuals used by employees and Ginnie Mae issuers and servicers. In 2011, Ginnie Mae received approval to support a staffing level of 108 FTEs. Ginnie Mae had developed a plan to hire additional staff in two phases. For the first phase, Ginnie Mae focused on staffing 25 priority positions, of which 9 were in the Office of Mortgage-Backed Securities, 5 in the Office of Finance, 4 to assist the Chief Risk Officer, 2 in the Office of Capital Markets, 3 in the Office of Management Operations, 1 in the Office of Program operations, and 1 in the Office of the President and Executive Vice President. The President’s 2012 budget request included $30 million for additional administrative expenses, including hiring up to 249 FTEs. According to Ginnie Mae officials, the increase would allow the agency to implement its second phase of hiring and increase its staffing levels. However, Ginnie Mae officials explained that in July 2011 they reassessed and revised the budget request after determining that the requested $30 million would be sufficient to hire only 137 FTEs. According to Ginnie Mae officials, additional flexibility provided in the budget request will enable Ginnie Mae to strengthen risk management and oversight, move in-house some functions performed by contractors, and provide flexibility for future needs. More specifically, if Ginnie Mae does not receive the authority requested in its revised 2012 request, officials told us the agency would be forced to use its limited resources across its many-risk management efforts and would have little capacity to conduct preventative analysis, therefore leaving Ginnie Mae to rely on a more reactive approach. Ginnie Mae initially proposed realigning its organizational structure to support increased staffing levels in November 2010, and amended its proposal in March 2011 based on comments received by HUD senior management. Ginnie Mae proposed the revisions to create a new office and add divisions under an existing office so that new staff could be more effectively integrated into the agency. For example:  The proposed structure created an Office of Enterprise Risk to be headed by the Chief Risk Officer. The Chief Risk Officer position and a Risk Committee were created in 2008 in response to a 2007 HUD OIG report identifying a potential conflict of interest between Ginnie Mae’s issuer approval and issuer monitoring functions.  The proposed structure added two divisions in the Office of Program Operations, which manages day-to-day functions for Ginnie Mae’s MBS and structured product programs. The Project and Data Management Division will oversee and direct initiatives across Ginnie Mae, such as the implementation of new disclosure information. The Operations Division will focus on managing operations, such as pooling loans and creating securities, and will direct Ginnie Mae’s contractors who maintain and operate a large part of Ginnie Mae’s securitization process. Figure 8 illustrates the proposed reorganization. As of August 2011, officials had received HUD approval to implement the new structure and have notified Congress and HUD’s union and await their responses to begin implementation. Between 2005 and 2010, as Ginnie Mae’s volume and issuer activity increased and staff levels remained largely the same, the agency increasingly relied on contractors. In 2005, we reported that in 2004 approximately 81 percent of Ginnie Mae’s activities were contracted out and concluded that ensuring the agency had sufficient staff capabilities to plan, monitor, and manage its contracts was essential. According to Federal Procurement Data System-Next Generation data, from 2005 through 2010, Ginnie Mae obligated approximately $599 million on contracts. As shown is figure 9, while the amount of obligations had been increasing since 2005, they increased significantly in 2009 and 2010. Contract obligations in 2010 were more than 14 times the obligations in 2005 due, in part, to increases in volume and market share, expenses related to servicing nonperforming loans in defaulted issuers’ portfolios, and the need to use contracts to implement planned improvements to technology systems. Further, the number of active contracts and orders increased from 18 in 2005 to 37 in 2010. According to Ginnie Mae officials, they have contracted out many functions because the agency has flexibility to use agency revenues to procure contractors. That is, statutorily Ginnie Mae has more flexibility to spend funds for contracting expenses because they can be funded from agency revenues without annual appropriations. To pay for staff, Ginnie Mae has to seek annual appropriations that have to be approved by HUD, OMB, and Congress. As a result, Ginnie Mae has relied on contractors to develop and operate information technology systems, manage and dispose of acquired mortgage portfolios, and conduct monitoring reviews of issuers. According to Ginnie Mae officials, throughout its history the agency has operated with a business model that includes a small staff that is largely supported by contractors because of the difficulty in securing annual appropriations and not being able to use agency revenues to pay for staff. Officials explained they have not conducted a formal benefit-cost assessment of using contractors but believe such a heavy reliance on contractors may not be cost-effective. Ginnie Mae depends on contractors to provide a variety of services, including those related to guaranteeing MBS, such as collecting data from issuers and processing monthly principal and interest payments to investors. In addition, Ginnie Mae relies on several contractors to take over the servicing responsibilities on pooled loans when issuers default. Table 2 illustrates some core functions at Ginnie Mae performed by contractors and the total amounts obligated from 2005 to 2010. Ginnie Mae has used its own staff and third-party assessments of contracts to oversee its contractors but plans to provide additional staff resources to supplement the third-party assessments. According to HUD’s contractor monitoring guide and handbook on procurement policies and procedures, a Government Technical Representative (GTR) should be assigned to oversee and monitor the contractor’s performance. For example, the guidance requires that GTRs monitor the contract for timeliness and review invoices for accuracy. Since 1993, Ginnie Mae has relied on third-party contractors to conduct Contract Assessment Reviews (CAR) in accordance with procedures developed by Ginnie Mae. In general, the CARs guidance outlines that the third-party contractor should focus on determining whether the contractors complied with the terms of their contracts, conducted appropriate billing, and maintained adequate internal controls to minimize risk to Ginnie Mae. The CAR reports also provide information on any potential risks to Ginnie Mae based on other completed audits and reviews. These reviews are to be conducted on contracts that have expended more than $1 million. Ginnie Mae officials explained they had plans to supplement these reviews in 2011 with the hiring of additional Ginnie Mae staff to conduct on-site reviews and oversight concurrent with, and independently of, the third-party contractors. However, due to changes to its budget, implementation of this plan has been put on hold until 2012 or 2013. Officials explained that in previous years staffing limitations required waiting until the following review to address issues identified in the previous review. In some instances, there might be a significant time lag between reviews. One review might cover a 15-month period while another would cover a 9-month time frame. Ginnie Mae officials explained the timing of the reviews often depended on the time needed to procure the contractors rather than on a set schedule. Based on our nonprobability sample of 33 CAR reports from 2005 to 2010, the reports produced some findings. These findings included questionable costs, information technology controls, and accounting controls. For instance, one contractor did not have proper procedures to review timesheets and improperly billed Ginnie Mae for $2,621. The contractor agreed to develop formalized procedures and reimburse Ginnie Mae for the improper payment. Additionally, in a few instances the third party conducting the review had difficulty accessing necessary files to complete contractually required procedures. Ginnie Mae officials explained that they now work to address any access issues with contractors at the beginning of the contractor’s reviews. While our review of a sample of CARs identified some findings, the 2010 HUD OIG management letter discussed problems relating to one contractor and recommended associated improvements in internal controls, including assessing the effectiveness of CAR procedures. More specifically, in October 2009 Ginnie Mae identified accounting irregularities at its servicer of manufactured home loans. Agency officials subsequently asked the contractor that performs internal control reviews to do a more in-depth review of the servicer, including a file review. The internal control review confirmed the servicer had not completely or accurately processed manufactured home loan transactions for Ginnie Mae. As a result, Ginnie Mae officials explained they developed a corrective action plan and decreased the size of the portfolio managed by the servicer from $26 million in August 2010 to about $4.7 million in August 2011. The HUD OIG management letter suggested that internal control over Ginnie Mae’s manufactured housing servicer needed improvement and stated one of the causes for the finding was that the prior year CAR did not include procedures to review specific loan-level details. The HUD OIG made four recommendations—the one specific to CAR procedures stated Ginnie Mae should assess the effectiveness of and update CAR procedures if needed. Ginnie Mae officials told us that they have addressed the HUD OIG recommendations and have updated review procedures for this servicer and its other servicers of single-family and multifamily properties. Subsequent to these reviews, Ginnie Mae began to take other steps to address operational risks related to contracting that are consistent with the principle identified in our internal control and management tool to consider risks associated with major suppliers and contractors. More specifically, Ginnie Mae has conducted risk assessments of its contracts and potential operational risks, and plans to review the proposed recommendations and determine how to implement them. However, as of October 2011, none of the recommendations have been implemented. In December 2010, the Chief Risk Officer staff analyzed Ginnie Mae contracts and identified approximately 12 contracts that could pose operational risk to Ginnie Mae. The purpose of the risk assessment was to assess the inherent risks associated with activities its top contractors executed and to determine what controls the agency had in place or should have in place to mitigate risks. The potential risks to Ginnie Mae included (1) lack of a contingency plan if the contractor ceased work with Ginnie Mae, (2) poor internal controls, (3) nonperformance under contract terms, and (4) failure of operations. The analysis included short-term recommendations related to better management of internal controls—for example, increasing training requirements for GTR staff on areas of the greatest risk exposure to Ginnie Mae such as cost overruns and inadequate recordkeeping. Long-term recommendations included increasing the number of Ginnie Mae staff to reduce the dependency on a few key staff. Targeted recommendations included developing  a transition plan to automate manual processes that might lead to operational errors to help address the risk of failure of operations and formal contract reporting on projects with performance metrics to help avoid nonperformance under contracts. Ginnie Mae also contracted with a firm to provide recommendations for enhancing its risk-management capabilities. In June 2011, the contractor’s study recommended that Ginnie Mae systematically assess staff overseeing its contracts to identify any gaps in expertise—for example, by annually using a checklist or other mechanism to identify expertise. In addition, the study suggested that Ginnie Mae develop a system to track any contract-related incidents so that any issues would be handled promptly. The study noted that as Ginnie Mae continues to grow, establishing formalized processes for contract-related incidents would be important. Although Ginnie Mae has conducted risk assessments on its contracts, it has not yet implemented the recommendations from these assessments. According to Ginnie Mae officials, they have deferred implementing the recommendations from the December 2010 risk assessment because staff working for the Chief Risk Officer also have been conducting another assessment on ways to improve contract management and procurement processes. Officials explained that once this review was complete, they would review recommendations from all three assessments and develop a plan to implement them collectively. Ginnie Mae officials also explained that during 2012, the Chief Risk Officer plans to work with senior management to assess the recommendations in the June 2011 study and prioritize their implementation relative to other competing projects currently underway at the agency, such as technology improvements and updates to its statistical model used to forecast cash flows to and from the program. We discuss technology improvements in the following paragraphs and the statistical model in the next section of this report. Concurrent with its other risk assessments, Ginnie Mae began to change its procurement practices in an effort to reduce its reliance on contractors for critical functions. More specifically, as part of senior management performance plans for the 2011 calendar year, managers have been directed to develop and put in place a contracting environment that leverages contractors and Ginnie Mae staff more effectively. For instance, some senior management performance plans include a directive to conduct a needs assessment for every contract that is new, has the option to extend, or has ended. These assessments consider whether the contract should be recompeted to bring targeted services or work products in-house, thereby reducing contractor expenses and reliance. Officials explained they also plan to include this directive in 2012 calendar year performance plans. Officials also told us that these needs assessments are required for all contract actions. As of August 2011, of the nine contracts for which needs assessments might be conducted, four have been completed. According to Ginnie Mae officials, the results of the assessments for two contracts identified possible ways to bring certain functions in-house, such as one contract for project management, which may save $600,000. In 2012, Ginnie Mae officials expect to complete 17 needs assessments. Senior managers also told us they have been reviewing current contract provisions to make sure Ginnie Mae staff understood all the elements of a contract. For example, management reviewed one contract with a large technology component and found that the system documentation and user manuals had not been consistently updated. According to officials, Ginnie Mae recognizes the need for updated documentation and is in the process of modernizing the data system used by the contractor, which includes new system documentation and user manuals. Ginnie Mae has been working on an ongoing initiative to improve its information technology systems. According to officials, Ginnie Mae has been working on the first phase of its business process improvement initiative for the last few years based on a plan developed in conjunction with OMB. The main goal of the initiative is to modernize the agency’s technology by consolidating processes and eliminating redundant systems. Some of the weaknesses included outdated data systems, a reliance on paper-based processes, and a lack of integrated data systems. According to our internal control management and evaluation tool, management should derive critical operating data from its information management function and support efforts to make improvements in the systems as technology advances. According to Ginnie Mae, the first phase of the initiative resulted in the creation of nine new information technology system initiatives. Seven of these initiatives have been in place since October 2009. For instance, one system allows Ginnie Mae to receive enhanced reporting and provide status information to issuers. Another allows Ginnie Mae issuers to provide pool information electronically. According to Ginnie Mae, these systems let Ginnie Mae modernize its technology by merging legacy systems into a centralized database. Ginnie Mae officials further explained that they have been modernizing the pooling information system so that it can be integrated with the enterprise-wide data system. In addition, Ginnie Mae has been drafting a strategy document for its ongoing initiative to look for additional business improvement opportunities in its information technology systems. To manage its counterparty risk, Ginnie Mae has processes in place to oversee issuers that include approval, monitoring, and enforcement. In response to changing market conditions and increased market share, Ginnie Mae revised its approval and monitoring procedures. In addition, Ginnie Mae has several planned initiatives to enhance its management of counterparty risk; however, many have not yet been fully implemented. Issuers are subject to the requirements outlined in the Ginnie Mae MBS guide and all participant memorandums, some of which have been made more stringent in recent years due to changes in industry and market conditions. In September 2008, Ginnie Mae issued a notice to participants that it was raising the issuer approval standards and requirements due to industry and market conditions. For example, newly approved issuers became subject to a 1-year probationary period, which begins after their first issuance or acquisition of a servicing portfolio. Before this time, new issuers had no probationary period. In addition, for newly approved and already existing issuers, the Office of Mortgage- Backed Securities monitors required risk thresholds, such as delinquency levels and loan matching statistics. New and existing single-family issuers also must meet increased net worth and liquid asset thresholds. Initially, new issuers in the single- family and reverse mortgage program had to have a minimum net worth of $250,000. In 2008, the minimum increased to $1 million. In October 2010, the minimum net worth requirement was raised to $2.5 million. At the same time, Ginnie Mae announced a new liquid asset requirement, which requires single-family issuers to maintain liquid assets that are 20 percent of the issuer’s Ginnie Mae required net worth requirement. According to the policy memorandum Ginnie Mae issued, the increased liquid asset requirement is intended to help ensure funds would be available when cash was needed for mortgage buyouts or to pay for potential indemnification requests from federal guarantee programs. Existing single-family issuers had until October 2011 to meet the increased net worth and liquid asset thresholds. Corresponding to changes in Ginnie Mae’s market share, the number of new issuer applications and approvals increased from 2008 to 2010 (see fig. 10). For the first three quarters in 2011, the agency received 73 new applications, approved 32 new issuers, and 85 applications were denied or withdrawn. Ginnie Mae’s process for screening applications includes a review of the applicant’s net worth and its performance as an FHA lender. In addition, the applicant may be required to undergo a special servicer review if the applicant is not an approved Fannie Mae or Freddie Mac seller or servicer, or Ginnie Mae believes the applicant warrants a more in-depth review. According to Ginnie Mae officials, the special servicer review (conducted by Ginnie Mae staff and its contractors) began in 2008 as an on-site review of the financial, management, and operational capacity of selected new applicants and existing issuers. As of June 30, 2011, the agency had conducted 32 special servicer reviews on new applicants since 2008, for which 27 were approved and 5 rejected. Officials explained one of Ginnie Mae’s goals is to decrease the approval time for issuers from approximately 1 year to 6–8 months. They plan to hire additional staff to review applications and have one of their contractors help obtain the necessary documentation from issuers. However, the creation of these new positions has been on hold due to decreases in the FTE levels for 2011 and potential budget decreases for 2012. Ginnie Mae also has been considering raising its application fee to deter issuers that might have little intention of issuing MBS but think approval from a federal entity would reflect well on their business. Ginnie Mae officials also told us they planned to expand the number of issuers by marketing Ginnie Mae and its products to smaller financial institutions, such as credit unions and state housing finance agencies because the concentration of the MBS portfolio among a few issuers represents some level of risk to Ginnie Mae. For instance, if one large issuer were to fail, Ginnie Mae would be responsible for servicing more mortgages than if a small issuer failed. Officials said that the risk posed by concentration may be mitigated because these issuers generally were regulated at the federal level. Monitoring processes for issuers include the approval process for commitment authority, reviews of quarterly and monthly summary reports, and on-site reviews of issuers. Ginnie Mae has modified some of these processes in recent years by requiring issuers to request commitment authority more frequently and developing additional quarterly and monthly summary reports. The agency also plans to add other monitoring tools. According to Ginnie Mae officials, the agency uses its ability to limit or modify commitment authority requests as a primary risk-management tool (by limiting commitment authority, the agency reduces the flow of funds to the issuer). To deal with increased demand, in 2005, Ginnie Mae created two processes for granting commitment authority—streamlined and nonstreamlined requests. Issuers that meet required risk thresholds set by Ginnie Mae go through the streamlined process, which limits the number of approvals needed for the request. Issuers that do not meet these thresholds or are on Ginnie Mae’s watch list would be considered under the nonstreamlined process, which requires additional scrutiny by Ginnie Mae staff and additional approvals by Ginnie Mae management. Before 2005, the agency used the same process for those that did and did not meet required risk thresholds. Officials explained the change was made to increase the efficiency of the process for issuers who met required thresholds. Whether streamlined or not, officials explained requests for commitment authority now require more frequent approvals. Before 2008, issuers generally would request commitment authority annually. However, Ginnie Mae issuers currently apply for commitment authority in an amount equal to the securities they plan to issue during the next 4 months. Therefore, issuers generally must request the authority every 2 to 3 months, which allows Ginnie Mae to take an in-depth look at the issuer’s performance and compare it against its required risk thresholds. In 2010, Ginnie Mae also revised its guidance to require that streamlined requests receive management-level review rather than just a staff-level review in the Office of Mortgage-Backed Securities. The commitment authority process has been subject to internal reviews from 2006 through 2011, but these reviews found no material weaknesses. Specifically, Ginnie Mae’s annual internal control review generally examines the commitment authority process. Although control deficiencies—that is, less serious findings that identify an internal control that might not be designed to prevent or detect and correct issues—were identified from 2008 through 2011, officials explained the deficiencies did not result in any issuer being granted commitment authority that should not have received it. For instance, in 2008, Ginnie Mae was unable to locate the files for the sample of 25 files selected by the internal auditor to conduct its review. In 2009–2011, the required commitment authority checklist was not always completed according to guidance. To address the 2008 finding, Ginnie Mae officials explained that management was directed to enforce the guidance and the filing system was changed. For the 2009–2011 findings, Ginnie Mae updated procedures in its manual and amended the checklist twice. Since 2007, according to Ginnie Mae, one of the two contractors that manage the administration of the MBS program has created 30 new monthly and quarterly monitoring reports, which staff from the Office of Mortgage-Backed Securities review. Ginnie Mae officials explained that these reports were generally created because new programs, such as the reverse mortgage program, were developed that required new monitoring requirements, or enhancements were identified to existing monitoring processes, which required additional reporting. Among other new reports, in 2008 the contractor created a monthly summary report addressing active issuers. The report summarizes issuer risks (in areas such as default and financial condition) and results of issuer compliance reviews. However, Ginnie Mae has not updated its guidance to reflect this new report. Officials explained that Ginnie Mae staff rely on the summary information prepared by the contractor that combine information on all issuers rather than creating individualized reports. In fact, our analysis of 10 issuer files revealed that Ginnie Mae staff had not prepared monthly management worksheets for any of these issuers as Ginnie Mae’s guidance requires. Ginnie Mae officials said they plan to revise guidance in 2012 to reflect the move from staff preparing reports for individual issuers to reliance on contractor-prepared summary reports. In addition, Ginnie Mae officials explained that they have been enhancing data systems to assess counterparty risk. More specifically, according to the Chief Risk Officer, the agency’s highest priority is to develop a counterparty risk-management system by March 2012. The new system aims to help Ginnie Mae identify its total counterparty risk exposure with all entities, such as issuers and contractors. The system would include information on issuers, such as rating data and risk calculations, and an algorithm to predict issuer default. In addition, the system would incorporate a scorecard to help Ginnie Mae have a comprehensive view of issuers, including information on issuer required risk thresholds. Ginnie Mae also monitors issuers through on-site reviews conducted by a contractor. Ginnie Mae has implemented two new types of reviews since 2008 to provide additional monitoring of new and existing issuers and increased the frequency of reviews on new issuers. Previously, there were two types of issuer reviews—basic and special. In 2010, Ginnie Mae added a findings resolution field review, which differs from the other reviews because the issuer is not given prior notice of the review. The purpose of this review is to test whether corrective actions for prior findings have been implemented. According to Ginnie Mae officials, seven finding resolution field reviews have been conducted since the review was implemented. According to Ginnie Mae’s January 2011 revisions to its MBS guide, new issuers are subject to on-site basic or special reviews by contractors after 6 months of the start of their Ginnie Mae issuance activity, and then annually for 2 years from the start of activity. Before this revision, contractors reviewed new issuers 6 months after their issuance activity started but did not conduct the annual reviews. Our review of information on the frequency of new issuer reviews indicated that of the five new issuers whose issuance activity began between December 2010 and March 2011, none had been reviewed after 6 months of program participation as required. According to Ginnie Mae officials, two reviews were completed in September 2011 (3 months late) and the other three were delayed due to scheduling issues and competing priorities. Existing issuers are subject to on-site basic or special reviews by contractors no less than once every 3 years, but may be reviewed more frequently based on their ability to meet performance thresholds and other factors. For example, an issuer review may be prompted by an issuer’s portfolio size, monthly reporting portfolio statistics, a sudden increase in issuance activity, monitoring of delinquency reporting, previous review results and findings, a request from the Risk Committee, or other information received by Ginnie Mae indicating potential risk to the agency. We reviewed a March 2011 schedule for reviews of 196 issuers and found that 174 reviews were conducted within the 3-year time frame. According to Ginnie Mae officials, the 22 issuers not reviewed were not active issuers during the 3-year time frame. Ginnie Mae officials explained that each year its contractor develops a schedule of the issuer reviews to be conducted in each quarter based on the factors identified earlier in this report. Currently, officials explained they work with the contractor that maintains the database on issuer reviews to develop the schedule with which issuers will be reviewed during the next time frame. However, they plan to enhance the development process by creating an additional factor for consideration—a scoring system that summarizes the results of prior issuer reviews—and coordinating with the Chief Risk Officer. Officials were unclear on the timeline for implementing this plan due to competing priorities with technology improvements. From 2005 to 2010, Ginnie Mae issued 3,971 findings from the basic and special issuer reviews. As of June 2011, 3,699 were cleared (93 percent), and 268 were referred (7 percent) to Ginnie Mae by the contractor for final resolution because they had not been cleared within the required time frame (see fig. 11). Findings from the issuer reviews fall into three risk categories (high, medium, and low). High-risk findings must be addressed within 21 days of the review, medium-risk findings within 45 days, and low-risk findings within 120 days. Findings are reflected as “cleared” if an issuer submits a resolution plan that includes evidence that the original cause of the finding has been corrected and a policy, procedure, or action was implemented to prevent the recurrence of the finding. Findings are considered “open” if they are not addressed in these time frames. Ginnie Mae can take a variety of enforcement actions against issuers, which we discuss in detail in the following paragraphs. According to Ginnie Mae officials, they do not have a database in place for tracking the resolution or timing of individual findings. However, they have been developing this capability through their information technology systems and expect it to be completed by June 2012, unless delayed by other priorities. To monitor the resolution or timing of findings, officials stated they received a weekly report from the contractor that lists all reviews completed over a certain period. The report includes the number of findings from each review and actions pending from issuers to close out any findings. If a finding has been referred to Ginnie Mae, the issuer is flagged in the system used to monitor issuers. Ginnie Mae’s internal control reviews from 2008 to 2011 repeatedly identified that the guidance used to conduct the issuer reviews should be updated to mitigate the risk of the current field review process not incorporating tests that address changing risks in the MBS market. Ginnie Mae officials told us that they have not updated the guidance because the internal control review was not specific about what risks were not being identified by the issuer reviews. However, they said that they have made changes to their issuer reviews and monitoring procedures—such as the unannounced on-site reviews and remote monitoring procedures on the movement of funds—during this time that were not reflected in updates to their guidance. Officials expected to update their guidance by the end of 2012. They explained the delay in updating the guidance in 2009 was due to the increase in the number of new issuers in 2008 and 2009, the need to conduct more issuer reviews on both new and existing issuers, and a delay in adding more funds to the contract to update the guidance. As mentioned previously, issuers found to not be in compliance are placed on Ginnie Mae’s watch list or are subject to more scrutiny during the commitment authority approval process. In addition, Ginnie Mae may declare the issuer in default and terminate the issuer. As of June 2011, 27 single-family active issuers (of 165) were on the watch list. These 27 single-family issuers had an average portfolio size of about $4.8 billion. Issuers on the watch list generally receive a quarterly monitoring letter detailing the reason for being on the watch list and are given 30 days to respond and take action. According to Ginnie Mae officials, they do not track how long issuers stay on the watch list. Ginnie Mae’s desk manual on operational procedures and its MBS guide list the types of enforcement actions it can take against noncomplying issuers. However, Ginnie Mae officials explained they plan to update this guidance by December 2011 because the violations listed may warrant a wide range of responses based on the severity of the violations. For example, if an issuer is defaulted by one of the government-sponsored enterprises, this action would warrant a more severe response than missing a deadline to post a letter of credit. However, the guidance currently does not distinguish among types of violations based on severity. Based on its monitoring of issuers, Ginnie Mae may issue a notice of intent to default if an issuer has violated the guidelines identified in the MBS guide, such as a missed pass-through of monthly principal and interest payment to an investor. Officials explained the most common enforcement actions used against issuers were the notice of intent to default an issuer. From 2005 to 2010, Ginnie Mae issued 46 notices of intent to default (see fig. 12). Officials told us that they issued most of the notices because issuers committed an operational error, such as a missed payment, and that issuers rectified the errors in a timely manner. Once an issuer receives a notice of intent to default, the issuer has 30 days to respond. If the issuer does not respond in 30 days, Ginnie Mae takes action on the violation based on the information available. In the first three quarters of 2011, Ginnie Mae issued seven notices of intent to default. During 2005–2010, Ginnie Mae defaulted 21 issuers. Officials said the reasons for defaults have included suspensions by FHA, terminations by Fannie Mae, bankruptcy, or failure to submit audited financial statements. When an issuer is defaulted, Ginnie Mae takes over responsibility for servicing that issuer’s portfolio. Currently, Ginnie Mae has a large portfolio of single-family loans it is responsible for servicing due in part to the default of Taylor, Bean & Whitaker Mortgage Corporation in 2009. Ginnie Mae defines its mission as expanding affordable housing by linking capital markets to the nation’s housing markets. Ginnie Mae has been fulfilling its mission by securitizing the growing volume of federally insured and guaranteed mortgage loans. Changes in the housing market and the economic downturn have increased the volume and market share of Ginnie Mae-guaranteed MBS significantly in the last 5 years. Although Ginnie Mae’s portfolio of guaranteed MBS outstanding has grown, increasing the financial exposure to the federal government, it has mechanisms in place to help offset this financial exposure. As mentioned previously, Ginnie Mae charges issuers a guarantee fee and has accumulated reserves over the years. In addition, the mortgages that back Ginnie Mae-guaranteed MBS are fully or partially insured against default by another federal agency, such as FHA, VA, RHS, or PIH. Finally, Ginnie Mae has a number of practices in place to mitigate its operational and counterparty risks and has enhanced or plans to enhance these practices. Nevertheless, the methods by which Ginnie Mae measures the expected costs and revenues stemming from its growing commitments may not take full advantage of available data and techniques for accurately assessing program costs. According to Ginnie Mae’s financial statements, income to Ginnie Mae, mainly in the form of a guarantee fee paid by issuers, exceeded Ginnie Mae’s costs by an average of about $700 million each year from 2006 through 2010. As of September 30, 2010, excess revenues allowed Ginnie Mae to accumulate a capital reserve of about $14.6 billion. Ginnie Mae has not required appropriations from the general fund to cover any losses. Ginnie Mae uses fee revenue to cover the cost of issuer defaults by making timely payment of principal and interest to investors in Ginnie Mae-guaranteed MBS when an issuer is unable to do so. Although Ginnie Mae forecasts the severity of defaults, a higher-than-expected delinquency and default rate on those mortgages could require Ginnie Mae to make payments to investors using its accumulated reserves. Additionally, while mortgages backing Ginnie Mae-guaranteed MBS generally must be insured or guaranteed by another federal agency, such as FHA, borrower defaults may result in lower fee and claim payments to Ginnie Mae in some instances.  For instance, if the number of borrowers who prepaid or stopped paying their mortgages was greater than Ginnie Mae expected, guarantee fees paid by issuers would be less than expected.  For delinquent loans it acquires from defaulted issuers, Ginnie Mae makes advances of principal and interest to cover any late payments on those mortgages in the MBS pools. If the borrower made late payments and eventually defaulted, Ginnie Mae might not recover the entire value of the loss, although the mortgage was insured. For example, for FHA-insured mortgages, Ginnie Mae has to incur the cost to foreclose on a defaulted borrower but receives only a percentage of the associated costs. During 2005–2010, Ginnie Mae defaulted 21 issuers and took over the portfolio for approximately $28.8 billion in mortgages (see fig. 13). While the number of issuers defaulting has varied from two to five in recent years, the number of loans involved increased during this period. In 2009, Ginnie Mae defaulted a large issuer—Taylor, Bean & Whitaker Mortgage Corporation—and took over the portfolio for approximately $26.2 billion in mortgages. In general, the actual cost of a defaulted portfolio for Ginnie Mae cannot be determined until insurance or guarantee claims are processed and the number of fraudulent or delinquent mortgages determined. As of June 2011, Ginnie Mae’s disbursed $7.4 billion as a result of the 21 defaults. However, according to its 2010 financial statements after considering forecasted receipts from claims and recoveries, Ginnie Mae estimated that its defaulted issuer portfolio at that time of about $4.5 billion would result in net costs of approximately $53 million. For budgetary purposes, Ginnie Mae annually estimates the expected subsidy costs to the federal government of its guarantee activity. Ginnie Mae’s subsidy cost estimates to date have indicated that the program would generate net revenues, meaning that the fees Ginnie Mae collects were expected to exceed its losses on a present value basis. These estimates take into account forecasted fees and expected losses in the event of an issuer default. Once an issuer defaults, Ginnie Mae would take over the issuer’s portfolio as its own loan portfolio. As a result, the initial subsidy cost estimates take into account potential losses on the guaranteed portfolio as well as potential losses on its loan portfolio from the defaulted issuers. Agencies typically update or re-estimate the subsidy cost estimates annually to reflect actual program performance and changes in expected future performance. Ginnie Mae performed a re-estimate for the first time at the end of 2010 and officials told us that they plan on performing annual re-estimates going forward. The 2010 re-estimate lowered expected net revenues by $720 million from the previous estimate. Ginnie Mae officials explained that they performed the re-estimate of their portfolio in 2010 because for the first time the agency and OMB had developed a methodology upon which both parties could agree. Ginnie Mae officials noted that they faced challenges in developing a re-estimate methodology. Officials explained the nature of their business posed a challenge because Ginnie Mae does not have a yearly cohort of loans like other federal guarantee programs. Ginnie Mae officials also stated the re-estimate was performed due to the default of the Taylor, Bean & Whitaker Mortgage Corporation in 2009. Although Ginnie Mae has made some changes to the model it uses to forecast cash flows for the program, it has not implemented certain practices identified in Federal Accounting Standards Advisory Board (FASAB) guidance. While Ginnie Mae, as a government corporation, follows private sector accounting standards rather than FASAB accounting standards, we believe FASAB guidance on preparing cost estimates for federal credit programs represent sound internal control practices for evaluating Ginnie Mae’s model. Ginnie Mae uses a statistical model to forecast cash flows, including guarantee fee income and costs related to issuer defaults, to develop a credit subsidy cost for the federal budget and to calculate a reserve for loss for its financial statements. Ginnie Mae’s model uses historical trends on the default and prepayment characteristics of loans in its guaranteed MBS and estimates of future events, such as issuer defaults, to forecast 30 years of costs and revenues to the program. Ginnie Mae officials explained they recognized improvements could be made to their model. In 2009, Ginnie Mae hired a contractor to redesign its model over a 2-year period. Ginnie Mae hired additional staff to assist with the development of the model in March 2011. The contractor completed the new version of Ginnie Mae’s revised model in August 2011. Examples of changes made to the model since 2009 include the following:  Changing the data used in the model from FHA loan-level data to Ginnie Mae data, which includes data on other loans in Ginnie Mae- guaranteed MBS, such as PIH, VA, and RHS loans. Incorporating econometric methods similar to those used in FHA’s model.  Changing the types of scenarios used for stress testing. Previously, Ginnie Mae relied on vendor-provided scenarios rather than using customized scenarios tailored to Ginnie Mae. Ginnie Mae staff recently obtained FHA’s estimates of borrower default and prepayment and are intending to use these for future credit subsidy estimates, credit subsidy re-estimates, and financial statements. However, the current model still does not implement certain practices identified in FASAB guidance and risk-budgeting guidance. According to FASAB guidance, managers of federal credit programs should develop cost estimate models that include the following characteristics:  Estimates should be based on the best available data of the performance of the loans or loan guarantees, including data from related federal agencies. Furthermore, agency documentation supporting the estimates should include evidence of consultation with relevant agencies.  Estimates also should include a sensitivity analysis to identify which cash flow assumptions have the greatest impact on the performance of the model. In addition, according to academic risk-budgeting guidance, it is important that stress testing, which is a form of sensitivity analysis, use realistic scenarios to provide accurate indications of the effect of variability in economic and market factors.  Estimates can rely on informed opinion (i.e., management assumptions), but these assumptions only should be used in lieu of available data and on an interim basis. Moreover, agency documentation supporting the assumptions should demonstrate how the assumptions were determined. Although FASAB suggests that estimates be based on the best available data, Ginnie Mae did not fully evaluate the benefits and costs of using data to develop borrower default and prepayment estimates from relevant agencies, including FHA. More specifically, it did not consider or assess the benefits of using FHA’s default and prepayment model, rather than spending resources on developing its own model. According to Ginnie Mae officials, they took steps intended to improve the revised model by using their own loan-level data as a basis for developing estimates of borrower default and prepayment. However, Ginnie Mae did not perform or document any analyses to determine what other data from FHA—or VA, RHS, and PIH—could improve its model or help assess its cost- effectiveness. Ginnie Mae officials explained that they used their own loan-level data in the revised model because they could incorporate data on mortgages from all of the guaranteeing agencies, without obtaining data from each of the agencies that insure or guarantee mortgages in Ginnie Mae-guaranteed MBS. However, since approximately 80 percent of loans pooled into Ginnie Mae-guaranteed MBS are FHA-insured mortgages, there may be some benefits of incorporating elements of FHA’s data or model. These benefits include its cost-effectiveness and the potential for more detailed loan-level data than Ginnie Mae collects on FHA mortgages. Similarly, there may be benefits to incorporating VA data on loans it guarantees, which represented 16 percent of loans pooled in Ginnie Mae-guaranteed MBS in 2010. More specifically, FHA’s models include certain data elements that Ginnie Mae’s model does not, such as identifying which loans are FHA streamlined refinancing products and reverse mortgages. An FHA official with whom we spoke explained that these types of mortgages have different borrower default and prepayment characteristics. In addition, the official explained that including information identifying these types of mortgages would improve the predictive quality of any model of default and prepayment. For example, according to 2009 FHA data, borrowers who refinanced their mortgage under the streamlined refinance program had higher early payment delinquency rates than those with other refinanced mortgages. Our review of Ginnie Mae’s August 2011 revised model showed that it did not identify reverse or streamlined- refinanced mortgages. However, since our review of the model, Ginnie Mae officials said they have received data from FHA on estimates of borrower default and prepayment and are intending to use this information for preparing future credit subsidy estimates, credit subsidy re-estimates, and financial statements. FHA’s estimates of borrower default and prepayment does include data on streamlined-refinance mortgages. Ginnie Mae officials have not yet incorporated data on reverse mortgages, which are modeled separately by FHA, or explored and documented VA estimates of defaults and prepayments in their model. According to Ginnie Mae officials, they are using FHA data to approximate the experience expected of VA loans rather than using VA data directly (by adjusting these data for expected differences for prepayment and default experience). However, the analysis underlying these adjustments have not been documented. According to FASAB, sensitivity analysis should be performed to improve the accuracy of a model. A stress test provides an analysis of the sensitivity of a model’s forecasted cash flows in response to extreme changes in economic conditions. According to academic risk budgeting guidance, using realistic stress test scenarios is important to accurately indicate the effect of variability in economic and market factors. More specifically, stress test scenarios should consider the impact of movements of individual market factors and interrelationships or correlations among these factors. Although Ginnie Mae recently has developed more customized stress test scenarios in its revised model, some of these scenarios may not be realistic because they do not reflect the interrelationships between economic and capital markets factors. For example, Ginnie Mae’s revised model includes customized scenarios that focus on mortgage rate movements. More specifically, mortgage rates in one scenario were lowered by 300 basis points, or 3 percent, but no other economic variables, such as housing prices and unemployment rates, were changed. Ginnie Mae’s revised model stated that this scenario consistently produced the lowest cumulative defaults across its FHA and VA portfolio. However, as we previously reported, an economic scenario involving a mortgage rate decrease, which included rising unemployment and falling house prices, could produce more realistic model results. This is an example of a scenario that could create a different—yet plausible—scenario for defaults under various economically stressful conditions. If the scenarios Ginnie Mae used were unrealistic, it could affect the accuracy of its model. Ginnie Mae relies on management assumptions rather than data to forecast issuer defaults and mortgage buyout rates. For example, Ginnie Mae’s management assumptions for the costs of future issuer defaults were $300 million in 2011 and $25 million annually from 2012 to 2015. Ginnie Mae officials were not able to provide documentation on the basis for these assumptions and have explained they have had difficulty forecasting the risk that an issuer would default because defaults are dependent on both economic and noneconomic factors. However, Ginnie Mae officials acknowledged that issuers that have a higher concentration of federally insured or guaranteed mortgages in their portfolio may face a greater risk of default if these mortgages default at high rates, and they could not continue making the required advances to investors. In addition, Ginnie Mae’s model does not incorporate data on the mortgage buyout rate but includes a management assumption that issuers will buy out all mortgages after default. The mortgage buyout rate affects Ginnie Mae’s cash flows because mortgage buyouts reduce the guarantee fee revenue on the MBS backed by the loans. However, Ginnie Mae officials told us changes in interest rates may influence an issuer’s decision to buy a defaulted mortgage out of an MBS pool. More specifically, officials explained that if an issuer’s borrowing rate (cost of capital) is higher than the interest rate on a delinquent mortgage, the issuer is less likely to buy the mortgage out of the pool and will choose to continue making advances to investors. When the issuer’s borrowing rate is lower than the interest rate on a delinquent mortgage, the issuer is more likely to buy the mortgage out of the pool at an earlier opportunity. Officials said they plan to include quantitative estimates on issuer defaults and interest rates in determining mortgage buyout rates in future iterations of the model, but the agency does not have a timeline for incorporating these data and the analysis into the model. Because Ginnie Mae’s revised model does not fully implement certain practices identified in FASAB guidance, the model may lack critical data needed to produce a reliable credit subsidy rate and reserve for loss amount, which could affect Ginnie Mae’s ability to provide more informed budgetary cost estimates and financial statements. Ginnie Mae also may be forgoing opportunities to further enhance its model in the most cost- effective way possible by not regularly consulting with other agencies and evaluating their data. In addition, economic scenarios used to conduct stress tests on its revised model may not be sufficiency realistic, which may impact the accuracy of the model. Further, Ginnie Mae’s reliance on management assumptions rather than quantitative estimates for issuer defaults and mortgage buyout rates also may impact the accuracy of the model and a lack of documentation on how these assumptions were developed limits the transparency of the model. Ultimately, because of these limitations on its model, Ginnie Mae could be limited in its ability to accurately portray the extent to which Ginnie Mae’s programs represent a financial exposure to the government. During the recent financial crisis and in response to continuing stresses in housing markets, Ginnie Mae has assumed an increasingly prominent position in the secondary mortgage market. However, risks have accompanied its growth. The agency has faced an increased reliance on contractors to perform many critical functions, while at the same time coping with relatively flat staffing levels and outdated information technology. Although Ginnie Mae has conducted risk assessments on its contracts and enhanced some processes, technology, and staffing, or planned to do so, a number of recommendations from these assessments and initiatives remain in planning or under development—warranting vigorous and continued commitment and follow through from senior management. In recent years, Ginnie Mae also received a salient demonstration of counterparty risk when it defaulted a major issuer and had to assume and service a $26 billion loan portfolio. This and other issuer defaults and issuance volume surpassing a trillion dollars highlight the need for comprehensive risk mitigation and monitoring. As with operational risks, the agency has several planned initiatives to enhance its management of counterparty risk, which have yet to be fully implemented. These actions are critical to Ginnie Mae’s efforts to enhance its operations and we encourage the agency to complete their implementation as soon as practicable. Finally, although Ginnie Mae revenues exceeded costs thus far (including the costs of defaults) and the agency has a positive capital reserve, it has had to lower net revenue projections in a recent re-estimate of program costs. A combination of factors, including changed economic conditions, increased Ginnie Mae market share and volume, and the results of the re- estimate suggest that now is an opportune time for the agency to reexamine its data sources and methodologies, and identify opportunities to improve inputs and analyses for the statistical model it uses to forecast cash flows to and from the program. Ginnie Mae has acknowledged that it could improve the model and has said they will use FHA’s estimates of borrower default and prepayment for preparing future credit subsidy estimates, credit subsidy re-estimates, and financial statements. For example, Ginnie Mae officials explained they are using FHA data to approximate the experience expected of VA loans rather than using VA data directly. However, the analysis underlying these adjustments have not been documented. Therefore, without fully documenting, it is not possible to assess the rigor of this analysis. Given that VA was 16 percent of Ginnie Mae’s portfolio in 2010, evaluating and documenting the accuracy of its assumptions going forward and assessing whether its assumptions are sufficiently accurate for VA loans or if it should use data directly from VA is important. We identified several areas in which the agency could better implement certain practices identified in federal guidance for estimating program costs, including using the best available data, conducting sensitivity analyses, and assessing and documenting reasons for using management assumptions (judgment) rather than data. By consulting other agencies, assessing different modeling inputs and approaches, and leveraging other agencies’ datasets, Ginnie Mae could provide more informed budgetary cost estimates and financial statements. In addition, Ginnie Mae could realize opportunities to further enhance its model in a cost-effective way. Further, by developing quantitative estimates for issuer defaults and mortgage buyout rates, Ginnie Mae could better predict potential impacts on the costs and revenues of its programs. With more informed budgetary cost estimates and financial statements, Congress could more confidently use this information to understand the extent to which Ginnie Mae’s credit programs represent a financial exposure to the government. To help ensure that Ginnie Mae is developing the most accurate model for estimating costs and revenues, we recommend that the Secretary of Housing and Urban Development direct Ginnie Mae to take steps to ensure its model more closely follows certain practices identified in Federal Accounting Standards Advisory Board guidance for estimating subsidy costs of credit programs. More specifically, Ginnie Mae should take the following four actions: 1. Assess and document that it is using the best available data in its model and most appropriate modeling approach. For example, Ginnie Mae should determine if other agencies’ datasets (such as FHA, VA, RHS, or PIH) provide for more detail that could lead to better predictability. Ginnie Mae should also determine whether using other models for prepayment and defaults are sufficient for accurately estimating future guarantee fee revenue. 2. Conduct and document sensitivity analyses to determine which cash flow assumptions have the greatest impact on the model. 3. Document how management assumptions are determined, such as those for issuer defaults and mortgage buyout rates. 4. Assess the extent to which management assumptions, such as those for issuer defaults and mortgage buyout rates, can be replaced with quantitative estimates. We provided copies of this draft report to HUD, VA, USDA, OMB, and the Federal Housing Finance Agency for their review and comment. Ginnie Mae (HUD) provided written comments that have been reprinted in appendix III. Ginnie Mae, OMB, VA, and the Federal Housing Finance Agency provided technical comments, which we incorporated as appropriate. USDA did not have any comments. The President of Ginnie Mae wrote that Ginnie Mae is working towards implementing our recommendation for conducting sensitivity analyses relating to issuer risk and behavior, but neither agreed nor disagreed with our other specific recommendations that are also intended to better ensure that Ginnie Mae is developing the most accurate model for estimating costs and revenues. Rather, Ginnie Mae noted that limited funding and resources constrained its ability to develop its model to forecast cash flows for the program consistent with our recommendations. However, as we also note, Ginnie Mae devoted significant resources to designing its models, but did not fully implement certain practices identified in FASAB guidance when redesigning its model. More specifically, Ginnie Mae hired a contractor in 2009 to redesign its model over a 2-year period, which cost approximately $1.8 million. The expected additional cost for the subsequent 3-year period of the contract is $193,000. Ginnie Mae agreed with a number of our findings. In particular, the President of Ginnie Mae noted that he agreed with the report’s analysis that limited staff, substantial reliance on contractors, and the need for modernized information systems are operational risks that Ginnie Mae can face. In addition, Ginnie Mae agreed with our observation about the importance of completing ongoing and planned initiatives for enhancing its risk-management processes, as soon as practicable, to improve operations. Finally, while Ginnie Mae agreed that its model could be further enhanced by incorporating some general FASAB guidance, the President of Ginnie Mae stated some aspects of the guidance did not provide a relevant framework for the nature of Ginnie Mae’s business. We recognize these differences, and as discussed in the report, our analysis focuses on particular aspects of FASAB guidance that are specific to developing cost estimate models and we believe the guidance that we cite provides a relevant framework for Ginnie Mae. Ginnie Mae also discussed a number of other issues that were beyond the scope of this review. For example, Ginnie Mae stated that its negative credit subsidy calculation is overstated because OMB currently does not allow Ginnie Mae to reduce the negative subsidy to reflect administrative costs. Additionally, Ginnie Mae noted that FCRA-type accounting presented a challenge because the agency could not use funds generated from previous fiscal years’ negative subsidy payments to cover the cost of defaulted issuers. For this study, we did not assess the accounting that Ginnie Mae is required to perform. To achieve the objectives of this report, we reviewed Ginnie Mae’s financial statements and their subsidy estimate and re-estimate to understand how Ginnie Mae’s portfolio may affect financial exposure to the federal government and how well Ginnie Mae has been managing this exposure. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Housing and Urban Development, appropriate congressional committees, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact Mathew Scirè at sciremj@gao.gov or (202) 512-8678. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To describe changes in the Government National Mortgage Association’s (Ginnie Mae) market share and volume, we collected and analyzed data from Ginnie Mae and Inside Mortgage Finance, a firm that collects data on the primary and secondary mortgage markets. The data from Ginnie Mae covered fiscal years 2005–2010 and part of fiscal year 2011 (October 2010 through June 2011). We analyzed information on the number and types of institutions that issue Ginnie Mae-guaranteed mortgage-backed securities (MBS) and the share of outstanding MBS by type of issuers. We included information on the amount of federally insured and guaranteed mortgages pooled into new Ginnie Mae- guaranteed MBS; the amount of new guaranteed MBS backed by reverse mortgages, multifamily loans; and the volume of Ginnie Mae structured products. The data from Inside Mortgage Finance covered calendar years 2005–2010. We analyzed information on the volume of MBS issuance by Ginnie Mae issuers, private-label issuers, and government-sponsored enterprises, and cumulative outstanding guaranteed MBS. We assessed the reliability of the data provided by Ginnie Mae by reviewing documentation on the systems that produced the data, performing electronic testing, and conducting interviews with relevant officials at Ginnie Mae and its contractors. To assess the reliability of the data provided by Inside Mortgage Finance, we interviewed an official at the firm and reviewed documentation that describes how market information is collected. We determined that the data were sufficiently reliable for the purposes of this report. We also reviewed Ginnie Mae’s 2009 and 2010 reports to Congress. To describe the reasons for changes in Ginnie Mae’s market share and volume, we interviewed officials from the Department of Housing and Urban Development (HUD)—more specifically, from Ginnie Mae, the Federal Housing Administration (FHA), Office of the Inspector General, Public and Indian Housing; the Department of Agriculture’s Rural Housing Service; the Department of Veterans Affairs; Fannie Mae and Freddie Mac (government-sponsored enterprises); the Federal Housing Finance Agency and the Mortgage Bankers Association. To assess the types of risks Ginnie Mae faces and how it manages these risks, we conducted a literature review of risks that may be prevalent in the MBS market for Ginnie Mae and government-sponsored enterprises. We also interviewed officials from Ginnie Mae, Fannie Mae, and Freddie Mac to determine what risk these agencies face and how they are managed. From this review and discussion, we identified counterparty and operational risk as the key risks facing Ginnie Mae. For both of these risks, we reviewed and identified principles in our internal control and management tool relevant to managing these risks. We also identified human capital principles in our prior work on the topic. We compared these principles to the steps that Ginnie Mae took to manage its risk. For operational risk, we focused on risks present in the agency’s management of human capital, contracting, and technology. We assessed Ginnie Mae’s staffing and organizational realignment plans to determine if Ginnie Mae developed strategies to address gaps in staffing needs and evaluated its organizational structure and made changes based on changing conditions. We collected information on the number of full-time equivalent positions requested, authorized, and actual in 2005– 2010 and part of 2011 (October 2010 through June 2011). We assessed the reliability of the information provided by reviewing documentation that HUD’s budget office and Ginnie Mae’s administrative officer maintain and conducting interviews with relevant officials. We determined that the data were sufficiently reliable for the purposes of this report. We reviewed HUD’s 2004 Resource Estimation and Allocation Process study. We also reviewed proposed 2012 budget documents produced by the Office of Management and Budget. To assess how Ginnie Mae managed risks associated with contracting, we reviewed Ginnie Mae’s guidance and other HUD and federal contracting standards. We obtained and analyzed Federal Procurement Data System-Next Generation data to determine the amount of Ginnie Mae contract dollars awarded from 2005 to 2010. We assessed the reliability of the data by reviewing documentation on the systems that produced the data, conducting interviews with relevant officials at Ginnie Mae and HUD’s Office of the Chief of Procurement, and reviewing the internal controls on the data. We also reviewed the number of active contracts and orders during that time period. We reviewed a nonprobability sample of 14 contracts selected either because the activities involved represented a core business function or Ginnie Mae identified the activities as key business functions that could result in operational risk if problems occurred with the contract. In addition, we examined a nonprobability sample of 33 third-party Contract Assessment Reviews conducted between 2005 and 2010. We also interviewed 7 contractors from our nonprobability sample of 14 contracts to gain an understanding of the work performed and how they were monitored. The interviews included four contractors that received some of the largest obligation amounts from 2005–2010 and three third-party contractors who conducted reviews on the majority of these contracts. We interviewed Government Technical Representatives for five contracts to understand their role and how they monitored contracts. We also reviewed risk assessments conducted by Ginnie Mae and its review contractor in December 2010 and June 2011 and determined if these studies followed our principles (from our internal control and management tool) for agencies to consider risks associated with major suppliers and contracts. We reviewed the 2011 performance plans for senior management that contained directives to assess contracts. In addition, we met with HUD Inspector General officials and reviewed Ginnie Mae financial statements from 2006 to 2010, management letters from 2008 to 2010, and program audits on the MBS program and information technology. To assess how Ginnie Mae managed risks associated with its information technology, we reviewed Ginnie Mae’s information technology improvement initiative and discussed the initiative and additional plans with Ginnie Mae officials. For counterparty risk, we assessed Ginnie Mae’s MBS policies and guidance, including processes for issuer approval, monitoring, and enforcement. We interviewed Ginnie Mae officials and contractors about how issuers are approved and monitored and the changes made to these processes in recent years. We collected and reviewed data from Ginnie Mae from 2005 to 2010 and part of 2011 (October 2010 through June 2011) and described the number of new issuer applications, approvals, reviews, and findings. We assessed the reliability of these data and determined they were reliable for our purposes. In addition, we met with HUD Inspector General officials and reviewed 2008 and 2009 program audits on the MBS program. We also reviewed A-123 internal control reviews performed by a third-party contractor from 2006 to 2011 to determine the types of findings and recommendations on Ginnie Mae’s approval, monitoring, and enforcement processes. We reviewed Ginnie Mae’s risk committee minutes from 2008 to 2010 to determine the role of the committee and how risks were monitored. We reviewed documentation on a nonprobability sample of 10 issuers to understand the types of monitoring Ginnie Mae and its contractors conducted. To select the issuers, we used a certainty sample to select the three largest issuers based on overall portfolio size and also one newly approved issuer approved after Ginnie Mae made changes to its process. The other six issuers were selected at random and included three that were on Ginnie Mae’s watch list and three that were not. We also selected 5 of the 10 issuers to interview based on size, institution type, and results from monitoring reviews. Two of the issuers selected also were investors and sponsors of structured products. We also looked at examples of monthly and quarterly reports prepared by Ginnie Mae’s contractor that report such information as issuer performance thresholds. We reviewed documentation on risk-management ideas, planned initiatives, and risk assessments performed by the agency’s contractor. We also reviewed the performance plans of senior management in the office of the Chief Risk Officer and the Office of Mortgage-Backed Securities to determine what goals were in place for the year. To determine how recent changes in Ginnie Mae’s market share and volume might affect financial exposure to the federal government and the agency’s ability to meet its mission, we interviewed officials from Ginnie Mae and its contractor that conducts modeling, the Office of Management and Budget, and FHA. We reviewed Ginnie Mae’s guidance and financial statements. We obtained and analyzed data on the potential risks of changes in Ginnie Mae’s market share and volume on its mission. More specifically, we analyzed data on FHA and Department of Veterans Affairs loan securitization rates from Inside Mortgage Finance for calendar years 2005–2010. To gain an understanding of how Ginnie Mae’s program might produce financial exposure to the federal government, we obtained data from Ginnie Mae on issuer defaults, including the number of pools, loans, and remaining balance of the assets needed to be serviced from 2005 to 2010 and part of 2011 (October 2010 through June 2011). We also obtained data as of June 30, 2011, on the associated costs Ginnie Mae incurred due to issuer defaults. We analyzed Ginnie Mae’s revenue and expense data to identify the extent to which its guarantee fee revenues covered its costs from 2005 through 2010 and part of 2011 (October 2010 through June 2011). We assessed the reliability of the data provided by Inside Mortgage Finance and Ginnie Mae by means such as interviewing relevant officials and reviewing documentation on the systems that produced the data. We determined that the data were sufficiently reliable for the purposes of this report. In addition, to determine how Ginnie Mae forecasts costs and revenues, we reviewed the Federal Credit Reform Act of 1990 and budget documents produced by the Office of Management and Budget. We also reviewed Ginnie Mae’s statutes and documentation related to the development of the annual subsidy estimate, including the credit subsidy re-estimate for 2010 and Ginnie Mae’s model used to forecast cash flows. Furthermore, we reviewed Federal Accounting Standards Advisory Board guidance for cost estimation of federal credit programs, academic research on risk budgeting, and FHA’s 2010 actuarial review. We compared this information with Ginnie Mae’s revised model. We conducted this performance audit from September 2010 to November 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. As mentioned previously, Ginnie Mae has several planned and proposed initiatives to address operational and counterparty risk. Table 3 provides a listing of these plans. In addition to the contact named, Andy Pauline (Assistant Director), Serena Atim Agoro-Menyang, Jennifer Alpha, Marcia Carlsen, Kathryn Edelman, Carol Henn, Julia Kennon, John McGrail, Luann Moy, Marc Molino, Nadine Garrick Raidbard, Paul G. Revesz, Barbara Roesmann, and Heneng Yu made key contributions to this report.

Summary: The Government National Mortgage Association (Ginnie Mae) has increased its role in the secondary mortgage market significantly. Ginnie Mae is a wholly owned government corporation in the Department of Housing and Urban Development (HUD). It guarantees the timely payment of principal and interest of mortgage-backed securities (MBS) backed by pools of federally insured or guaranteed mortgage loans, such as Federal Housing Administration (FHA) loans. GAO was asked to (1) describe how Ginnie Mae's volume of MBS and market share have changed, (2) assess the risks Ginnie Mae faces and how it manages these risks, and (3) determine what effect recent changes in Ginnie Mae's market share and volume may have on financial exposure to the federal government, including mission. To address these objectives, GAO analyzed data on volume and market share and assessed their reliability. GAO also reviewed guidance and Ginnie Mae's credit subsidy calculations and estimation model, and interviewed agency officials and others. From 2007 to 2010, the volume of Ginnie Mae-guaranteed MBS and its share of the secondary mortgage market increased substantially. Ginnie Mae-guaranteed MBS outstanding grew from $412 billion to more than $1 trillion, and market share grew from 5 percent to more than 25 percent. As the demand for FHA and other federally insured or guaranteed mortgages grew during this time, financial institutions increased their issuance of Ginnie Mae-guaranteed MBS to finance these federally insured or guaranteed loans. Ginnie Mae has taken steps to better manage operational and counterparty risks, and has several initiatives planned or underway. The agency may face operational risk--the risk of loss resulting from inadequate or failed internal processes, people, or from external events--and counterparty risk--the risk that issuers fail to provide investors with monthly principal and interest payments. GAO and others, including HUD's Inspector General, have identified limited staff, substantial reliance on contractors, and the need for modernized information systems as operational risks that Ginnie Mae may face. For example, although Ginnie Mae's market share and volume of MBS have increased in recent years, its staffing levels were relatively constant and actual staff levels trailed authorized levels. In addition, between 2005 and 2010, the agency increasingly relied on contractors. Ginnie Mae has identified gaps in resources and conducted risk assessments on its contracts but has not yet fully implemented changes based on these analyses. To manage its counterparty risk, Ginnie Mae has processes in place to oversee MBS issuers that include approval, monitoring, and enforcement. In response to changing market conditions and increased market share, Ginnie Mae revised its approval and monitoring procedures. Ginnie Mae also has several planned initiatives to enhance its risk-management processes for issuers, including its tracking and reporting systems, but these plans have not been fully implemented. It will be important for Ginnie Mae to complete these initiatives as soon as practicable to enhance its operations. The growth in outstanding Ginnie Mae-guaranteed MBS resulted in an increased financial exposure for the federal government as Ginnie Mae fulfills its mission of expanding affordable housing by linking capital markets to the nation's housing markets. Nonetheless, Ginnie Mae's revenues have exceeded its costs and it has accumulated a capital reserve of about $14.6 billion. However, GAO found that in developing inputs and procedures for the model used to forecast costs and revenues, the agency did not consider certain practices identified in Federal Accounting Standards Advisory Board (FASAB) guidance for preparing cost estimates of federal credit programs. Ginnie Mae has not developed estimates based on the best available data, performed sensitivity analyses to determine which assumptions have the greatest impact on the model, or documented why it used management assumptions rather than available data. By not fully implementing certain practices identified in FASAB guidance that GAO believes represent sound internal controls for models, Ginnie Mae's model may not use critical data which could affect the agency's ability to provide well-informed budgetary cost estimates and financial statements. This may limit Ginnie Mae's ability to accurately report to the Congress the extent to which its programs represent a financial exposure to the government. Ginnie Mae should enhance the model it uses to forecast cash flows for the program by (1) assessing potential data sources, (2) conducting sensitivity analyses, and (3) assessing and documenting its modeling approaches and reasons for using management assumptions, among others. In written comments, Ginnie Mae agreed with GAO's recommendation to conduct sensitivity analyses, but neither agreed nor disagreed with the other recommendations.