Where Were the Banks’ Internal Controls?

After suffering through one of the worst crises in financial history, the big banks that survived the collapse in 2008 now find themselves dealing with another crisis: the foreclosure fiasco. First, banks lost billions on bad home mortgages and now they're finding they often don't have proper paperwork showing ownership of the properties on which they're trying to foreclose.

You would think these financial institutions would know something about internal control by now, but what's transpiring causes one to question that presumption quite seriously, to say the least.

Adding insult to injury, bank officials' claims during legal proceedings that loan files were reviewed for required documentation tuned out not to be true. With some banks' foreclosure processes on hold, homeowners who defaulted on mortgages remain in their homes. Buyers, meanwhile, are unable to complete transactions, putting the entire housing market on shaky ground once again.

The problem first came to light when GMAC announced it was withdrawing affidavits in pending court cases and suspending certain foreclosures to give it time to investigate its procedures. JPMorgan Chase and Bank of America soon followed by suspending foreclosures in certain states. Wells Fargo initially said its foreclosure processes were accurate but then said it would correct and refile documents because its employees didn't “strictly adhere” to its requirements. With enough evidence to indicate potentially widespread industry problems, the attorneys general of all 50 states launched an investigation into foreclosure practices.

The Why and the How

The current mess began in the 2000s when home prices were soaring and banks were writing mortgages with lightening speed. We know that banks spewed out new loans fast and furiously and packaged them into securities sold to investors eager to buy what appeared to be high-quality investments. And now it becomes clear that servicing took a back seat, with insufficient attention to the basics of internal control.

Going back to basics, we know that different internal controls are aimed at achieving different business objectives. Some support the reliability of financial reporting, which we've come to know so well with the reporting requirements of the Sarbanes-Oxley Act. Others are aimed at helping ensure compliance with laws and regulations affecting a company. And the rest are there to see that the company's business objectives are achieved, including protecting assets such as mortgage loans and underlying collateral and related income streams. (Some controls, of course, are in place to accomplish objectives in multiple categories.)

With that in mind, let's look at reported transgressions:

Fraudulent or otherwise improper notarizations on mortgage assignments and problems with documents transferring ownership of the underlying note from one institution to another.

Improprieties in original documents compiled as part of the foreclosure process.

“Robo-signers” at mortgage servicers, attesting that they reviewed the accuracy and completeness of loan files—to the tune of hundreds per day, indicating such reviews had not taken place.

How could this have happened? Well, media reports say JPMorgan Chase staffed its mortgage servicing department with “Burger King kids—walk-in hires so inexperienced they barely knew what a mortgage was.” At Citigroup and GMAC work was “outsourced to frazzled workers, who sometimes tossed the paperwork into the garbage,” according to one report. And at a Goldman Sachs' mortgage servicing arm employees are alleged to have processed foreclosure documents so quickly they could not possibly have had time to read them.

And then there is the shuffling of mortgage documentation work to outside contractors. Citigroup, GMAC, and other banks outsourced much of the foreclosure effort to law firms later accused of shoddy work. One firm in turn outsourced the work to firms in Guam and the Philippines. A law firm employee said in a deposition that “the girls would come out on the floor not knowing what they were doing … Mortgages would get placed in different files. They would get thrown out. There was just no real organization when it came to the original documents.” Another testified that she and other employees of a law firm were trained to forge signatures, and did so repeatedly.

Fortunes have been lost on technicalities. Internal controls can be called technical or many other things, but we know they are extremely important, especially when billions of dollars are at stake.

And then there's the matter surrounding the Mortgage Electronic Registration System (MERS) set up by the banking industry to facilitate mortgage securitization with an ancillary benefit of not having to pay local registration fees each time a mortgage changed hands. Reportedly a whopping 60 percent of mortgages in the United States are recorded as owned by MERS, but that ownership is now in question. One federal judge blocked a bank trying to foreclose, saying the borrower was likely to win that, arguing use of MERS invalidated the mortgage. Media reports highlight work of two academics saying MERS recording mortgages in its own name could violate precedents barring separation of a mortgage from the underlying note. They point to a Supreme Court decision going back to 1879, holding “the assignment of the note carries the mortgage with it, while the assignment of the latter alone is a nullity”—in which case, they say, the mortgage could no longer be enforced.

So how did these banks deal with the basics of internal control, including such matters central to the control environment, such as commitment to competence, organizational structure, management protocols, personnel standards, and assignment of authority and responsibility? Where was the identification and analysis of risk, specifically the risk that significant numbers of foreclosures would require reliable documentation for use in foreclosure? And where were the control activities to ensure document processing was accurate and complete, with files intact and readily accessible when needed? Or the due diligence in selecting and using outsourcing firms? We know internal control systems extend to service providers acting on behalf of a company, and the critical importance of seeing that outsourcers' control systems meet the company's standards.

The answers to these and related questions appear to be self-evident. There seems little doubt that the focus of attention from upper management on down was to reap the immediate rewards of generating and selling mortgages, with standards lowered and document processing a still lower priority. And when it came time to bring forth documentation in the foreclosure process, once again it seems the focus was on speed and quantity rather than accuracy.

Some bank officials have called the problem simply a “technicality.” Well, fortunes have been lost on technicalities. Internal controls can be called technical or many other things, but we know they are extremely important, especially when billions of dollars are at stake.

The Implications

It's not a problem that is going away anytime soon. According to one analyst the “problem will last at least four or five years, maybe a decade [and] in the short term it could easily cost $1.5 billion per quarter.” Other estimates put the figure at $6 billion to $10 billion. And recently, the Financial Fraud Enforcement Task Force, a coalition of federal agencies and United States attorney's offices, announced this foreclosure issue is its “priority No. 1.”

Beyond foreclosures, problems still go back to the original lending activities, regarding whether the loans packaged and sold to investors adhered to the stated underwriting standards. According to one report, “if it turns out that mortgages were bundled together and sold improperly, more holders could sue the banks and force them to buy back tens of billions in mortgage-backed securities.” A hedge fund manager has suggested that Bank of America is potentially exposed to over $70 billion in losses from mortgage securities that it may have to repurchase from Fannie Mae, Freddie Mac, and private investors. Other analysts estimate liabilities on improper underwriting standards for the industry as a whole will range from $20 billion to as much as $179 billion.

This story will continue to unfold, but hopefully the lessons of the critical importance of “mundane” internal controls will not soon be forgotten.