you know its bad when...

management has such a strong-hold over internal audit that they have convinced the internal auditors to not only conduct an audit, but also write the audit response for management.

wtf.

I am experiencing something similar to that.

wow...you are kidding me!

i wish i was kidding. but, i'm not.

When I was an auditor in a prior life, we would write the issue and the recommendation. The response was up to management. In most cases, if they agreed with us, their reponse would be the recommendation put into the affirmative. If they did not give us a response in a timely fashion, it got bucked up the chain of command.

As a former auditor, we always wrote up the issue and recommendation and management responded with corrective action.

This sounds like a conflict to me.

more than once in my life i've been "coached" by internal audit on how to respond to a comment. Remember that the purpose of internal audit is to work with you to identify your weaknesses or vulnerabilities, and to take steps to correct them. It is about making the bank safer. I have no issues with IA providing assistance in that capacity, as long as there is no pressure brought to change an audit comment or leave out negative comments.

This might, actually, not be as bad as it initially sounds. Depends. If IA is writing "management fixed xyz problem during the audit" and that's not a true statement, then there's a problem. If IA is writing a management response that says "management commits to researching and implementing a fix to this issue during 1st Quarter 2011" and management is on board with this plan and timeframe AND someone in management follows through and does this... well then it doesn't matter if IA or mgmt wrote the actual response.

Management probably asks employees to write their own reviews too. Done that several times.

I know of a bank where management told the auditors what would be included as a finding in the report and picked the sample for the auditors. When I explained this was a problem, no one understood why.

Was that the same bank where someone (other than their author) changed audit findings before they were submitted?

I came into an email this morning from the SVP of Sales asking why we are concerning ourselves with doing QC audits on the loans we book and fund in our name and immediatley sell to the secondary market, you know since they have their own resources to do QC and they are buying the loans and all, why are we wasting our resourses. He would like to understand the need and relevance of doing so.

Apparently someone doesn't like our recent findings

Yes it was.

Some of these places are really scary.

That those places probably complain about regulatory reform the loudest.

That SVP's attitude, when institutionalized, is one of the several causes of the major mortgage market meltdown. When lenders were able make 'em, sell 'em, and forget 'em, they got the idea that they could get away with all sorts of loose practices and shift the risk of the buzzards coming home to roost to the secondary market. That is one of the main reasons that Dodd-Frank will be requiring securitizers of mortgage loans to retain part of the credit risk in those loans when they are sold.

Piggybacking on what John just mentioned, the correspondents are going to do a QC. It would be better if the lender understood what the problems were, changed the procedures to ensure that they did not re-occur and provided training.

The fact that a correspondent buys a loan does not mean that they have full confidence in the bank and that the loan is theirs forever and ever. Through the representations and warranties that your bank issued, if there is a problem, the correspondent can force the bank to buy the loan back and charge the bank for doing it. If there are significant problems or issues, they may do a 100% validation of everything the bank sold to them.

Banks sell in the secondary market mainly for liquidity. If (for example) Citi, Chase, etc. viewed the purchased loans as a higher risk, the bank could be forced into buying every one back that is not 100% accurate - any reason. Additionally, if they did not cut the bank off, it may be reclassified to a higher risk rating (e.g. dropping from a platinum to a gold or gold to silver rating), with a corresponding change in the pricing to reflect the risks.

It's all about the quality of the product the bank sells, and the pride of management in getting it right.

Our bank recently finished an FDIC compliance audit. The examiner specifically asked for and reviewed several files of loans sold to secondary market. Those files are not one and done and forgotten as some assume.

Same thing here, examiners looked at several secondary market mortgages during our last compliance exam. We also sample them during our internal monitoring. If the Lending area isn't getting them right for secondary market loans, they probably aren't getting them right for our own portfolio either. Just my experience.

We write all our loans to secondary market standards regardless of if they stay in portfolio or not. Makes things much easier that way!