Ten Core Competencies in a Compliance Management System

Jonathan Foxx

President & Managing Director

Lenders Compliance Group

In my view, there are ten core competencies to implementing a Compliance Management System, often referred to by its acronym CMS. The Consumer Financial Protection Bureau requires it, state regulators are now asking for it, and investors want assurance of its application.

I have written extensively about the CMS concept and its importance in mortgage risk management. For instance, see my article on Creating a Culture of Compliance. Also, other articles here. When I speak on the subject, it is often the case that some in the audience actually have no idea about what constitutes the CMS. They think it is no more than a compilation of policies and procedures. But, the fact is that a viable CMS is composed of several integral features, each of which contributes to the cohesiveness of the whole compliance function.

Here’s a brief synopsis of the Ten Core Competencies that should inform a CMS:

1)      Loan portfolio, secondary and capital market management processes, mortgage servicing.

2)      Loan flow process, from point of sale to securitization or secondary market transaction.

3)      Internal Audit and Control Plan, including calendrical reviews, reporting protocol, rank and file training in all departments, and testing.

4)      Consumer disclosures, all loan types, federal and state.

5)      Mortgage quality control, not only random sampling, but proactive audits that target criteria.

6)      Record retention and maintenance, securing against unauthorized alteration or destruction.

7)      Marketing and advertising, including use of third-party services.

8)      Vendor, settlement agent, closing agent, and third-party vetting and approvals.

9)      Safeguards for privacy protection of consumer records and information.

10)   Reporting mandates to agencies, both federal and state, investors, and third-party relationships.

The compliance framework is built on the foregoing competencies. Destabilize one of them and it is possible that the others will crash like a tottering stack of cards!

Also, it should be noted that there is a growing expectation amongst regulators for a residential mortgage lender or originator to have a business continuity plan.

It is not necessary to consolidate all compliance policies and procedures into a single document. Nor does it require compliance managers to memorialize every action that must be taken in order to remain in compliance with federal and state banking law. In some cases, it may be enough for the compliance policies and procedures to allocate responsibility within the organization for the timely performance of many obligations, such as the filing or updating of required forms.

However, observed instances in which compliance policies and procedures were not followed or the actual practices were not consistent with the description in the compliance manuals, will likely lead to an adverse banking examination finding. Observed practices in areas that are required to be reviewed in accordance with specific regulations and in areas that include policies and procedures, but are not expressly required to be reviewed by regulations, will come under significant regulatory scrutiny.

What good is a compliance management system if it is not continually reviewed and, where needed, updated? In our work with new clients, we have found the following issues happening often:

·         Critical areas not identified, thus certain compliance policies and procedures were not adopted.

·         Policies were adopted, but were not applicable to the businesses and operations.

·         Critical control procedures were not performed, or not performed as described in the CMS.

·         Annual Review of the compliance function was rarely, if ever, implemented.

During examinations, an examiner may observe certain compliance weaknesses. But examiners review periodically, not continually, in most cases. The rest of the time, the residential mortgage lender or originator should be self-assessing the compliance programs in order to spot weaknesses, particularly with respect to identifying applicable mortgage compliance risks, and thereby ensure that the compliance management system encompasses all relevant business activities.