The full text on this page is automatically extracted from the file linked above and may contain errors and inconsistencies.
Federal Reserve Consent Order – JPMorgan Chase Response
Executive Summary
The Board of Directors of JPMorgan Chase & Co. (JPMC Board) recognizes its obligation to
ensure that JPMorgan Chase Bank, National Association (Bank) has the appropriate financial
and managerial resources to meet the requirements of the Federal Reserve Board of Governors
and the Office of the Comptroller of the Currency (OCC) Consent Orders issued April 13, 2011.
The Orders require significant actions to enhance the Bank’s Compliance, Audit, and Risk
programs and to aggressively improve the state of controls for residential mortgage loan
servicing, loss mitigation, and foreclosure activities. The Bank is taking those actions, which are
provided as “FRB Consent Order Action Plan Milestones” in this submission.
Source of Strength
The Bank has developed an Action Plan to address OCC Articles IV through XII, which relate to
redefining core business controls including policies and procedures, data integrity, staffing,
training, fee management, third-party oversight, and management reporting. Deloitte & Touche
LLP has been engaged as the independent consultant to conduct independent Foreclosure
Reviews required under both Orders. A Consent Order Steering Committee has been created
and is responsible for setting overall program direction, monitoring progress and results,
ensuring compliance with the Order, and serving as a point of escalation to resolve issues. The
Consent Order Steering Committee meets on a weekly basis to review the status of the
progress with respect to the Consent Order Action plans. During this meeting, progress against
key milestones, interdependencies and issue identification and remediation are discussed.
In February 2011,
of JPMC and Head of Home
Lending, established a weekly Home Lending Metrics Meeting representing a focused approach
to managing and governing the business. An executive summary of the metrics report from this
weekly meeting is produced and provided to senior management, including Jamie Dimon, CEO
of JPMC and Chairman of the Board. In addition, Home Lending has added staff in key areas.
Board Oversight
The principal functions of the JPMC Board are to oversee processes for evaluating the
adequacy of internal controls, risk management, financial reporting, and compliance with law
and the code of conduct. The purpose of the Audit Committee is to assist Board oversight of
the performance of the corporation's internal audit function and independent registered public
accounting firm and management's responsibilities to assure that there is in place an effective
system of controls reasonably designed to safeguard the assets and income of the corporation,
assure the integrity of the corporation's financial statements, and maintain compliance with the
corporation's ethical standards, policies, plans and procedures, and with laws and regulations.
The Risk Policy Committee is responsible for oversight of the responsibilities of the CEO and
senior management to assess and manage JPMC's credit risk, market risk, interest rate risk,
investment risk, liquidity risk and reputational risk, and is also responsible for review of JPMC’s
fiduciary and asset management activities.
In June 2011, the JPMC Board appointed a Joint Subcommittee of the Audit Committee and the
Risk Policy Committee, consisting of Audit Committee Chairman Laban Jackson, and Risk
Policy Committee Chairman James S. Crown, to monitor and oversee JPMC’s compliance with
the requirements of the Order. The Joint Subcommittee will convene at least monthly for the
foreseeable future to review information and reports from JPMC management. The Joint
Subcommittee will report to the Audit Committee, Risk Policy Committee and/or JPMC Board,
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
1
Federal Reserve Consent Order – JPMorgan Chase Response
on the Risk Management program, policies and procedures for managing third-party service
providers, the adequacy of levels of staff, types of officers and staff in JPMC’s Risk
Management, Audit and Compliance programs and the steps taken to improve the information
and reporting to the JPMC Board or an authorized committee of the JPMC Board regarding
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations.
Mr. Crown is also the Chairman, and Mr. Jackson is a member, of the three-person Compliance
Committee of the Board of JPMorgan Chase Bank, N.A., formed in April 2011 to ensure that the
Bank achieves and maintains compliance with the OCC Order, including the successful
implementation of the Action Plan. Frank Bisignano is the third member of the Compliance
Committee.
Enhancements to Compliance, Audit and Risk Management Programs
As required by the Order, JPMC conducted an evaluation of the Home Lending Compliance,
Audit and Risk Management programs to identify enhancements to each program. Compliance
and Risk Management programs were reviewed based on bank holding company and bank
standards for risk control functions as determined by banking regulators, specifically,
components of FRB regulatory guidance including SR8-08/CA08-11, “Compliance Risk
Management Programs and Oversight at Large Banking Organizations with Complex
Compliance Profiles,” and SR 95-51, “Rating the Adequacy of Risk Management Processes and
Internal Controls at State Member Banks and Bank Holding Companies.” Key program
elements were reviewed, including governance, policies and procedures, risk assessment, and
testing and monitoring. The effectiveness of each program element was assessed based on the
current control environment, regulatory reviews and examinations, and deficiencies identified in
enforcement actions for the residential mortgage servicing activities.
While the Compliance and Risk Management programs contained all of the key elements
required, we concluded that the execution of these elements was not sufficient to adequately
address the risks presented by a mortgage business with severe borrower delinquencies and
accelerated loss mitigation and modification program requirements. Moreover, business and
control reporting, overall assessment, and comprehensive view of risks in the mortgage
business were lacking. Specifically, Compliance’s inventory of laws, regulations and
requirements needed to be expanded, risk rated, and the corresponding testing program
expanded appropriately. To address this gap, JPMC engaged outside counsel to compile a
Legal Requirements Matrix, a comprehensive database of Federal, State and investor
requirements for foreclosure actions. Compliance is now analyzing its current testing program
to ensure that it properly addresses applicable legal requirements. Risk management required
a separate, comprehensive risk assessment be conducted to adequately classify risks and
manage remediation for newly identified control issues. The Home Lending Audit Program did
not increase scope and level of audit attention commensurate with the growth and complexity in
business activity. In addition, root cause analysis of audit findings was not consistently provided
to management. Finally, while reporting and status of audit findings were in place, information
provided in control forums and business reviews could have been more focused.
Each program requires enhancement to elevate its effectiveness in a mortgage servicing
environment with significant volume increases in a compressed period of time. Enhancements
for all programs are well underway, with Compliance working with an expanded Legal
Requirements Matrix of laws and regulations, Internal Audit executing its 2011 work plan with
staffing augmented to a significant level, and Risk Management nearing completion on a
comprehensive risk assessment of the mortgage servicing and default activities.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
2
Federal Reserve Consent Order – JPMorgan Chase Response
Source of Strength
1.
The board of directors of JPMC shall take appropriate steps to fully utilize
JPMC’s financial and managerial resources, pursuant to section 225.4(a) of
Regulation Y of the Board of Governors (12 C.F.R. § 225.4(a)), to serve as a
source of strength to JPMC, including, but not limited to, taking steps to
ensure that JPMC complies with the Consent Order issued by the OCC
regarding JPMC’s residential mortgage loan servicing activities.
The JPMC Board has reviewed the Response to the Consent Order, as well as
the Action Plans submitted in compliance with the OCC Consent Order. These
responses contain achievable plans to enhance meaningfully JPMC’s and the
Bank’s Compliance, Audit, and Risk policies, procedures, and practices. The
JPMC Board fully supports, and will ensure that appropriate financial and
managerial resources are devoted to, the efforts to comply with the Federal
Reserve Consent Order and the OCC Consent Order. Specifically,
x
The Bank has developed an Action Plan to address Articles IV through
XII of the OCC Consent Order, which relate to redefining core business
controls, including policies and procedures, data integrity, staffing,
training, fee management, third-party oversight, and management
reporting;
x
Both the Board of Governors of the Federal Reserve System and the
Comptroller of the Currency of the United States have issued letters of
non-objection to the engagement of Deloitte & Touche LLP as an
independent consultant for the purpose of conducting the Foreclosure
Reviews required under Items 3 and 4 of the Consent Order and Article
VII of the OCC Consent Order; and
x
Upon implementation of the Action Plan, a Joint Subcommittee of the
Audit and Risk Policy Committees will continue its oversight of the Bank’s
mortgage servicing, foreclosure and loss mitigation activities.
Response
JPMC established a Consent Order Steering Committee, which is responsible for
setting overall program direction, monitoring progress and results, ensuring
compliance with the Order, and serving as a point of escalation to resolve issues.
The members of the Steering Committee are:
x
Frank Bisignano, who is the CAO of JPMorgan Chase, the Head of Home
Lending, a member of the JPMC Board and a member of the Compliance
Committee of the Board of JPMorgan Chase Bank, N.A.;
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
3
Federal Reserve Consent Order – JPMorgan Chase Response
x
, who is General Counsel for JPMorgan Chase Bank, N.A.;
x
who is General Counsel Home Lending and Senior Legal
Advisor for JPMC;
x
who is the Chief Risk Officer for JPMorgan Chase Bank,
N.A.; and
x
who is the Chief Information Officer for JPMorgan Chase
Bank, N.A.
The Consent Order Steering Committee meets on a weekly basis to review the
status of the effort to comply with the requirements of the Consent Order and the
OCC Consent Order, and to measure progress toward completion of the Consent
Order Action Plans.
Weekly Management Review
JPMC has instituted a weekly Home Lending Metrics Meeting conducted by
in which managers representing every business and region
within Home Lending, and key support and control groups, report on
performance in areas including customer satisfaction and complaints, employee
turnover, market share, critical errors, and control breaks. This weekly meeting
also includes a review of customer complaints to determine and address root
causes. Each week a summary of the metrics report is prepared for senior
management of JPMC, including Jamie Dimon, CEO and Chairman of the Board
of JPMC.
Reporting
Several reporting mechanisms have been enhanced throughout the Home
Lending business and the supporting control functions. These reports have been
developed to address the status of progress and compliance with the Consent
Orders as well as to provide an ongoing status of the Home Lending Business:
x
The weekly report of the Home Lending Metrics Meeting is provided
to the Head of Home Lending and other members of senior
management as well as JPMC’s control groups. This report contains
information measuring performance in areas including customer
satisfaction, employee turnover, market share, critical errors, control
breaks, and customer complaints.
x
The Weekly Consent Order Project Status Report is submitted to the
Consent Order Steering Committee. It includes updates to the
comprehensive action plan, showing key messages, activities,
developments, risks, issues and watch items, as well as upcoming
plans and milestones for the next week. The Steering Committee
issues this weekly report to the Joint Subcommittee of the JPMC
board and meets once every two weeks with the Joint Subcommittee
to review the current report.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
4
Federal Reserve Consent Order – JPMorgan Chase Response
x
The Monthly Home Lending Compliance Update will be reviewed
monthly with Home Lending management, Corporate Compliance,
Risk Management, and Internal Audit. This update report details the
completion status of the Compliance test plan and provides detailed
results and findings in Compliance reports issued that month.
x
The Semi-Annual Assessment of the Global Compliance function is
conducted at the direction of the Bank’s Global Head of Compliance
and reports on the effectiveness and current state of compliance
activities and any identified weaknesses.
x
At least semi-annually JPMC management will report to the Risk
Policy Committee and Audit Committees of the JPMC Board on the
status of the Home Lending control environment and the status of
open control issues, including but not limited to, the Bank’s residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities.
These reports include the status and results of measures taken or to
be taken to remediate deficiencies, and efforts to comply with the
Consent Order.
Action Plan
JPMC has developed, and is currently implementing, comprehensive Action
Plans to address the issues raised in the Consent Order and the OCC Consent
Order. Those Action Plans identify the gaps between the current and the future
state of JPMC’s policies, procedures, and practices; provide the concrete steps
necessary to close those gaps; and provide for establishment of effective
governance procedures. JPMC has committed the financial resources to
implement the Action Plans and to ensure continued compliance with the
Consent Order, the OCC Consent Order, and applicable laws, regulations, and
supervisory guidance. The Board of Directors fully supports, and has devoted
the managerial and financial resources of JPMC to implement, the Action Plans.
Action Plans specific to the Federal Reserve Consent Order are summarized in
the “FRB Consent Order - Action Plan Milestones” schedule, which is provided
as part of this submission. This schedule provides a summary of the milestone,
start and projected end dates.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
5
Federal Reserve Consent Order – JPMorgan Chase Response
Board Oversight
2.
Within 60 days of this Order, the board of directors of JPMC shall submit
to the Reserve Bank an acceptable written plan to strengthen the board’s
oversight of JPMC’s enterprise-wide risk management (“ERM”), internal
audit, and compliance programs concerning the residential mortgage loan
servicing, Loss Mitigation, and foreclosure activities conducted through
JPMC. The plan shall, at a minimum, address, consider, and include:
JPMC has enhanced its board and management structure to provide more
effectively for the monitoring and oversight of JPMC’s activities concerning
residential mortgage loan servicing, Loss Mitigation and foreclosure, as well as
the enterprise-wide risk management (ERM), Internal Audit and Compliance
programs associated with them. This reporting structure includes both the
ongoing review and oversight of JPMC’s compliance with the terms of the
Federal Reserve and OCC Consent Orders, and is designed to ensure
appropriate monitoring and oversight of the Home Lending business once the
Consent Orders are satisfied.
Response
As noted in our response to Item 1 of the Federal Reserve Consent Order,
several new committees, management meetings and reporting mechanisms
have been implemented or enhanced to provide for the review, monitoring and
oversight of the Home Lending business and JPMC’s progress with respect to
our Action Plans in response to the Consent Orders. These forums provide an
opportunity for issues and information to be reviewed by senior management
and are the foundation for reporting and escalation to the JPMC Board and
board level committees. Specifically, there are two significant changes in this
area relating to board oversight. The first is the creation, on June 8, 2011, of a
Joint Subcommittee of the Audit Committee and the Director’s Risk Policy
Committee (Risk Policy Committee) of the Board of Directors of JPMC. The
purpose of the Joint Subcommittee is to monitor and oversee JPMC’s
compliance with the requirements of the Federal Reserve Consent Order. Its
members are: Audit Committee Chairman Laban Jackson, who is Chairman of
Clear Creek Properties, Inc.; and Director’s Risk Policy Committee Chairman
James S. Crown, who is President of Henry Crown and Company. Each is also
a member of the Compliance Committee of the Board of JPMorgan Chase
Bank, N.A., which was created to oversee compliance with the OCC Consent
Order.
The Joint Subcommittee will convene at least monthly to review and consider
information and reports from JPMC management, and to report to the Audit
Committee, Risk Policy Committee and/or JPMC Board, concerning topics
including but not limited to:
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
6
Federal Reserve Consent Order – JPMorgan Chase Response
x
JPMC’s ERM program’s risk management oversight activities with
respect to the Bank’s residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities, particularly with respect to
compliance with applicable legal requirements, and supervisory
standards and guidance of the Board of Governors;
x
JPMC’s adoption of policies and procedures designed to ensure that
JPMC’s ERM program provides proper risk management of
independent contractors, consulting firms, law firms, or other third
parties who are engaged to support residential mortgage loan
servicing, Loss Mitigation, or foreclosure activities or operations. For
more information about timelines for the revised Third Party
Oversight policy, refer to the Risk Management section 7 (a);
x
Steps taken to ensure the adequacy of JPMC’s levels and types of
staffing in JPMC’s ERM, audit and compliance programs dedicated
to overseeing the Bank’s residential mortgage loan servicing, Loss
Mitigation and foreclosure activities, and that the officers and staff
that are involved in those programs have the requisite qualifications,
skills and abilities to comply with the requirements of the Consent
Order; and
x
Steps taken to improve the information and reports that will be
regularly reviewed by the JPMC Board or an authorized committee
of the JPMC Board regarding residential mortgage loan servicing,
Loss Mitigation, or foreclosure activities and operations.
Each week, the Joint Subcommittee members receive the Weekly Consent
Order Status Report Update from the Compliance Committee (as referred to in
Item 1) which outlines Home Lending’s progress toward completion of the OCC
and Federal Reserve Consent Order Action Plans. The Joint Subcommittee
convenes at least monthly to review this report and consider information and
reports from JPMC management.
The second significant change relating to board oversight is the creation, at the
direction of the Compliance Committee of the Board of JPMorgan Chase Bank,
N.A., of the Consent Order Steering Committee, a committee of management,
which is responsible for ensuring compliance with the Consent Orders. A
description of the Steering Committee and its membership and responsibilities
is discussed in detail in Item 1 of this Response. The Steering Committee
meets on a weekly basis to review the progress of efforts to complete the
Consent Order Action Plans. Each week after this meeting, the Steering
Committee prepares a status report to the members of the Compliance
Committee of the Board of JPMorgan Chase, N.A., including the two members
of the Joint Subcommittee of the JPMC Board.
In addition to the weekly reporting to the members of the Compliance
Committee and the Joint Subcommittee, management will provide quarterly
progress reports to the JPMC Board of Directors on compliance with
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
7
Federal Reserve Consent Order – JPMorgan Chase Response
requirements of the Consent Order and the status of control and oversight
initiatives, and at least semi-annually management and/or the independent
control functions, where appropriate, will update the Risk Policy and/or Audit
Committee of the JPMC Board on third party management and oversight,
adequacy of staff in ERM, Audit and Compliance, compliance risk assessments,
and status of Home Lending controls and control issues.
JPMC also has made two key improvements in management practices relating
to monitoring and oversight of JPMC’s activities concerning residential
mortgage loan servicing, Loss Mitigation and foreclosure, as well as the
enterprise-wide risk management (ERM), internal audit and compliance
programs associated with them. The most significant of those is the institution
of a weekly Home Lending Metrics Meeting conducted by
n
which managers representing every business and region within Home Lending,
and key support and control groups, report to the group on performance in
areas including customer satisfaction, employee turnover, market share, critical
errors, and control breaks. This weekly meeting also includes a review of
customer complaints to determine and address root causes. Each week a
summary of the metrics report is prepared for senior management of JPMC,
including Jamie Dimon, CEO JPMC and Chairman of the Board of JPMC.
The second significant management change in this area is the update of the
charter of the Chase Home Lending Risk Management Committee. The
members of the Risk Management Committee include senior business leaders
and representatives from each Risk and Compliance group within JPMC. As
currently chartered, the Risk Management Committee and its subcommittees
will provide a forum for management review and discussion of existing and
emerging risks and reviews all credit, portfolio, operational collateral, loan
integrity and related policies.
The Home Lending business performance, issues and Consent Order progress
are also discussed in JPMC Board subcommittees as detailed in the responses
to Items 5, 6 and 7. Regular reporting on the status of the Home Lending Audit
plan, results, and status of corrective measures will be incorporated into the
Home Lending risk and control forums and business reviews, as well as
provided to the Audit Committee of the JPMC Board. In addition to the regular
reporting, Home Lending management and/or the independent control functions
where appropriate, will be expected to report to the Audit Committee on the
status of the Home Lending control environment.
Item 7 addresses the strengthening of the overall Enterprise Risk management
plans with reference to governance, Third-Party Oversight, and risk policies and
procedures. Action plans and milestones have been identified to further
develop and refine the key risk indicators and metrics that are currently
submitted and reviewed by management, various committees and the Board.
Metrics and reporting currently in place and to be developed will address both
the progress against the Consent Order action plan as well as ongoing
monitoring of the control environment, risks and performance of the Home
Lending business.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
8
Federal Reserve Consent Order – JPMorgan Chase Response
In addition to the weekly status report updates, bi-weekly meetings and monthly
reviews that are presented to senior management, the Joint Subcommittee and
Compliance Committee (both committees composed either largely or entirely of
external board directors), reporting will also consist of quarterly written progress
reports to the Board of Directors on compliance with requirements of the Order,
status of the action plans and status of the control environment. Semi-annually,
in addition to the reporting provided in the quarterly written status reports, JPMC
management and/or the independent control functions, where appropriate, will
update the Risk Policy and/or Audit Committee of the JPMC board on:
x
Risk Management’s program for third-party management and oversight;
x
Adequacy of staff in ERM, Audit and Compliance;
x
Update on servicing, Loss Mitigation and foreclosure activities and
operations, including compliance risk assessment and compliance with
order; and
x
Status of Home Lending control environment and open control issues.
Board reporting frequency and content will continue to be addressed to react to
changes in the risk and regulatory environment as well as to the status of the
Home Lending control environment.
2. (a)
Policies to be adopted by the board of directors of JPMC that are
designed to ensure that the ERM program provides proper risk
management oversight with respect to JPMC’s residential mortgage loan
servicing, Loss Mitigation, and foreclosure activities, particularly with
respect to compliance with the Legal Requirements, and supervisory
standards and guidance of the Board of Governors as they develop;
Response
Risk Policies
Risk policies with firm-wide implications are approved by the Audit Committee
or the Director’s Risk Policy Committee (Risk Policy Committee), and are
submitted to the Board of Directors for their review and approval. The Risk
Policy Committee is responsible for oversight of the CEO’s and senior
management’s responsibilities to assess and manage the corporation’s credit
risk, market risk, interest rate risk, investment risk, liquidity risk, and reputational
risk and it is also responsible for review of the corporation’s fiduciary and asset
management activities. The Risk Policy Committee is chaired by James S.
Crown. The other committee members are David M. Cote, who is Chairman
and Chief Executive Officer of Honeywell International and Ellen V. Futter, who
is President and Trustee, American Museum of Natural History. The Risk
Policy Committee’s charter includes the following authorities and
responsibilities:
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
9
Federal Reserve Consent Order – JPMorgan Chase Response
x
Review with management guidelines and policies to govern the process
for assessing and managing risks;
x
Review benchmarks for and major financial risk exposures from such
risks;
x
Receive and review reports from management of the steps it has taken
to monitor and control such exposures;
x
Review management’s performance against these policies and
benchmarks;
x
Receive and review reports on selected risk topics as management
deems appropriate on an ad hoc basis;
x
Review the corporation’s capital allocation; and
x
Review reports of significant issues prepared by internal risk oversight
functional groups.
The JPMC Board, through its Risk Policy Committee, has adopted a firm-wide
set of risk policies (the “Global Primary Risk Policies”) designed to ensure that
JPMC’s ERM program provides proper risk management oversight with respect
to all of JPMC’s activities. Upon adoption of Firm-wide Policies, the Board holds
management accountable for implementation of these policies and for ensuring
that systems and processes are in place to confirm compliance with these
policies.
As part of the Home Lending enhanced policy review process, Risk
Management will ensure alignment to Global Primary Risk Policies. The most
relevant Global Primary Risk Policies for the Home Lending business are the
Consumer Credit Risk Management, Operational Risk Management, and the
Reputational and Fiduciary Risk Management Policies. Risk Management will
address operational risk and reputational risk in resolving issues identified in the
Federal Reserve and OCC Consent Orders and based on the results of the
comprehensive risk assessment. Market, liquidity and capital risk policies will
be reviewed based on business priorities.
In addition, as denoted in our response to the OCC Consent Order, Article IV
and to Item 5(c) and Item 7(a) herein, Home Lending is enhancing its process
for standardizing, developing, and implementing policies and procedures.
Business management, Risk Management, Legal and Compliance review and
approve policies and, where appropriate, procedures. Policies and procedures
being changed as a result of the Consent Orders will be reviewed and approved
by the accountable senior business owner. This review will include a
determination as to what, if any, policies require escalation to more senior level
management or for subsequent committee review.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
10
Federal Reserve Consent Order – JPMorgan Chase Response
JPMC management and/or the independent control functions, as appropriate,
will report to the Risk Policy Committee of the Board, no less than semiannually, on the ERM program’s risk management oversight of residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities pursuant to
the Global Primary Risk Policies and any more detailed policies related thereto.
Reporting frequency and content will continue to be addressed to react to
changes in the risk and regulatory environment as well as to the status of the
Home Lending control environment. In addition to the quarterly written progress
reports which are presented to the Board, the Risk Policy Committee will report
on these matters to the JPMC Board, as appropriate.
2. (b)
Policies and procedures adopted by JPMC to ensure that the ERM
program provides proper risk management of independent contractors,
consulting firms, law firms, or other third parties who are engaged to
support residential mortgage loan servicing, Loss Mitigation, or
foreclosure activities or operations, including their compliance with the
Legal Requirements and JPMC’s internal policies and procedures,
consistent with supervisory guidance of the Board of Governors;
Third-Party Oversight
The Bank is currently engaged in enhancing the Third-Party Oversight Program
(TPO Program) under Article V of the OCC Consent Order. The Response for
Article V of the OCC Consent Order provides a detailed description of the
Action Plan to enhance the TPO program.
Response
The TPO Program is a Firm-wide, multi-tiered policy and procedure framework
focusing on Third-Party Oversight that sets forth a minimum standard of Firmwide requirements. Firm-wide policy and procedures have been developed to
comply with applicable laws, regulations and OCC guidance (including OCC
Bulletin 2001-47 and Supervisory Letter 2010-55). Home Lending policies and
procedures are consistent with the enhanced TPO Program and a new Firmwide Third-Party Provider Policy, which has replaced the former TPO Standard.
Home Lending policies and procedures have been designed to supplement the
enhanced TPO Program to account for Home Lending-specific requirements,
including the OCC Consent Order. During this process, a cross-functional team
identified gaps in the TPO Program. Based on this gap analysis, JPMC has
developed a draft Firm-wide Third-Party Provider Policy, enhanced Home
Lending Policy and Home Lending Operating Procedures. A draft of the
enhanced Home Lending Policy now encompasses all outside provider
functions, including foreclosure and bankruptcy functions, as well as functions
provided by outside counsel. While implementation of many of the
enhancements to the TPO Program has begun, efforts to strengthen the TPO
Program are ongoing.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
11
Federal Reserve Consent Order – JPMorgan Chase Response
JPMC has strengthened the framework for monitoring, reporting, and escalating
matters concerning Third-Party Providers. Details of Home Lending efforts to
enhance the Third-Party Oversight are further outlined in the response to
Consent Order Item 7 – Risk Management. Third-Party risk reviews will be
become a standing agenda item for the Home Lending Risk Management
Committee, or its appropriate subcommittee, and monthly Home Lending
business reviews. The Firm-wide Third-Party Provider Policy provides for
periodic review by the Board directly or through committees that the Board may
designate, of updates from senior management regarding Third-Party Provider
monitoring and reporting regarding risk, performance, and quality of service.
The Policy was reviewed and approved by the Mortgage Banking Risk
Committee on November 2, 2011.
Board reporting will consist of quarterly written progress reports to the Board of
Directors and semi-annual presentations by JPMC management or the internal
control functions, where appropriate, to the Audit and/or Risk Committees on
compliance with requirements of the Consent Orders, status of the action plans,
and status of the control environment. Semi-annually, JPMC senior
management and/or the independent control functions, where appropriate, will
specifically update the Risk and/or Audit Committee of the JPMC Board on the
program for third-party management and oversight. In addition to the regular
quarterly reports, the Risk Policy Committee will report on such matters to the
JPMC Board as appropriate. Reporting frequency and content will continue to
be addressed to react to changes in the risk and regulatory environment as well
as to the status of the Home Lending control environment.
2. (c)
Response
Steps to ensure that JPMC’s ERM, audit, and compliance programs have
adequate levels and types of officers and staff dedicated to overseeing
JPMC’s residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities, and that these programs have officers and staff with
the requisite qualifications, skills, and abilities to comply with the
requirements of this Order; and
Risk, Compliance, and Internal Audit are structured and organized so as to
maintain independence and authority. Responses to Items 5(b), 6(c), and 7(b)
address action items underway to ensure that JPMC’s Risk Management, Audit
and Compliance programs have adequate levels and types of officers and staff
dedicated to overseeing JPMC’s residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities, and that these programs have officers and
staff with the requisite qualifications, skills, and abilities to comply with the
requirements of this order.
The reporting line for these individuals and organization are outside of the Line
of Business and report directly into the functional heads for Risk (Chief Risk
Officer), Compliance (General Counsel) and Audit (General Auditor).
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
12
Federal Reserve Consent Order – JPMorgan Chase Response
Staffing Adequacy
Compliance
As detailed in the response to Item 5(2), on a quarterly basis, as Compliance
evaluates the actual completion of the test plan versus planned tests for the
quarter, initiatives undertaken by the lines of business, and new regulations and
revisions to existing regulations, Compliance will perform a staffing analysis to
ensure that it has the requisite staffing. Compliance staff numbers will be
included in the weekly submission for the Home Lending Senior Management
meeting, as well as reported in the monthly Compliance report distributed to
Home Lending Senior Management and the JPMC Global Head of Compliance.
On a semi-annual basis, the Global Head of Compliance requires that the
Senior Compliance Managers complete an assessment of the effectiveness of
the Global Compliance Function, which reflects the state of the compliance
activities.
Audit
A revised Home Lending Audit Plan was developed, during which a review of
the adequacy of staffing of the audit function for loan servicing, Loss Mitigation
and foreclosure activities was evaluated. As detailed in the response to Item
6(b), Internal Audit included within its audit scope the effectiveness of the ECP
and ERM with respect to residential mortgage loan servicing, Loss Mitigation,
and foreclosure activities and compliance with the Legal Requirements and
supervisory guidance of the Board of Governors.
Risk Management
The reporting structure within JPMC’s Risk organization (e.g., committees and
Risk Management departments) is designed to promote independence and
objectivity. JPMC reviewed all aspects of the current Risk Management
program and referenced supervisory guidance and industry expert opinion to
ensure that the current structure is aligned with supervisory best practices.
Within the next 90 days, Home Lending Risk Management will also develop
staffing plans related to risk assessment and controls.
The Risk Management organization’s independent role was reinforced and is
responsible to ensure that a comprehensive Enterprise Risk Management
framework exists. The Risk oversight function was expanded with a new Chief
Risk Officer. In addition, Risk Management was reorganized and staff
assessed with a focus on effective oversight of default servicing activities.
Compliance, Audit and ERM Overall
Any additional metrics and reporting enhancements required to address staffing
adequacy and qualifications will be identified by August 12, 2011. Staffing
metrics will be included in the quarterly written progress reports to be submitted
to the JPMC Board of Directors. In addition, at least semi-annually, JPMC
management, and/or the independent control functions, where appropriate, will
report to the Risk Policy Committee and/or Audit Committee of the JPMC Board
on the adequacy of JPMC’s levels, types of officers and staff in JPMC’s risk
management, audit and compliance programs dedicated to overseeing the
Bank’s residential mortgage loan servicing, Loss Mitigation and foreclosure
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
13
Federal Reserve Consent Order – JPMorgan Chase Response
activities, and the qualifications, skills and abilities of the officers and staff of
these programs to comply with the requirements of the Order. As appropriate,
the Risk Policy Committee and/or Audit Committee will report on these matters
to the JPMC Board.
Incentive Compensation for Control Functions
Incentive compensation pools for Control functions (Risk, Finance, Human
Resources, Audit, and Compliance) are determined based on a bottoms-up
assessment of recommended compensation as well as a top-down assessment
of budgetary resources and control area metrics—both qualitative and
quantitative. For corporate-level Control functions (Compliance, plus parts of
Risk, Finance and Human Resources), pool determinations are made by the
CEO in conjunction with the functional head and with input from the Operating
Committee. Audit pool determinations are made by the CEO and the General
Auditor. For line of business-aligned Control functions within Human
Resources, Finance and Risk, pools are determined based on consultation
among the line of business head, the line of business Control head and the
corresponding corporate-level functional head, with ultimate decision owned by
the corporate-level functional head.
Individual incentive compensation awards for employees in Control functions
are driven by a combination of the market value of the role, management’s view
of relative individual performance and the available incentive compensation
pool. Individual compensation decisions are made by an employee’s manager,
with successive levels of review/approval. Risk and Control compensation is not
predominantly based on the performance of the line of business they oversee
so is less subject to variability than compensation for front office professionals.
Revenue generating business managers cannot determine or change the
incentive level of employees in control functions.
Disciplinary Actions
All employees of the firm are subject to the Code of Conduct and are required to
affirm that they have reviewed it on an annual basis.
In January 2010, JPMC implemented enhancements to the provisions in our
equity awards to enable claw back and recovery of incentive awards by the
Firm: (1) for conduct detrimental to the Firm, insofar as it causes material
financial or reputational harm to the Firm or its business activities and (2) for
members of the operating Committee, members of LOB Management
Committees (including the control functions leads) and certain other employees,
failure to properly identify, raise or assess, in a timely manner and as
reasonably expected, risks and/or concerns with respects to risk material to the
Firm or its Business activities. Awards under the Corporate Annual Incentive
Plan (AIP) are discretionary, not formulaic, and in general are based on
performance factors considered for the individual, the function and the firm as a
whole. As such, an employee’s lack of adherence to control policies and
procedures would constitute a performance issue and would result in reducing
or eliminating their AIP award. Depending on the severity of the violation, this
would potentially subject them to corrective action up to and including
termination.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
14
Federal Reserve Consent Order – JPMorgan Chase Response
2. (d)
Steps to improve the information and reports that will be regularly
reviewed by the board of directors of JPMC or authorized committee of
the board of directors regarding residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities and operations, including
compliance risk assessments and the status and results of measures
taken, or to be taken, to remediate deficiencies in residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities, and to comply
with this Order.
As described in the response in Item 1 – Source of Strength, several reporting
mechanisms have been enhanced throughout the Home Lending business and
the supporting control functions. These reports have been developed to
address the status of progress and compliance with the Consent Orders as well
as to provide an ongoing status of the Home Lending Business and in part, form
the basis for reporting to the Board and Board-level committees.
Reporting
An assessment was performed of the reporting and management information
systems to determine if additional reports or changes to reports were required.
The review considered the distribution, and frequency of the reports to ensure
that information, including status of regulatory and Consent Order issues, were
highlighted. Reports were redesigned with a focus on control issues, ownership,
and current status.
Response
The objective of the assessment was to improve business and control
information for senior management and for Board and Board-level committees.
The most significant report changes are the addition of the Joint Subcommittee,
which oversees the Consent Order remediation and the weekly Home Lending
Metrics meeting and report, which provides the Head of the business with
detailed business and control information.
Regular reporting to the Board of Directors of JPMC or one or more of the board
committees regarding residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities include the following:
x
The Weekly Consent Order Status Report is submitted weekly to the
Joint Subcommittee of the Audit Committee and the Risk Policy
Committee.
x
The Home Lending Metrics - Executive Summary is a summary of the
Home Lending Metrics Meeting package and is provided to the
CEO/Chairman of the Board and other members of senior management
as well as JPMC’s control groups. It contains information measuring
performance in areas including customer satisfaction and complaints,
employee turnover, market share, critical errors, control breaks, and
other metrics.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
15
Federal Reserve Consent Order – JPMorgan Chase Response
x
Audit Department Executive Management Reporting is sent to the Audit
Committee monthly.
x
The Semi-Annual Assessment of the Global Compliance function is
conducted at the direction of the Bank’s Global Head of Compliance and
reports on the effectiveness and current state of compliance activities
and any identified weaknesses.
x
Material Matters Requiring Attention, compliance testing and risk
assessment results and open compliance-related audit items will be
reported periodically by Home Lending Compliance to an appropriate
committee or subcommittee of the Board.
Meetings and Reviews
Reporting to Board and Board-level committees has been enhanced with the
Joint Subcommittee focused on Consent Order remediation progress and
additional reporting to existing committees.
Joint Subcommittee of the Audit Committee and Risk Policy Committee
x
At least monthly (and currently every other week), the Joint
Subcommittee convenes to review and consider information and reports
from JPMC management to assist in the oversight and monitoring of
JPMC’s compliance with the requirements of the JPMC Board
subcommittees.
Audit Committee
x
The General Auditor will present four times per year to the Audit
Committee on the status of the control environment in Home Lending.
x
At least semi-annually, JPMC management, or the internal control
functions, where appropriate, will report to the Audit Committee of the
JPMC Board on the status of the Home Lending control environment
and the status of open control issues, including but not limited to, the
Bank’s residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities. As appropriate, the Audit Committee will report on
these matters to the JPMC Board.
Audit and Risk Policy Committees
x
At least semi-annually JPMC management or the internal control
functions, where appropriate, will report on:
o
Residential mortgage loan servicing, Loss Mitigation and
foreclosure activities and operations, including compliance risk
assessments and the status and results of measures taken or to
be taken to remediate deficiencies and to comply with the Order;
and
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
16
Federal Reserve Consent Order – JPMorgan Chase Response
o
The adequacy of Home Lending’s levels, types of officers and
staff in Home Lending’s Risk Management, Audit and
Compliance programs dedicated to overseeing the Bank’s
residential mortgage loan servicing, Loss mitigation and
foreclosure activities, and the qualifications, skills and abilities of
the officers and staff of these programs to comply with the
requirements of the Order.
Board of Directors
x
As appropriate, the Risk Policy and/or Audit Committee will report to the
JPMC Board on any of the above matters presented to them.
x
The next presentation from the Head of Home Lending to the JPMC
Board of Directors is scheduled for July 19, 2011.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
17
Federal Reserve Consent Order – JPMorgan Chase Response
Compliance
5
Within 60 days of this Order, JPMC shall submit to the Reserve Bank an
acceptable written plan to enhance its enterprise-wide compliance
program (“ECP”) with respect to its oversight of residential mortgage loan
servicing, Loss Mitigation, and foreclosure activities and operations. The
enhanced plan shall be based on an evaluation of the effectiveness of
JPMC’s current ECP in the areas of residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and operations, and
recommendations to strengthen the ECP in these areas.
JPMC is committed to enhancing its current Compliance Program with respect
to oversight of Home Lending activities, including residential mortgage loan
servicing, Loss Mitigation and foreclosure activities in accordance with this
Order. To enhance the Compliance Program, the existing compliance
framework was reviewed, its effectiveness was evaluated, weaknesses were
identified and an action plan was developed to address those areas requiring
improvement. The framework was reviewed for alignment with Federal Reserve
Supervisory Letter, “Compliance Risk Management Programs and Oversight at
Large Banking Organizations with Complex Compliance Profiles”, SR8-08/CA
08-11.
Response
To assist in this review and evaluation, in December 2010 Home Lending senior
management engaged KPMG to perform an assessment of controls and of the
monitoring and testing of regulatory compliance within Home Lending. This
assessment included a review of the completeness and accuracy of JPMC’s
inventory of regulations, as well as the testing programs and procedures of the
Home Lending Compliance management functions. The results of KPMG’s
review are incorporated into the relevant conclusions of the overall evaluation
below.
Based on this review, JPMC concluded that the key elements of an effective
Compliance Program were present, but the then-existing Compliance Program,
and the resources devoted to compliance, had not kept pace with the rapid
increase in the number of mortgage defaults, the growth of the employee base,
and the rising compliance risk profile of the areas identified in the Consent
Order. In addition, JPMC concluded that its Compliance Program did not react
quickly enough to challenges in the business environment, including JPMC’s
use of multiple systems and products across three heritage servicing platforms
(i.e., Chase’s own historic platform, as well as the acquired servicing platforms
of Washington Mutual and EMC Mortgage Corporation), certain manual
processes used in the foreclosure process, changing legal requirements, and
an influx of new employees requiring training.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
1
Federal Reserve Consent Order – JPMorgan Chase Response
1. Compliance Testing Program
The Compliance Testing Program is a key mechanism used by JPMC to
assess adherence to applicable laws and regulatory policies across the
Home Lending business. JPMC reviewed the following key areas of its
Testing Program and developed action plans to strengthen each.
a) Inventory – The Testing Program is predicated on a complete and
comprehensive inventory of laws and regulations. JPMC’s review
identified the need for a full inventory of applicable laws and
requirements and an impact assessment across Home Lending to
ensure that its practices keep pace with all applicable laws and
requirements.
JPMC retained the law firm Morgan, Lewis & Bockius, LLP (“Morgan
Lewis”) to assist JPMC in developing a database of the requirements
of relevant state and federal laws, regulatory requirements,
mandatory supervisory guidance, and obligations in investor
guidelines that relate to residential mortgage default servicing, loss
mitigation, and foreclosure. Morgan Lewis compiled, spot-checked
to validate, and supplemented requirements information that was in
use at JPMC, as well as information on legal requirements that
JPMC acquired from the law firms of Buckley Sandler, LLP and
Hudson Cook, LLP. Morgan Lewis also developed information
summarizing the requirements imposed under the United States
Bankruptcy Code, the Service members Civil Relief Act (SCRA), the
servicing guides of the Government Sponsored Enterprises (GSEs),
the Federal Housing Administration (FHA), the Home Affordable
Modification Program (HAMP), and loss share agreements with the
Federal Deposit Insurance Corporation. Morgan Lewis compiled all
of this information into a Legal Requirements Matrix, and provided a
preliminary assessment of the applicability of each requirement to
relevant business processes (e.g., collections, foreclosure, or loss
mitigation).
The Legal Requirements Matrix was provided by Morgan Lewis to
JPMC on May 25, 2011 and was current as of that date. The Legal
Requirements Matrix represents a significant investment by JPMC.
Using the Legal Requirements Matrix, JPMC is developing a
Foreclosure Attorney Compliance Checklist and a Bank Foreclosure
QC Checklist. These checklists are two additional oversight tools
that will enhance monitoring of Bank and foreclosure attorney
compliance with legal requirements. These checklists will be
maintained and updated by the business as the Legal Requirements
Matrix is updated. Compliance will test these checklists for accuracy
and completeness as part of each annual test plan.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
2
Federal Reserve Consent Order – JPMorgan Chase Response
The Legal and Compliance departments are developing a process
for (1) ongoing updating of the Legal Requirements Matrix in
response to regulatory developments and changes to state and
federal laws and (2) communication of such changes to the
business. The development of this update process will be complete
by August 12, 2011. It is currently contemplated that the Bank’s
Legal Department Regulatory Team will monitor and identify
changes in legal, regulatory, and supervisory requirements, and will
(a) suggest updates to the Legal Requirements Matrix, (b)
communicate changes in legal requirements to the applicable lines
of business, and (c) ensure that the applicable lines of business
maintain updated policies, procedures, and training materials that
reflect the current state of legal, regulatory, and supervisory
requirements.
Compliance is using the Legal Requirements Matrix to complete a
comprehensive review of the legal requirements applicable to
Servicing and Default, and to revise and enhance its testing plan for
2011 and beyond. Part of that revision effort is to ensure that any
applicable requirement that is not currently included in the testing
plan is added. Upon conclusion of this “gap analysis,” Compliance
will conduct a resource review to ensure adequacy of resources to
complete both the new 2011 Compliance test plan and the 2012
Compliance test plan. The revised test plan will be implemented on
August 15, 2011.
The Legal Requirements Matrix will be updated quarterly. Each
quarterly update will address changes in requirements identified by
the Legal Department Regulatory Team as described in the
foregoing paragraph, as well as independent research on legal,
regulatory, and supervisory requirements changes conducted or
compiled specifically for the update. JPMC currently plans to retain
Morgan Lewis to conduct the first quarterly update, to be completed
by October 31, 2011.
b) Risk Assessment – Compliance Risk Assessment is discussed in
more detail in Item 5(a) below.
c) Testing Plan Changes – A step-by-step procedure has been
developed for moving, cancelling and updating test plans. The
procedure specifies when the
System (
must be updated, as well as
when and how to notify the Home Lending Compliance management
team of proposed and actual test plan modifications. The
Compliance Director, who coordinates Home Lending Compliance
testing, will maintain a Master Test Plan spreadsheet (MTPS) to
manage, track, monitor and report against test plans. In this way, a
clear picture of the Home Lending Compliance test plan will be
available to management at all times.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
3
Federal Reserve Consent Order – JPMorgan Chase Response
Reporting of testing completion to and approval of plan changes by,
JPMC Corporate Compliance is required, and will be communicated
to senior management in Home Lending and in risk and governance
forums.
Changes to compliance testing plans must be approved by the Head
of Compliance of Home Lending, and will be permitted based on
review and analysis of the following criteria: Internal Audit performing
test, included in another test, duplication of another test, process
change not going into effect as planned, systems change not going
in as planned, etc.
Compliance Test completion rates are not a performance criteria for
Home Lending business management.
JPMC is aware that in previous years, staffing was not adequate to
effectively complete planned testing. This is being addressed and is
discussed in more detail below.
d) Oversight – JPMC Corporate Compliance will enhance its oversight
of the effectiveness of Home Lending’s Compliance Testing
program. A new monthly report, which is sent to and will be
discussed with the Global Head of Compliance, details the
completion status of the Compliance test plan and results of reports
issued that month, as well as a detailed listing of the findings from
each report.
2. Resources
Prior to September 2010, there was no formal process to evaluate
staffing needs in Home Lending Compliance. It was determined that a
complete staffing analysis was required to ensure that Compliance has
the proper structure, roles and personnel to adequately support all
Compliance responsibilities and activities.
Compliance prepared a Staffing Request Matrix that detailed the
proposed position, location, hiring manager, position level and rationale
for additional staff. This matrix was provided to Home Lending, Retail
Financial Services, and Legal and Compliance management for
approval.
The Staffing Request Matrix revealed the need for additional staffing
and, as a result, Home Lending Compliance has been actively adding
resources and upgrading talent throughout the department. In mid2010, a dedicated position of Head of Compliance for Home Lending
was created and filled. The Head of Compliance for Home Lending will
report to the General Counsel of Home Lending.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
4
Federal Reserve Consent Order – JPMorgan Chase Response
In addition, a staffing assessment performed in the 4th quarter of 2010
indicated that an increase in staffing from 30 to 50 compliance
professions was warranted. 15 staff members were hired, some of
whom were placed in the dedicated Compliance Testing group. This
brought the Compliance Testing staff to 21. A further staffing review
conducted in March of 2011 identified that an additional 21 Compliance
professionals were required across multiple compliance functions. Five
of these positions have been filled to date.
Additional resources may be required as a result of an ongoing
assessment of staffing levels in light of the changes in business
operations, the revised testing plans currently under development, and
the changing regulatory environment.
In addition to ensuring that JPMC has the appropriate number of people
to effectively manage all Compliance responsibilities and activities,
JPMC is taking steps to ensure that its Compliance personnel have
appropriate experience and qualifications. JPMC is evaluating criteria
and establishing formal minimum standards for Home Lending
Compliance professionals. As part of its analysis of the Compliance
team supporting the Consent Order deliverables, JPMC completed a
skills assessment detailing the number of years of expertise that each
member of the Home Lending Compliance team has in Compliance,
mortgage banking, risk management, audit, technology and MIS to
ensure that it has professionals with the appropriate skill sets. The skills
assessment demonstrated that the appropriate skill sets are evident on
the team.
Management is committed to adding the necessary additional resources
to ensure an effective Compliance Program. On a quarterly basis for the
next 18 months and then semi-annually thereafter, JPMC will perform a
staffing analysis to ensure the requisite staffing numbers and skills using
the methodology detailed above. Compliance staffing data are included
in the submission for the weekly Home Lending Metrics Meeting and in
the monthly Compliance report distributed to Home Lending Senior
Management and the JPMC Global Head of Compliance.
3. Communication of and Follow Up on Compliance Issues
Although Compliance issues and test findings were tracked historically,
they were not always adequately escalated to ensure that any required
corrective action was taken. During the 4th quarter of 2010, Compliance
started reporting issues requiring attention
, to
assist in escalation of issues to line and senior management. JPMC
reviews these issues, and tracks our progress in remediating them,
during line of business control and risk committee meetings.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
5
Federal Reserve Consent Order – JPMorgan Chase Response
As referred to in our response to Item 2, during the multi-hour weekly
Home Lending Metrics Meeting, business leaders report to the group on
a set of defined metrics against their performance, including customer
satisfaction, employee turnover, market share, critical errors, control
breaks, and many others. Compliance and Internal Audit now report
metrics weekly for inclusion in this review.
Testing results with an unacceptable error percentage are coded as red,
require a
action plan entry, and are reported in the Compliance
Dashboard as part of the monthly Compliance report. The Compliance
report will also be presented at the monthly Home Lending Risk
Management Committee or the appropriate subcommittee as well as at
the monthly meeting with the Global Head of Compliance.
Issues are escalated in testing reports, the monthly Compliance report,
the Risk Committee, and in the weekly Home Lending Metrics Meeting,
and are raised to management’s attention as issues arise.
The line of business, Risk Management, Compliance, and in some
cases Internal Audit are involved in determining when an issue is closed.
For issues noted by a regulatory authority, Compliance will perform
independent testing to ensure that all aspects of the issues noted have
been satisfactorily resolved. The documented evidence for the line of
business and operating risk is uploaded to
and Compliance
records are maintained in
(
For all Matters Requiring Attention and
Matters Requiring Immediate Attention, Internal Audit performs an
additional evaluation to ensure that the item has been satisfactorily
resolved.
4. Board Oversight
Compliance will escalate Matters Requiring Attention, Matters Requiring
Immediate Attention, Compliance Testing, risk assessment results, and
open compliance-related audit items to an appropriate committee or
subcommittee of the JPMC Board.
A Joint Subcommittee of the Audit and Risk Policy Committees of the
JPMC Board was appointed in early June and members meet twice
monthly to oversee JPMC’s progress on enhancing Compliance, Audit
and Risk Management programs.
Board-level and senior management reports for Home Lending are
being reviewed and will be updated to include business and risk
information and metrics where appropriate.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
6
Federal Reserve Consent Order – JPMorgan Chase Response
5. Home Lending Governance Forums
As previously discussed, the weekly Home Lending Metrics Meeting, led
by Head of Home Lending
, has been established as a
key governance forum. During the multi-hour session, business leaders
report to the group on a set of defined metrics against their performance,
including customer satisfaction, employee turnover, market share,
critical errors, control breaks, and many others. Compliance and
Internal Audit now report metrics weekly for inclusion in this review.
The management team also reviews customer complaint backlog and
inventory and discusses ways to analyze and fix the root causes.
The Head of Home Lending Compliance is a standing member of the
Home Lending Risk Management Committee (HLRMC). A monthly
status report detailing Compliance test results, Audit and Examiner
Reports, as well as the significant issues and action plans, will be
discussed and included in the materials presented at the HLRMC. Home
Lending Compliance will continue to participate in line of business
reviews that focus on compliance with laws and regulations.
Home Lending Compliance will also be a key stakeholder in the New
Business Initiative Approval (NBIA) process. Compliance will be
required to review and sign off on every NBIA.
Compliance is also an integral team member of Home Lending’s ThirdParty Oversight (TPO) review process. Compliance has been providing
guidance on the program criteria and will be participating in on site
reviews of vendors that are rated high risk by Compliance.
JPMC has identified the population of vendors that have an impact on
Home Lending’s compliance with regulatory requirements, and is
performing an assessment of which TPO vendor onsite reviews
Compliance will participate in for high risk vendors. Compliance will
contribute questions to the TPO team to be addressed on medium and
low risk reviews. The law firms utilized by Home Lending will be
covered separately and, in addition, will be reviewed by the Home
Lending Attorney Review team.
As part of its assessment, Compliance has identified the following gaps
in the TPO program:
x
Incomplete governance model. The current program is missing a
performance-based model. Relationships are managed in a
piecemeal fashion, leading to inconsistency both within and
across lines of business.
x
No formal TPO Program structure. There is no measurement,
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
7
Federal Reserve Consent Order – JPMorgan Chase Response
monitoring or reporting on the effectiveness of the overall TPO
Program, and no formal structure for communications, issue
escalation or decision-making.
x
Disparate non-integrated systems. There are multiple data sets
about the same third-parties captured in various systems (e.g.,
Risk, Sourcing, and AP) but not integrated. There is no complete
vendor master list and no enterprise portfolio view of
relationships.
Based on this gap analysis and as summarized in the Article V milestones
submitted in response to the OCC Consent Order, the Bank has drafted an
enhanced Firm-Wide Third-Party Provider Policy. The Bank will develop and
implement the following enhanced governance controls for managing mortgage
servicing functions performed by third-parties as part of the enhanced risk
management framework:
x
Processes to perform appropriate due diligence on potential and
current third party provider qualifications, including expertise,
capacity, reputation, complaints, information security, business
continuity and financial viability, adequacy of staffing levels, training,
work quality and workload balance.
x
Policies and procedures to ensure that work outsourced to third
parties is adequately documented, and that, taking a risk-based
approach, third party policies and procedures are assessed by
JPMC personnel.
x
Processes to ensure periodic reviews of third party work for
timeliness, competence, completeness, compliance with applicable
legal and regulatory requirements, and supervisory guidance, and to
ensure safety and soundness of practices.
Home Lending uses a framework to analyze all Third-Party Providers and
assign tiers to prioritize those with the highest risk and business impact,
including law firms providing foreclosure, bankruptcy and eviction services to
the Bank. Based upon this analysis, Home Lending has identified a pilot
population of seven Third-Party Providers to assess based upon the refined
Business Criticality Classifications. The Bank is utilizing this pilot population to
test the enhanced firm-wide TPO framework and tools.
In summary, the Home Lending Compliance program has been modified to
address the following issues that have been identified:
x
The Compliance Program has been expanded across mortgage loan
servicing, Loss Mitigation, and foreclosure activities and operations
to include training and testing related to applicable laws and
regulations. A comprehensive inventory of legal requirements, and a
robust system for monitoring changes in those requirements, has
been developed. The process of reporting to management, Home
Lending Compliance, and the Home Lending General Counsel has
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
8
Federal Reserve Consent Order – JPMorgan Chase Response
been enhanced to communicate the status of the testing program
and transparency on plan changes throughout the year.
x
Additional experienced resources with backgrounds in audit, risk,
compliance, mortgage servicing and default and/or technology have
been added to the Home Lending Compliance team to advise the
business on regulatory requirements and to perform testing. The
size of the team has increased significantly since mid-2010 and will
increase further as 2011/2012 testing programs are revised.
x
Findings from Compliance Testing are now tracked in
the
Bank’s Risk Management System, in order to ensure visibility to
management of the impacted areas. Reporting of compliance
findings has been enhanced and will be communicated in key risk
and governance forums for Home Lending.
x
Compliance now participates in the governance meetings within
Home Lending. Issues deemed to be significant will be escalated to
the Home Lending Risk Management Committee’s Operational Risk
Subcommittee to raise management awareness. Significant issues
could include new regulations impacting mortgage, regulatory
examinations, compliance issues that have been identified and large
remediation efforts.
Further changes to the Compliance team and plan will be considered as the
business model evolves.
5. (a)
Ensure that the fundamental elements of the ECP and any enhancements
or revisions thereto, including a comprehensive annual risk assessment,
encompass residential mortgage loan servicing, Loss Mitigation and
foreclosure activities;
Management is committed to ensuring that the Compliance Program and any
enhancements are comprehensive. This includes the following fundamental
elements of the program, each of which is described in greater detail further
below:
x
Maintaining an inventory of regulations, rule/law changes and regulator
guidance;
x
Performing an annual compliance risk assessment of the Servicing and
Default functions; and
x
Rating the compliance risk on a recurring basis.
Response
Inventory of Regulations, Rule/Law Changes and Regulator Guidance
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
9
Federal Reserve Consent Order – JPMorgan Chase Response
As set forth in detail in Item 5 above, above, the Compliance Testing program is
predicated on a complete and comprehensive inventory of laws and regulations.
JPMC has developed the comprehensive Legal Requirements Matrix (described
in detail in Item 5, above) and Home Lending Compliance is conducting an
analysis to confirm that its Testing Program is consistent with applicable
requirements, and that any gaps are filled. As set forth in more detail above,
changes in legal requirements will be tracked and communicated to the
business, and the Legal Requirements Matrix will be updated:
x
The Legal Requirements Matrix was submitted to JPMC and is now
being reviewed in order to create a revised and enhanced compliance
testing plan for 2011 and beyond. The revised test plan will be
implemented on August 15, 2011.
x
The Legal and Compliance Department is responsible for identifying
regulatory proposals, rule or law changes and regulator guidance that
may have an impact on the Bank’s compliance responsibilities.
Regulatory changes are tracked by the affected Compliance teams.
x
Compliance will develop a process by August 12, 2011 to update the
Legal Requirements Matrix in response to regulatory developments and
changes to state and federal laws, and to communicate these changes
to the business to develop an impact analysis and an action plan. The
Bank’s Legal department will communicate these changes to the
appropriate departments, which will monitor for implementation.
x
Compliance, working with Legal, will ensure that it advises the business
as to how applicable regulatory/legal requirements affect their
businesses, both in the implementation of new requirements and in the
application of existing requirements to particular activities, transactions,
products, practices or controls.
x
JPMC will cause a quarterly update of the Legal Requirements Matrix.
The first of those updates will be complete by October 31, 2011.
Compliance Risk Assessment
Corporate policy dictates that the Compliance Risk Assessment be performed
every 12 months. For Home Lending, the high risk areas and requirements will
be reviewed semi-annually.
x
Compliance works with the business and Legal to identify applicable
laws and regulations impacting the business and the compliance risks
inherent in the application of such laws and regulations to the business,
to assess and document controls in place to mitigate such risks, and to
advise on the residual risks the business faces. The business is
responsible for the risk of non-compliance and must ensure effective risk
mitigation. Compliance risk assessments are completed as a joint
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
10
Federal Reserve Consent Order – JPMorgan Chase Response
exercise by the lines of business and Compliance. Compliance utilizes
the results of these assessments to target compliance testing efforts
following a risk-based approach.
x
Home Lending’s Compliance team utilizes a system to track compliance
assessments and compliance testing, and this system serves as a
repository to identify and categorize risks and controls, report results,
and highlight the existence of compliance risk or areas with inadequate
controls. Minimum standards exist which govern the use of these
compliance risk assessment tools requiring, among other things, that
testing be completed within a 24-month cycle.
x
Compliance is currently evaluating whether a 24-month testing cycle is
appropriate and is in the process of evaluating the appropriate frequency
for high, medium and low rated risks. The minimum standards are
currently being amended. (See excerpt of proposed changes in the
appendix at the end of this matrix).
x
On a semi-annual basis, the Global Head of Compliance requires that
the Senior Compliance managers complete an assessment of the
effectiveness of the Global Compliance function, which reflects the state
of the compliance activities. The assessment reflects the current state of
compliance health within the business, including identified weaknesses.
This recent assessment highlighted several areas where enhancements
were needed, namely the need for additional compliance resources and
more comprehensive testing.
Issues and limitations related to both testing and resources were identified and
reported at year end 2010 as part of the Self-Assessment of Effectiveness of
the Compliance Function.
The assessment indicated that an increase in staffing from 30 to 50 compliance
professions was warranted. 15 staff members were hired, some of whom were
placed in the dedicated Compliance Testing group. This brought the
Compliance Testing staff to 21. A further staffing review conducted in March of
2011 identified that an additional 21 Compliance professionals were required
across multiple compliance functions. Five of these positions have been filled
to date.
Additional resources may be required as a result of an ongoing assessment of
staffing levels in light of the changes in business operations, the revised testing
plans currently under development, and the changing regulatory environment.
Compliance Risk Rating
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
11
Federal Reserve Consent Order – JPMorgan Chase Response
For Home Lending, the risk rating process lagged behind the changes in the
mortgage business and the changes in the regulatory environment. The risk
rating process will be performed at least semi-annually, and more frequently for
defined areas that pose a higher risk to Home Lending.
x
The Compliance risk rating process establishes a standard framework
and terminology for evaluating compliance risk across the Bank and
facilitates creation of global compliance risk ratings that provide a
comprehensive and global assessment of compliance risk and is
implemented at a line of business level.
x
The Compliance risk ratings are assigned by the Home Compliance
team based on the Home Lending compliance risk assessment,
knowledge of the operations and strategic plans, monitoring/Quality
Assurance metrics, testing results, performance against training
requirements and results of internal audits and regulatory examinations.
x
The Compliance risk ratings include determination of Compliance ratings
for Home Lending for inherent risk, strength of the mitigation
factors/controls, residual risk and the projected direction of risk over the
upcoming twelve months.
x
The evaluation of the risk includes a review of customer complaints, and
that input is factored into the compliance program and the annual testing
plan.
x
A rating of “high” for inherent risk indicates that the risk of violations or
noncompliance exposes JPMC to significant impairment of its
reputation, value, earnings or business. A rating of “high” for residual
risk indicates that the residual risk exposes JPMC to significant
impairment of its reputation, value, earnings or business opportunity.
The latest compliance risk assessment was performed as of March 31, 2011
and was rated Weak.
x
5. (b)
Upon completion of the entire process, Corporate Compliance will
review the Risk Ratings and supporting narrative for each line of
business and will prepare a Global Executive Summary that includes: (1)
summary narrative of findings, highlighting key areas of high risk and
areas with a strong or weak set of controls; (2) Global Ratings
spreadsheet with line of business and regional data summarizing all
Compliance Risk Ratings; and (3) individual line of business Executive
Summaries. The Global Compliance Risk Ratings and Executive
Summaries will be shared with the Global Head of Compliance, the
General Counsel and the Risk Policy Committee.
Ensure compliance with the Legal Requirements and supervisory
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
12
Federal Reserve Consent Order – JPMorgan Chase Response
guidance of the Board of Governors; and
Management is committed to compliance with legal and supervisory
requirements and intends to ensure compliance by training employees on the
requirements, maintaining sufficient testing of the regulatory controls to assess
the effectiveness of the controls, and assessing staffing and resources focused
on compliance.
Compliance Training
As described in other sections of JPMC’s response, employees of Home
Lending will be receiving increased training on legal requirements and
regulatory guidance.
x
On an annual and ongoing basis, the Compliance team works with the
business to assess the need for training around regulatory requirements
as well as reviewing training content. Compliance partners with the
business to ensure that adequate training around legal requirements is
factored into employee training programs. As necessary, the
Compliance team revises the content, in partnership with Legal, and
sometimes facilitates the training sessions. Additional compliance
training is added to the schedule throughout the year as required. To
assist Training with their annual budgeting process, Compliance has a
process to review and opine in the fourth quarter on mandatory
compliance training for the upcoming year.
x
The process for determining compliance training needs varies. The
determinations are made in conjunction with the line of business,
Compliance and Legal. Determinations for training requirements on new
regulations and/or regulatory changes (e.g., Dodd Frank, RESPA
changes) are guided by Compliance/Legal leads on the project teams.
In some cases, training needs are determined by an issue (e.g., affidavit
execution; SCRA). In general, Compliance, Training and the business
create learning paths for core roles (e.g., sales, credit, and operations)
that include the compliance requirements for that role. Training is
mandatory and is assigned to learners in their assigned learning on
Training Central; the Bank’s online training application.
x
Guidelines for Refresher Training Sessions are determined by
Legal/Compliance when courses are created. Not all courses have an
annual assessment. For those courses that have recertification
requirements, those intervals are determined by Compliance and/or
Legal project representatives.
x
Compliance training completion is tracked in Training Central for each
employee. In many cases, achieving a passing score on a course
assessment (e.g., Privacy Awareness) is required to achieve course
completion status. In other cases, completing the review of the course
content will satisfy completion. While employee scores are not always
provided to management, completion reports for assigned compliance
Response
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
13
Federal Reserve Consent Order – JPMorgan Chase Response
courses are provided. In cases like SCRA or Foreclosure Affidavit
training, achieving a passing score is required and pass/fail information
is provided to management.
Compliance Testing
The Compliance Testing program is a key mechanism to assess the
effectiveness of the adherence to regulatory policies across the Home Lending
business. The testing program is being enhanced, with greater focus on state
laws, agency requirements and supervisory guidance. Reporting to
management continues to be strengthened.
x
Home Lending Legal and Compliance are in the process of analyzing
the Legal Requirements Matrix described in Items 5 and 5(a) above,
and performing a gap analysis between the existing Home Lending
Compliance Testing Plan for 2011 and the compliance testing we
believe necessary to ensure compliance with the Consent Orders. The
resulting revised testing plan will conform to JPMC’s Minimum Testing
Standards for compliance testing. The revised policy now has a
checklist to ensure the minimum standards have been followed. The gap
analysis will be completed on July 31, 2011.
x
The gap analysis and any incremental compliance testing resource
requirements will be reviewed with Corporate Compliance, Legal, Home
Lending Management and Audit before any changes are finalized for the
2011 Compliance Testing Plan. Recommendations for changes to the
2011 Compliance Testing Plan will be completed by August 12, 2011.
Once approval is obtained, any changes to the Testing Plan will be
implemented. Compliance has already begun adding tests to the 3rd
quarter test schedule for Executive Complaints as well as for Sworn
Statements.
x
Compliance has primary responsibility for conducting compliance
testing, supplemented by additional testing that may be done by other
control groups such as Internal Audit. Each Compliance team develops
an annual testing plan prioritized by risk. Compliance executes against
this plan, adjusting it if necessary throughout the year to address
changing priorities, taking into consideration new regulations, the results
of regulatory examinations, the findings of internal audits and the
ongoing review of customer feedback and complaints. Any changes to
approved testing plans must be approved by the Head of Home Lending
Compliance and reported to Corporate Compliance to ensure
appropriate testing coverage. This will also be presented at the Home
Lending Risk Management Committee.
x
The types of Compliance tests performed include procedural reviews,
sample testing, reviews of management information systems (MIS) used
by the business to assess data reliability, verification of testing
performed by quality assurance, as well the development of full
population testing. Testing results also serve to validate whether
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
14
Federal Reserve Consent Order – JPMorgan Chase Response
training has been effective or if changes to compliance risk assessments
are warranted.
x
Compliance findings are recorded in
the Corporate Compliance
tool, as well as within
the JPMC’s Risk Management System.
Root cause analysis and action plans are documented and included in
each system. When a test result identifies a potential systemic issue,
the Head of Compliance of Home Lending, in conjunction with Legal,
opines on remediation. Starting in the 4th quarter 2010, Compliance is
involved in all remediations with a regulatory component to ensure that
the full population affected is identified and properly remediated.
Corporate Compliance has enhanced its oversight of the effectiveness of Home
Lending’s Compliance Testing programs. A new monthly report, which is sent
to and will be discussed with the Global Head of Compliance, details the
completion status of the Compliance test plan, results of reports issued that
month, as well as a detailed listing of the findings from each report. Results of
compliance testing will continue to be reported to Home Lending Management,
Corporate Compliance, Risk Management and Internal Audit. The status of the
Compliance test plan will be presented to the Home Lending Risk Management
Committee quarterly. Additions to the Compliance test plans will be discussed
with Home Lending Senior Management and Internal Audit.
Organization and Staffing
Home Lending’s Compliance team is aligned with each area of Home Lending
(i.e., Production, Servicing, Default, Marketing, Technology, and Exam
Management) and these areas are staffed with qualified compliance officers
who have experience in one or more of the following areas: mortgage banking
regulatory compliance, audit, risk management, technology and project
management. Compliance will assist business management by:
x
Providing guidance to Home Lending on regulatory issues including new
regulations and updates to existing regulations, and assisting the
business in assessing the impact of these developments;
x
Assisting in the development of appropriate procedures to ensure
compliance with applicable laws, regulations and compliance policies;
x
Conducting and/or assisting the business with training to ensure that
employees are familiar with all existing and new applicable laws,
regulations, policies and procedures;
x
Conducting appropriate ongoing monitoring and compliance testing to
evaluate the effectiveness of the compliance procedures within the
Home Lending business;
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
15
Federal Reserve Consent Order – JPMorgan Chase Response
x
Providing reports to Home Lending management and to Compliance
management regarding compliance deficiencies or violations of laws or
rules, and aiding the business in developing appropriate action plans;
x
Overseeing the completion of compliance risk assessments, risk ratings
and evaluation of compliance metrics on a regular basis; and
x
Interfacing with regulators concerning examinations and regulatory
compliance matters and facilitating the conduct of their supervisory
activities.
Management has made a significant effort to ensure that compliance risk is
identified, measured, monitored and controlled through a risk-based compliance
monitoring and testing approach in order to ensure compliance with all
commitments made regarding the enterprise-wide compliance program.
Control functions (e.g., Internal Audit, Risk) conduct regular and ongoing
monitoring and testing of Home Lending’s functions to help ensure that the
control environment continues to operate effectively. Monitoring is designed
and implemented in a way that identifies and corrects compliance issues in a
timely manner. Procedures are in place to ensure that the findings of all
compliance reviews are promptly evaluated and investigated, decisions are
made about the appropriate response, and actions are taken to correct or
otherwise resolve compliance issues promptly.
Management recognized that Compliance needed additional staffing and Home
Lending Compliance has been actively adding resources and upgrading talent
throughout the Department. In mid-2010, a dedicated position of Head of
Compliance for Home Lending was created, reporting to JPMC’s Head of
Compliance for Retail Financial Services, and the role was filled. In addition, a
staffing assessment performed in the 4th quarter of 2010 indicated that an
increase in staffing from 30 to 50 compliance professions was warranted. 15
staff members were hired, some of whom were placed in the dedicated
Compliance Testing group. This brought the Compliance Testing staff to 21. A
further staffing review conducted in March of 2011 identified an additional 21
Compliance professionals were required across multiple compliance functions.
Five of these positions have been filled to date.
Results of an ongoing assessment of staffing levels in light of the changes in
business operations, the revised testing plans currently under development, and
the changing regulatory environment may require additional resources. With
the additional resources, we will have better aligned senior compliance
managers and appropriate staff to mortgage loan servicing, Loss Mitigation and
foreclosure activities and operations.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
16
Federal Reserve Consent Order – JPMorgan Chase Response
Resource Review Process
As part of the staffing exercise, each functional area of Compliance prepared a
roadmap detailing the functions (e.g., Production, Servicing, State, Default, and
Technology) and processes that need to be covered by Compliance. A staffing
request matrix was then prepared which detailed the proposed position,
location, hiring manager, position level and rationale for additional staffing. The
matrix was provided to Home Lending, Retail Financial Services and Legal and
Compliance management for approval.
5. (c)
Ensure that policies, procedures, and processes are updated on an
ongoing basis as necessary to incorporate new or changes to the Legal
Requirements and supervisory guidance of the Board of Governors.
Legal and Compliance are working with the business to strengthen the
processes to ensure that policies, procedures and processes are updated on an
ongoing basis to ensure that they reflect the required legal requirements and
supervisory guidance. In order to support this effort, Legal and Compliance
resources are aligned to specific areas of loan servicing, Loss Mitigation and
foreclosure activities. As changes occur to the legal requirements, these will be
communicated formally to the business and the business will confirm that the
requisite changes have been made to the relevant policies, procedures, and
processes. In addition, the control functions, including Risk Management,
Compliance and Audit, will also review and test the procedures during their
reviews to ensure that the new or changed requirements have been
incorporated and that the processes are effective.
Response
Legal and Compliance have responsibility to monitor federal, state and local
laws and regulations. Change control processes are designed to ensure that
when requirements change, an inventory of affected policies and procedures
can be identified and appropriate governance followed until the Bank is in
compliance with the changed regulations.
JPMC’s standard framework for policies and procedures development will
be implemented. Policies and procedures will be identified as high priority for
alignment with Consent Order requirements.
As explained above, one of JPMC’s initiatives was to update the inventory of
laws and regulations applicable to the Home Lending business through the
creation of the Legal Requirements Matrix. The list of laws and regulations is
being mapped to existing policies and procedures to identify prioritize and
remediate any additional gaps. This work is expansive and will continue
throughout 2011.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
17
Federal Reserve Consent Order – JPMorgan Chase Response
JPMC is developing a centralized approach for developing and updating
policies and procedures and by limiting access it will ensure appropriate review
and approval before distribution.
Supervisory guidance is included in the Legal Requirements Matrix and will be
tracked as detailed in Item 5(a). JPMC will follow its existing process for
updating polices and procedures in response to changes in federal and state
law identified by Legal.
Business management, Legal and Compliance all review and sign off on
policies and procedures. All policies and procedures being changed as a result
of the Consent Order will be reviewed and approved by the accountable senior
business owner (e.g., Foreclosure Executive).
Home Lending, in response to the OCC Consent Order Article IV, is working to
implement, by September 30, 2011, plans to strengthen the process for
developing and implementing policies and procedures, and to ensure that
current policies and procedures are accurate, complete and appropriately
documented.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
18
Federal Reserve Consent Order – JPMorgan Chase Response
Item 5 – Compliance
Summary of Response
The Federal Reserve has requested that the Bank develop and implement a plan to
enhance its enterprise-wide compliance program (“ECP”) with respect to residential
mortgage loan servicing, loss mitigation, and foreclosure activities and operations.
Compliance performed an evaluation of the effectiveness of the Home Lending Compliance
Program to identify weaknesses and to develop an action plan to address areas for
improvement. Evaluation, conclusions, and recommended enhancements are below:
Results from Evaluation
x The Program and resources did not keep pace with the rapid escalation in Loss
Mitigation and foreclosure activities, as well as the growth of the employee base and the
rising compliance risk profile of the areas identified in the Order.
x The Program did not react quickly enough to challenges in the business environment,
including differing systems and products across the three heritage servicing platforms,
manual processes, changing requirements, and an influx of new employees requiring
training.
x Our evaluation identified the need for a full inventory of laws and requirements and a
regular impact assessment across the breadth of activities and end-to-end business
processes in Home Lending.
x Compliance issues and test findings were tracked within the function but were not
always adequately escalated to ensure that the required corrective action was taken.
During the 4th Q 2010, Compliance started reporting issues requiring attention
to assist in escalation of issues to line and senior
management. These issues and our progress in remediating them are reviewed during
regular line of business control and risk committee meetings.
Compliance Staffing
x Home Lending Compliance has been actively adding resources and upgrading talent
and, in mid-2010, a dedicated position of Head of Compliance for Home Lending,
reporting to a newly-created Head of Compliance for Retail Financial Services, was
established and the role filled.
x In 2011, we increased staffing from 30 to 50 Compliance professionals, bringing the
number of dedicated Compliance Testing staff to 21. With the additional resources, we
will have aligned senior compliance managers and appropriate staff to mortgage loan
servicing, loss mitigation and foreclosure activities and operations. We are in the
process of recruiting an additional 21 Compliance professionals for the Home Lending
Compliance team.
x Staffing levels will continue to be assessed in light of the changes in business operations
and changing regulatory requirements. Revised 2011 testing plans are currently under
development.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 5: Compliance – Final – December 8, 2011
Federal Reserve Bank of New York Consent Order – JPMorgan Chase Response
Compliance Remediation Plan
x Home Lending Compliance is in the process of performing a gap analysis between the
existing Home Lending Compliance Testing plan for 2011 and the compliance testing we
believe necessary to ensure compliance with the FRB and OCC Orders. The resulting
revised testing plan will conform to JPMC’s Minimum Testing Standards for Compliance
Testing.
x The gap analysis will be reviewed with Corporate Compliance, Legal, Home Lending
Management and Audit who will make recommendations for changes to the 2011
Compliance Testing plan, as appropriate.
x The law firm of Morgan Lewis & Bockius, LLP was retained to expand, where necessary,
the inventory of applicable laws and regulations against which Compliance would
determine the nature and extent of testing and oversight. That expanded inventory was
provided in May 2011. Based on this expanded inventory, we will be reviewing existing
policies and procedures to ensure requirements are captured in a policy and detailed in
a procedure as appropriate.
x Compliance will partner with the business to ensure that adequate training around legal
requirements is factored into employee training programs.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 5: Compliance
Federal Reserve Consent Order – JPMorgan Chase Response
Audit
6.
Within 60 days of this Order, JPMC shall submit to the Reserve Bank an
acceptable written plan to enhance the internal audit program with respect
to residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations. The plan shall be based on an evaluation of the
effectiveness of JPMC’s current internal audit program in the areas of
residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations, and shall include recommendations to
strengthen the internal audit program in these areas. The plan shall, at a
minimum, be designed to:
Self-Evaluation
Internal Audit performed an in depth evaluation of the effectiveness of the Home
Lending Audit program to develop an enhanced audit approach and coverage
plan. This assessment, while inclusive of the areas identified in the Consent
Orders, was completed for the overall Home Lending business to ensure that
the audit program was comprehensive and responsive to learnings from control
weaknesses identified through the Consent Orders and other regulatory reports.
Relevant conclusions from the assessment included:
x
Significant audit work was completed that specifically focused on
areas identified in the Consent Orders; however, past coverage did
not always keep pace with the increasing risk in some areas (e.g.,
core servicing) and the scope of coverage was not consistently
inclusive of certain risks (e.g., state law compliance).
x
The previous audit coverage resulted in identification of significant
issues with agreed upon action plans. While management
addressed many of the actions, the root cause of issues was not
clearly called out by Internal Audit or addressed by management and
issues reappeared as the environment changed.
x
While the reporting of audit issues and status was in place, due to
the rapidly changing environment and the magnitude of issues,
increased dialogue in risk and control forums and business reviews
might have refocused attention on key outstanding issues for more
timely and effective remediation.
Response
Process to Fix
The Home Lending Audit program has been modified to address these issues
as outlined below:
x
Management responsibilities have been streamlined to ensure
adequate oversight of the Home Lending Audit Plan and Consent
Orders.
Senior Vice President, has overall responsibility
for the Home Lending Audit Program.
Managing
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
1
Federal Reserve Consent Order – JPMorgan Chase Response
Director, has been added to the team and will have audit
responsibility for Originations and Portfolio Management. He also
has responsibility for executing Audit’s response to the Consent
Orders.
Managing Director, retains responsibility for
residential loan servicing and default related activities, including
monitoring Management’s compliance with the Consent Orders.
x
Audit Plan hours were significantly increased to accelerate coverage
of mortgage loan servicing, loss mitigation, and foreclosure activities
and operations over the next 18 months. The Audit Plan includes all
relevant audit activities to achieve a new baseline risk assessment of
these functions given the elevated risks and changing business
operations. Essentially all areas in Default and Servicing will be
reviewed in this revised Audit Plan. These areas would typically be
covered over a 3-year time horizon. This Audit Plan covers the
period April 1, 2011 to September 30, 2012. Audit expects to issue
71 reports with about 139,000 audit hours of coverage. Please see
Appendix A for a summary of the Home Lending Audit Plan and
Appendix B for the proposed timing of the reviews.
x
The scope of audits will be enhanced to include focus on areas of
previous control weaknesses, including business practices/customer
experience, third-party vendors, legal documents, and state law
compliance. Planning of audits is based on a fresh assessment of
the risk and control framework of the area just prior to the start of the
review and includes known problem areas, as well as new and
emerging risks. Structured audit tollgates to review and approve
audit scopes with active engagement by the Home Lending Audit
Management Team will facilitate how this comprehensive coverage
will be achieved.
x
Staffing requirements are derived from the number of hours of
coverage in the Audit Plan. Aggressive actions were taken to build
out the Home Lending Audit Team to meet the requirements of the
revised plan. Experienced resources were obtained from other
JPMC Audit Teams, a staff augmentation arrangement was entered
into with an external firm (Protiviti), and external recruiting efforts
were ramped-up. The resources to execute the plan are
approximately double the historical levels. As the Internal Audit Plan
is re-evaluated for changes in risk dynamics, resource levels will be
periodically re-assessed for appropriateness.
x
The Internal Audit Continuous Auditing program is a key to
monitoring the changes in risk dynamics. The Continuous Auditing
program involves: analyzing business management reporting;
assessing and monitoring of business key risks and performance
indicators; participating actively in stakeholder meetings and
oversight committees; monitoring of key financial data; reviewing
business scorecards; monitoring the Control Self-Assessment
process; assessing new business initiatives; reviewing system
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
2
Federal Reserve Consent Order – JPMorgan Chase Response
capacity, resiliency, and system outages; and evaluating progress
against target dates for audit, regulatory, and business identified
issues. This level of engagement keeps a pulse on the control
environment and influences identifying key control issues, adjusting
audit scopes, and updating risk assessments. Internal Audit
summarizes the results of these Continuous Auditing activities in
quarterly reports.
x
Refinements were made to adverse audit follow-up standards and
validation of the closure of action plans from regulatory
examinations. Management reporting was also improved to provide
greater transparency on audit issues, closure rates, and the
effectiveness of corrective measures.
x
Regular reporting on results, emerging issues, themes, status of the
Audit Plan, and progress of corrective measures will be incorporated
into the Home Lending risk and control forums, business reviews,
and provided to the Audit Committee. More active dialogue of the
state of the overall control environment in these forums and in the
regular course of management discussions will be a key area of
focus. Starting in April 2011, Internal Audit leveraged the Retail
Audit Executive Management Report (EMR) to generate a separate
Home Lending Audit EMR. Weekly reporting on the health of the
control environment to Home Lending Executive Management began
in June 2011. Revised reporting to the Home Lending Risk
Management Committee and/or its appropriate subcommittees will
begin in July 2011 and at each meeting going forward. Home
Lending Audit reporting to the Audit Committee will begin in July.
Status materials will be provided at each meeting with a control
environment update quarterly. This level of reporting will continue
until Consent Order action plans are implemented and a sustainable
satisfactory control environment is in place.
x
Monthly meetings will be held with
, the General
Auditor, and
the Chief Administrative Officer and Head
of Professional Practices, to review the status of Audit’s compliance
with Consent Order requirements.
x
The Audit Reporting Policy was clarified in June 2011 to clearly
outline the protocols for resolving any differences of opinion between
Internal Audit and management concerning audit issues or
recommendations. This policy will be reviewed with the Audit
Committee in July 2011.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
3
Federal Reserve Consent Order – JPMorgan Chase Response
Sustainability
Several efforts are in place to focus on sustainability of the Audit actions:
x
Ongoing training is essential to ensure Internal Audit stays abreast of
emerging risks in the industry and maximize the effectiveness of our
Audit Team. Internal Audit will hold at least quarterly training
sessions led by a rotating group of public accounting firms to
understand mortgage industry perspective and changes in risk
dynamics from a variety of sources.
x
Internal Audit actively participates in mortgage Audit peer group
forums to promote a dialogue around industry challenges and
approaches and benchmark staffing and qualifications.
x
Efforts to identify and articulate the root cause of problems will
facilitate developing appropriate and sustainable action plans to
address problems. Internal Audit will work with management to
identify the root cause of all key issues in audit reports. In addition,
this root cause analysis will be highlighted in the executive summary
of all adversely rated audit reports and trends will be discussed in
appropriate governance forums.
x
Audit reporting of results, themes, and emerging issues will be
regular and frequent. Key reporting forums will include: weekly
metrics to Home Lending Executive Management, monthly reporting
to Home Lending control forums, monthly reporting in the Audit EMR,
and frequent reporting to the Audit Committee. The firm is also
adjusting quarterly business review agendas to include significant
control environment issues. Internal Audit will provide input to this
reporting, which is expected to be in place by the fourth quarter.
x
A Business Manager and a Protiviti resource were added to the
Home Lending Team to focus on the development and regular
generation of the Home Lending weekly and monthly reporting
packages described in the response.
x
Active engagement by the Audit Management Team in all audit
tollgate meetings will provide the constant and consistent level of
attention to robust coverage of high-risks. Audit coverage scoping
will also leverage the inventory universe mapping developed for
management reporting, control self-assessments, Sarbanes-Oxley
general ledger accounts, legal entities, and high risk elements of
system applications, third-party operators, models, and law and
regulations.
x
Standard Risk Assessment Matrix (RAMS) will be created as part of
baseline audit reviews that will be leveraged going forward for
sustainability. These RAMS will be in place by the end of the Audit
Plan period (September 30, 2012).
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
4
Federal Reserve Consent Order – JPMorgan Chase Response
x
Our risk assessment tool and related guidance will continue to be reevaluated and assessments will be refreshed at least on a semiannual basis. The auditable entities and the level at which the risk
assessments are completed, may also be adjusted as management
redesigns the Home Lending organization.
x
Resource level flexibility is provided by the staff augmentation
arrangement with Protiviti. Internal Audit has the ability to expand
and renew this contract as needed. In addition, resource levels can
vary from month to month based on needs.
x
Overall, Internal Audit will operate with increased resource levels
until Home Lending is operating in a sustained satisfactory control
environment.
These efforts are outlined in greater detail in the following pages. In total, they
represent a significant commitment to providing robust audit coverage of Home
Lending.
6. (a)
Ensure that the internal audit program encompasses residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities;
Audit Planning Process
Internal Audit utilizes an Annual Planning Process that designs and implements
an appropriate mix of audit coverage focused on key risks. Planned audit
coverage:
x
x
x
x
x
Response
Focuses on highest risks;
Includes required regulatory audits and coverage of key regulations;
Incorporates critical cross-firm risks;
Ensures adequate coverage of high-risk legal entities and locations;
and
Includes continuous auditing activities and change activities.
Audit planning includes:
x
x
x
Confirming the inventory of auditable entities;
Performing risk assessments of auditable entities; and
Determining planned audit activities.
Home Lending Audit Plan
In developing the revised plan, Internal Audit: (1) took steps to ensure the
overall Home Lending plan is comprehensive, reflective of the current risk
environment, and inclusive of all relevant auditable activities; (2) assessed prior
audit coverage and control weaknesses in Home Lending to ensure learnings
were appropriately included in the revised plan; and (3) considered the need for
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
5
Federal Reserve Consent Order – JPMorgan Chase Response
flexibility to adapt the plan as the business and operating models change to
meet the requirements of the Consent Order.
Internal Audit conducted a series of audit universe checks, which were more
comprehensive than conducted during Annual Planning, to ensure auditable
entities and audit activities were complete. These checks included mapping the
following:
x
x
x
x
Weekly management information systems and organization
reporting;
Control Self-Assessments;
Sarbanes-Oxley general ledger accounts; and
Legal entities.
Additionally, Internal Audit leveraged existing Bank risk assessments or
conducted their own assessments to map to the highest risk elements of the
following:
x
x
x
x
System applications;
Third-party service providers;
Models; and
Laws and regulations.
Internal Audit assessed our prior audit coverage and the control weaknesses
that occurred in Home Lending and determined that additional emphasis should
be placed in our individual audit planning and risk assessment process to
establish the audit scope related to the following areas: business practices/
customer experience, third-party vendors, legal documents, and state law
compliance.
Additionally, Internal Audit will consider the need to adapt this plan throughout
the year as the business and operating models change to meet the
requirements of the Consent Order. Internal Audit will report any significant
changes to the plan to Home Lending Senior Management and the Audit
Committee and will capture these changes as part of the continuous auditing
memorandum. A formal reforecast of the plan will occur at least quarterly.
As a result of this assessment, Internal Audit developed a comprehensive
Home Lending Audit Plan that includes loan servicing, loss mitigation, and
foreclosure activities. The Audit Plan highlights are outlined below:
x
We expect to issue 71 audit reports utilizing about 139,000 hours of
coverage. The Audit Plan covers the period April 1, 2011 to
September 30, 2012 and Internal Audit expects to execute this Audit
Plan over this 18-month time horizon. Please see Appendix B for
the proposed schedule of audits to occur and those that have
already been completed.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
6
Federal Reserve Consent Order – JPMorgan Chase Response
x
Resources are approximately double the historical levels. As the
Internal Audit Plan is re-evaluated for changes in risk dynamics,
resource levels will also be re-assessed for appropriateness.
x
Internal Audit utilized our risk assessment tools to develop this plan.
Based on the Consent Orders, the coverage in loan servicing, loss
mitigation, and foreclosure activities was accelerated over the next
18 months and includes all relevant audit activities to achieve a new
baseline risk assessment for these functions given the elevated risks
and changing business operations. We essentially will review all
areas in Servicing and Default in this Audit Plan. These areas would
typically be covered over a 3-year time horizon. Please see
Appendix A for the complete list of entities that have been selected
for review.
Areas of focus for the Home Lending plan include:
x
Significant attention is directed to Consent Order commitments,
including validation of action plans and remediation efforts shortly
after completion with reporting on inappropriately closed action
plans.
x
Audit coverage will be accelerated for loan servicing, loss mitigation,
and foreclosure operations areas and will provide an opinion on the
overall control environment at the time of the audit.
x
The scope and depth of these reviews will be expanded to include
consideration of audit testing related to business practices/customer
experience, third-party vendors, legal documents, and state law
compliance.
x
Reviews in accordance with Internal Audit’s change activity
methodology will be conducted with expected deliverables for highrisk system development, Consent Order system initiatives, and data
management enhancements to ensure effective project governance
and execution.
x
Attendance at the newly implemented weekly Home Lending Metrics
Meetings and evaluation of reporting will provide an update on each
business in terms of key metrics and results as well as discussions
on strategy and approach to inform our ongoing risk assessment
process which will be documented in the quarterly continuous
auditing memorandums. Metrics on the health of the control
environment will be included in these weekly updates.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
7
Federal Reserve Consent Order – JPMorgan Chase Response
x
Audit tollgate meetings will be enhanced to improve the
appropriateness, consistency, and depth of coverage. These
planning, fieldwork, and reporting tollgates are held at key
checkpoints during the course of an audit and include Home Lending
Audit Management and now include active participation from key
subject matter experts from the Consumer Finance, Risk, and
Compliance Audit teams. These tollgate meetings will also leverage
the universe mappings prepared to develop the audit plan.
Open Action Plans:
x
x
x
x
x
x
6. (b)
Review the revised Home Lending Audit plan with the Audit
Committee (July 31, 2011).
Leverage Compliance tools developed as part of the Consent Order
to map applicable regulatory guidance and federal and state laws to
audit activities in the plan to ensure appropriate consideration of
coverage (September 30, 2011).
Hold monthly Audit Consent Order status meetings with
General Auditor, and
CAO and Head of
Professional Services (July, 31, 2011).
Provide reporting on the health of the control environment to the
Home Lending Risk Management Committee and/or the appropriate
subcommittee (July, 31, 2011).
Develop standard RAMS for baseline audits (September 30, 2012).
Provide control environment updates to the quarterly business
reviews (December 31, 2011).
Periodically review the effectiveness of the ECP and ERM with respect to
residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities, and compliance with the Legal Requirements and supervisory
guidance of the Board of Governors.
There are three key components of the audit coverage of the Home Lending
Enterprise Compliance Program (ECP) and Enterprise Risk Management.
x
Response
The effectiveness of the Compliance and Risk Management
programs will continue to be considered for review within the scope
of applicable audits of the mortgage loan servicing, loss mitigation
and foreclosure operations areas. This approach allows for ongoing
assessment of the components of the ECP and ERM through the
audit plan period. Appropriate coverage of these activities will be
monitored through the audit tollgate process. Compliance related
issues will be integrated into these audit reports.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
8
Federal Reserve Consent Order – JPMorgan Chase Response
x
Internal Audit will validate closure of action plans associated with
Matters Requiring Attention (MRA) and Matters Requiring Immediate
Attention (MRIA) from regulatory examinations and actions plans
associated with the Consent Orders for these two Programs and
report on instances of inappropriate closure. Coverage will be
provided by a combination of audits, follow-up audits, and stand
alone validation reviews. This approach affords timely assessment
of changes made to ECP and ERM through the Consent Orders.
x
In order to ensure comprehensiveness and sustainability of ECP and
ERM, Internal Audit will perform an overall annual review of the
Compliance and Risk Management programs for Home Lending
beginning in 2012. The specific focus of the review will be on
mortgage loan servicing, loss mitigation, and foreclosure activities
following the complete implementation of the Consent Order action
plans. The scope of these reviews will include assessing risk
identification, measurement, monitoring/control, and reporting.
Internal Audit will incorporate conclusions as appropriate from any
other audits in the plan where Compliance and Risk policies or
practices were included in the scope. The review will be conducted
toward the end of the audit plan period to provide a view as to
sustainability and impact to the revised programs. Internal Audit will
leverage the inventory of applicable legal and supervisory
requirements created by outside legal counsel in response to the
Consent Orders to facilitate this review and will evaluate
management’s change management practices to the inventory as
part of this review.
The frequency of compliance and risk management audits will be re-evaluated
each year as part of our annual planning exercise.
Open Action Plan:
x Complete audits of the Home Lending Enterprise Compliance
Program and Enterprise Risk Management (September 30, 2012).
6. (c)
Response
Ensure that adequate qualified staffing of the audit function is provided
for loan servicing, Loss Mitigation, and foreclosure activities;
As the revised Home Lending Plan was being developed, we worked to
significantly expand the size and experience of the Audit Team. The Plan
contemplates approximately 139,000 hours of audit work, which will require on
average about 55 auditors to execute the work over the 18-month time horizon
from April 1, 2011 through September 30, 2012. The staff to complete this plan
will fluctuate in size depending on the audit schedule. Resources aligned to the
Home Lending Audit Plan have an average of 12 years of experience and 49
percent have professional certifications. Several steps have been taken to
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
9
Federal Reserve Consent Order – JPMorgan Chase Response
augment the Home Lending Audit Team as follows:
x
The Home Lending Audit Team continues to report to
,
the Chief Auditor of Retail Banking and Home Lending.
, the Consumer Lending and Payments Chief Auditor, has
assumed responsibility for Consumer Business Practices, including
Home Lending, to provide additional focus and oversight of these
key initiatives.
x
Seven experienced top performing auditors, primarily Vice
Presidents, transferred from other Line of Business Audit Teams.
This allowed the Home Lending Team to add Audit Managers and
Auditors In-Charge to increase experience and proven leadership
across the team, provide a fresh perspective to assessing risk in the
Home Lending business, and to assist in the on-boarding and
ongoing quality assessment of Protiviti resources. While they do not
bring specific mortgage experience, they bring strong audit
backgrounds and a solid foundation of JPMC Firm and audit
practices to supplement existing mortgage expertise on the team.
x
Internal Audit entered into a staff augmentation arrangement with
Protiviti, an external firm. Protiviti is a leading firm specializing in
internal audit services with significant experience in large scale audit
staff augmentation projects in the financial services space. This firm
will provide at least 20 experienced consultants that will operate
under the direction of JPMC Internal Audit for at least the next 12
months, with an option to extend the contract as necessary. These
resources are included in executing the planned 139,000 hours of
coverage. These resources provide an immediate staffing solution
while Internal Audit continues to recruit for permanent qualified full
time hires. They will also provide subject matter experts for certain
engagements. Internal Audit provides Protiviti with resources
requests including level, skills needed, and assignment duration.
Protiviti provides resumes on candidates to meet the requirements.
Chase Internal Audit managers review resumes and conduct
interview screens to select the consultants to join the engagement.
The primary Protiviti consultants were trained and on-boarded in
mid-April with additional resources being added as necessary
throughout the remainder of the Audit Plan period. After proving
their capabilities, selected consultants have been identified to InCharge various upcoming audits under the direction of a JPMC
Internal Audit Manager and Senior Audit Manager. Please see
Appendix C for the Protiviti Services Schedule. This contractual
arrangement was coordinated through the firm’s Procurement
Services group and was conducted in accordance with JPMC
Procurement standards, including a competitive bidding process.
Five firms provided detailed responses and presentations to respond
to the request for proposal. Protiviti was selected based on their
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
10
Federal Reserve Consent Order – JPMorgan Chase Response
ability to consistently provide the strongest internal audit resources
accompanied by mortgage and financial services experience. The
contract was approved by
, JPMC General Auditor.
x
While the Home Lending Audit Managers were historically fully
dedicated to Home Lending, Internal Audit migrated to a completely
dedicated Home Lending staffing model from a pooled staffing
concept across the Retail Audit Team to further build mortgage
expertise.
x
Additionally, Internal Audit continues to leverage subject matter
expertise resident on other audit teams (e.g., Risk, Compliance,
Technology) across the Internal Audit Department as necessary to
supplement expertise.
Internal Audit conducted comprehensive mortgage training for the transferred
employees and the external consultants to facilitate integration on the Home
Lending team. Internal Audit will continue to evaluate ongoing training options
as necessary, including those being developed by Home Lending in conjunction
with the Consent Order. Ongoing training is essential to maximizing the
effectiveness of our Audit Team. We will hold at least quarterly training
sessions led by a rotating group of public accounting firms to understand
mortgage industry perspective and changes in risk dynamics from a variety of
sources.
Recruiting efforts have been focused on hiring additional resources for
permanent positions on the Home Lending Team, including individuals with
specific mortgage servicing and loss mitigation experience to reduce reliance on
external resources over time. To date 6 auditors have been hired for the Home
Lending Team.
As the Internal Audit plan is re-evaluated for changes in risk dynamics,
resources levels will also be periodically re-assessed for appropriateness.
Please see Appendix D for the Home Lending Audit Team Organization Chart.
Open Action Plan
x
6. (d)
Response
Hold quarterly mortgage industry update training sessions (September
30, 2011)
Ensure timely resolution of audit findings and follow-up reviews to ensure
completion and effectiveness of corrective measures;
In 2010 Internal Audit made refinements to the Audit Practice to ensure the
timely and effective resolution of audit findings. These refinements included
highlighting the root cause of audit issues more clearly in audit reporting and
management dialogues, explicitly stating whether the Control Self-Assessment
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
11
Federal Reserve Consent Order – JPMorgan Chase Response
for the area was effective, accelerating follow-up of Needs Improvement audits,
and validating the closure of regulatory MRAs as outlined below:
x
Root Cause – Internal Audit began specifically identifying the root cause
of audit issues in audit reports and other management reporting
including the monthly Audit EMR. The root cause analysis provides
clarity on the comprehensiveness and appropriateness of
management’s actions to resolve the issue and may point to more
systemic concerns such as capacity, management oversight, and data
architecture.
x
Control Self-Assessment – Internal Audit also added a section to audit
reports and includes commentary in the monthly Audit EMR to explicitly
state whether the Control Self-Assessment for the area under review
appropriately identified the control failures reported in the audit.
x
Follow-up audits – Internal Audit accelerated the follow-up standard for
Needs Improvement-rated reports from 18 to 12 months. The standard
for follow-up of Inadequate-rated reports is six months. Management
reporting is in place to monitor compliance with these follow-up
standards. This reporting tracks when follow-up reviews are required
and the status of validation efforts until the follow-up report is issued.
Adversely rated audit reports are reported to the Audit Committee.
Please see Appendix E for the Audit Reporting Policy which outlines
audit rating definitions and guidelines.
x
Regulator MRA – Internal Audit now has an audit practice standard in
place to conduct validation of the closure of OCC and FRB MRA and
MRIA. These action items are tracked on the
system, a tool to
track the status of management, Internal Audit, and regulator identified
issues. Coverage will be provided by a combination of audits, follow-up
audits, and stand alone validation reviews. This approach affords timely
assessment of changes. We are in the process of mapping Consent
Order responses and expected target dates to determine whether the
validation work will be performed as part of an audit or whether the work
will be a stand alone validation exercise. Senior management will
receive a memorandum outlining key issues identified in the validation
work, including any applicable new action items, owners, and target
dates. If the deliverable is an audit report, we will highlight the Consent
Order action plans included in the scope of the review and our validation
conclusion. We will report results in our weekly Home Lending Metrics
Executive Summary report to Home Lending executive management,
Audit EMRs, and Control Committee and Business Review reports.
Management reporting is in place to monitor compliance with this
MRA/MRIA validation standard. Results of MRA/MRIA validations will
be summarized for the Audit Committee.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
12
Federal Reserve Consent Order – JPMorgan Chase Response
These practices are all currently being followed by Home Lending Audit team
and follow-up audits to validate the effective closure of open audit issues have
been incorporated into the revised Audit Plan submitted as part of the Consent
Order response. Beginning in 2011, Internal Audit also began reporting
emerging key results and issues to the Head of Home Lending on a weekly
basis. Monthly, Internal Audit reports the status of action items from adverse
rated reports, key control issues, and regulatory examinations in the Home
Lending EMR. Revised target dates and the rationale for the revisions will be
highlighted in the EMR for management. Additionally, Internal Audit is creating
a standard reporting format for risk and control forums which will include
providing an aggregate view of the control environment quarterly, and providing
current and trended information on root causes, the effectiveness of the control
self-assessments, and timely closure of audit issues and regulatory MRAs.
Starting in July 2011, the executive summary of adverse rated reports will
include a section on the root cause analysis of the key issues identified.
In response to the target exam of JPMorgan Chase Internal Audit – Federal
Reserve Bank of New York Supervisory Letter Dated March 21, 2011, Internal
Audit agreed to develop and implement procedures to validate issues in
satisfactory rated reports. To address the recommendation related to approval
of revisions to action plan target dates associated with audit-identified issues,
Internal Audit is pursuing enhancements to the
system to require audit
notification of extended target dates. The preliminary estimate for deployment
of this enhancement is the first quarter of 2012. In the interim until such
automation is available, we will implement tracking and reporting to formally
document our review of the appropriateness of revised target dates associated
with audit-identified issues.
Open Action Plan:
x
x
x
6. (e)
Response
Implementation of procedures to validate issues in satisfactory rated
reports (August, 31, 2011).
Implementation of Audit-developed tracking and reporting of target
date revisions to audit identified-issues (August 31, 2011).
Enhancement to the
system (March 31, 2012).
Ensure that comprehensive documentation, tracking, and reporting of the
status and resolution of audit findings are submitted to the audit
committee; and
Status materials will be provided at each Audit Committee meeting with a
control environment update provided quarterly. This level of reporting will
continue until Consent Order action plans are implemented and a sustainable
satisfactory control environment is in place.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
13
Federal Reserve Consent Order – JPMorgan Chase Response
Open Action Plan:
Enhance Audit Committee reporting for Home Lending including past due action
plans and closure rates (July 31, 2011).
6. (f)
Establish escalation procedures for resolving any differences of opinion
between audit staff and management concerning audit exceptions and
recommendations, with any disputes to be resolved by the audit
committee.
Internal Audit revised the Audit Practice Policy on Audit Reporting to further
clarify our escalation policy as follows:
x
Response
Differences of opinion regarding audit issues or recommendations
that cannot be resolved with the Line of Business Chief Auditor and
the Line of Business Chief Executive Officer will be escalated to the
General Auditor for discussion with the Line of Business Chief
Executive Officer. If agreement cannot be achieved, the issues will
be escalated to the JPMC Chairman/Chief Executive Officer for
resolution. If such discussions do not result in agreement, the
issues will be escalated to the Audit Committee of the Board of
Directors for resolution. The policy was revised in June 2011 and
was approved by
and the Audit Management Team.
To-date, there have been no issues requiring Audit Committee
escalation for resolution. Please see Appendix E – Audit Reporting
Policy. The escalation protocol will be reviewed with the Audit
Committee in July.
Open Action Plan:
x
Review the escalation protocol with the Audit Committee (July, 31,
2011).
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
14
Federal Reserve Bank Consent Order – JPMorgan Chase Response
Item 6 – Audit Enhancement Plan
Summary of Response
The Federal Reserve has requested that the Bank develop and implement a plan to
enhance the internal audit program with respect to residential mortgage loan servicing,
loss mitigation, and foreclosure activities and operations.
Internal Audit performed an evaluation of the effectiveness of the Home Lending audit program
to develop an enhanced audit approach and coverage plan. Evaluation conclusions and
recommended enhancements include:
Evaluation Conclusions
x Significant audit work has been completed or is included in the 2011 plan; however,
coverage has not always kept pace with the increasing risk in some areas and the scope
of coverage was not consistently inclusive of certain risks (e.g. state law compliance).
x The previous audit coverage resulted in identification of significant issues with agreed
upon action plans. While management addressed many of the actions, the root cause of
issues was not clearly called out by Internal Audit or addressed by management on a
consistent basis and issues reappeared as the environment changed.
x While the reporting of audit issues and status was in place, due to the rapidly changing
environment and the magnitude of issues, increased dialogue in risk and control forums
and business reviews might have refocused attention on key outstanding issues for
more timely and effective remediation.
Enhanced Audit Coverage Plan
x Audit plan hours were significantly increased to accelerate coverage of mortgage loan
servicing, loss mitigations, and foreclosure activities and operations over the next 18
months. These areas would typically be covered over a 3 year time horizon.
x The scope of audits will be enhanced to include focus on areas of previous control
weaknesses including business practices/customer experience, third party vendors,
legal documents, and state law compliance.
x Additionally, Internal Audit will consider the need to adapt this plan throughout the year
as the business and operating models change to meet the requirements of the Consent
Order.
Staffing
x Aggressive actions were taken to build out the Home Lending audit team to meet the
requirements of the enhanced plan. Experienced resources were obtained from other
JPMC Audit teams, a staff augmentation arrangement was entered into with an external
firm specializing in large scale audit staff augmentations in financial services
organizations, and external recruiting efforts were ramped-up.
x There are currently approximately 65 staff aligned to complete the revised plan, which is
approximately double the historical allocation of resources. As the Internal Audit plan is
re-evaluated for changes in risk dynamics, resource levels will be periodically reassessed for appropriateness.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 6: Audit – Final – December 8, 2011
1
Federal Reserve Bank Consent Order – JPMorgan Chase Response
Review of Enterprise Compliance Program and Enterprise Risk Management
There are three key components of coverage of the Home Lending Enterprise Compliance
Program and Enterprise Risk Management:
x
x
x
Internal Audit will perform a comprehensive review of the Compliance and Risk
Management programs for Home Lending, with specific focus on mortgage loan
servicing, loss mitigation, and foreclosure activities following the complete
implementation of the Consent Order action plans.
The effectiveness of the Compliance and Risk Management programs is considered for
review within the scope of applicable audits of the mortgage loan servicing, loss
mitigation and foreclosure operations areas.
Internal Audit will validate closure of action plans associated with the Consent Orders for
Compliance and Risk Management.
Audit Finding Resolution and Follow-up
x In 2010 several refinements were made to the Audit Practice to ensure the timely and
effective resolution of audit findings as follows:
– Root Cause – specific identification of root cause of control issues in audit
reports and monthly reporting.
– Control Self Assessment – explicit conclusions on the effectiveness of the self
assessment in audit reports and monthly reporting.
– Follow-up Audits – acceleration of Needs Improvement follow-up audits from 18
to 12 months.
– Regulatory MRA – validation of appropriate closure of regulatory issues within 60
days of closure by management.
x Regular reporting and active dialogue on the status of the Home Lending Audit plan,
results, and status of corrective measures will be incorporated in the Home Lending risk
and control forums, and business reviews.
Audit Committee Reporting
x Internal Audit will provide specific Home Lending Audit updates to the Audit Committee
in addition to existing reporting on Retail Financial Services. These updates will include
the Home Lending Audit plan status, results, and action plans starting with the July Audit
Committee meeting.
x Additionally, management will be expected to report on the status of the Home Lending
control environment at least semi-annually to the Audit Committee, including the status
of open Audit Issues.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 6: Audit – Final – December 8, 2011
2
Federal Reserve Consent Order – JPMorgan Chase Response
Risk Management
7.
Within 60 days of this Order, JPMC shall submit to the Reserve Bank an acceptable
written plan to enhance its ERM program with respect to its oversight of residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations.
The enhanced plan shall be based on an evaluation of the effectiveness of JPMC’s
current ERM program in the areas of residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities and operations, and recommendations to
strengthen the risk management program in these areas. The plan shall, at a
minimum, be designed to:
JPMC is committed to enhancing its current Risk Management program with respect to its
oversight of Home Lending activities including residential mortgage loan servicing, loss
mitigation, and foreclosure activities and operations in accordance with this Order. To
enhance the Risk Management program, JPMC reviewed the existing framework,
evaluated its effectiveness, identified weaknesses and developed an action plan to
address the areas for improvement. Relevant conclusions from the assessment include:
Response
x
The deterioration of the housing market resulted in existing workout and loss
mitigation programs that were no longer sufficient and the industry, including
Home Lending, struggled to develop effective solutions.
x
The acquisition of two significant mortgage loan and servicing portfolios from Bear
Stearns (EMC Mortgage Corporation) and Washington Mutual created increased
complexity of process and technology for Home Lending.
Integrating these portfolios, operations, and the different servicing platforms and tools at
the same time that Home Lending’s infrastructure was under stress added to the existing
challenges. These challenges include the following:
x
The government became involved in providing solutions to the growing
housing market crisis. For example, the Home Affordable Modification
Program (HAMP) and foreclosure alternatives contributed to significant
operational complexity without the lead time necessary for Home Lending to
properly identify and plan for an orderly implementation. Home Lending, and
its industry counterparts, attempted to quickly address associated policies,
procedures, technologies/systems, staffing, and controls. This resulted in
poorly documented or incomplete policies and procedures; inadequate
training; insufficient testing, monitoring and reporting; and quality control
problems.
x
The increased complexity of loan product offerings and modification waterfall
processes, coupled with the significant increases in delinquent customers
requesting assistance, resulted in a material increase in the volume of
transactions and customer interactions needing operational support across
Home Lending. As a result, new servicing guidelines required that each loan
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
1
Federal Reserve Consent Order – JPMorgan Chase Response
case be managed on an individual basis, which entailed increased consumer
interactions and process activities the Home Lending operation did not
anticipate. The increase in default servicing staff from
strained Home Lending’s ability to effectively integrate the
personnel.
x
Finally, despite the significant growth in the size and complexity of the
servicing business, the Home Lending core Risk Management did not scale
with the business’ need for independent oversight. As a result, although the
control functions were able to identify many of the inherent risks in the
business, the issues arising from the expanded scale and scope of mortgage
servicing operations were not sufficiently aggregated, escalated, and resolved.
We recognize the significant steps to be taken to address the requirements of the Federal
Reserve and OCC Consent Orders issued on April 13, 2011. In order to ensure that the
inherent risks in the business and the issues arising from the expanded scale and scope
of mortgage servicing operations will be sufficiently aggregated, escalated and resolved
going forward, a comprehensive risk assessment is being conducted and remediation
plans will be developed. First, the risk assessment catalogs all known control issues,
including Matters Requiring Attention (MRAs), Audit findings, and business self-identified
issues. Second, control issues were aggregated from the operating risk findings of the
numerous work streams set up to address issues identified in the OCC Consent Order.
Third, to ensure all inherent risks were captured, a group of qualified individuals
conducted site visits, interviewed key business functional stakeholders, assessed
Management Information Systems (MIS), and assembled a list of risks not previously
identified.
The Home Lending business has hired a Chief Control Officer who will be responsible for
Quality Assurance, issue resolution, and escalation within the business. The Chief Control
Officer will also be a member of the Home Lending Risk Management Committee.
Home Lending ERM Risk Assessment Evaluation
In accordance with the Federal Reserve Consent Order, JPMC has completed an
evaluation of the effectiveness of its current risk management program in the areas of
residential mortgage loan servicing, loss mitigation, and foreclosure activities and
operations. JPMC has developed a plan to enhance the program.
The evaluation process:
x
Reviewed all aspects of the current Risk Management program and referenced
supervisory guidance (including SR8-08/CA08-11, “Compliance Risk Management
Programs and Oversight at Large Banking Organizations with Complex
Compliance Profiles,” and SR 95-51, “Rating the Adequacy of Risk Management
Processes and Internal Controls at State Member Banks and Bank Holding
Companies”) and consulted with industry experts to determine if the current
structure is aligned with supervisory best practices.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
2
Federal Reserve Consent Order – JPMorgan Chase Response
x
Considered elements of the Risk Management program including governance,
policies and procedures, risk identification and assessment, organization, MIS,
training, testing and monitoring, and issue escalation.
x
Interviewed key operational and risk personnel and reviewed issues identified in
recent regulatory, audit, and operational risk reviews to determine the root cause
of these issues and the causal gaps in the effectiveness of the current Risk
Management structures.
The enhanced Risk Management program is designed to effectively identify and manage
enterprise risk with a focus on (1) addressing identified issues, (2) performing a
comprehensive annual risk assessment, and (3) establishing guidelines for compliance,
legal, and reputational risks and providing for regular review of related risks by
appropriate senior management and the Board of Directors.
Evaluation of Program Effectiveness
The evaluation of Risk Management was conducted based on the four key components of
JPMC’s Risk Management framework that mapped to key functional components:
Risk Management Framework
Identification
Measurement
Control with Tolerances
Monitoring and Transparency
Key Functional Program Elements
Risk Assessments, Issue Escalation
Analysis
Governance, Policies and
Procedures, Organization and
Training
MIS, Reports, Testing, Monitoring
Risk Assessments
Home Lending maintains a broad Control Self-Assessment (CSA) process, a key element
of the risk assessment framework. CSAs are executed by operational process control
owners and administered by the line of business Controller function. While CSA testing
was conducted on a timely basis, there was limited independent review of the process
and results. JPMC found that controls designed to identify and mitigate process-related
risks and the related testing were not sufficient. In addition, JPMC identified two gaps in
the Risk Management program with respect to risk assessments:
x
There needed to be a stronger risk assessment process as an inherent control
in order to identify and appropriately develop process risk mitigants for
material processing changes and/or the initiation of new business initiatives
(e.g., HAMP), implementation issues (e.g., a lack of trained processing
agents), as well as ongoing operational issues (e.g., increased defects,
processing delays). In some cases, risk assessments were performed, but
failed to adequately identify systemic issues on an end-to-end basis.
x
Gaps existed in the effectiveness of the operational risk control framework in
terms of resource levels and structure. Home Lending began to address these
gaps in mid-2010, when it expanded its Operational Risk Management
(“ORM”) staff, and began a program to conduct a series of comprehensive
independent risk assessments for a number of functional areas within the
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
3
Federal Reserve Consent Order – JPMorgan Chase Response
business. While progress has been made, questions continue regarding
resource levels, enforcement authority, and, in some cases, a lack of actual or
perceived authority to require independent risk assessments or enforce
mitigation plans and controls.
The risk management program evaluation was conducted as a survey/review of
governance and documentation at various levels of the organization, operational risk
process evaluations, and interviews with senior line of business risk and operations
management. Documentation reviewed as part of the evaluation is available for review.
The Risk Management program assessment identified areas for improvement and they
are being addressed through the remediation plans incorporated into the Consent Order
risk response. Project milestones have been identified and provided to the Federal
Reserve.
Issue Escalation
While the line of business (LOB) and overall Bank risk management frameworks lay out
clear lines of communication from line operating functions through various Risk
Committees to the Board of Directors, a number of systemic risks were not effectively
raised to appropriate levels of Home Lending management. Clear escalation paths were
not appropriately utilized or sufficiently effective. The rapid on-boarding of many new hires
and a large number of field promotions to accommodate the increases in workload further
exacerbated escalation challenges. The conditions for escalation and the appropriate
level for the escalation need to be enhanced.
To address escalation issues, late in 3rd quarter 2010, the Home Lending business
formed the Operational Risk Subcommittee of the Home Lending Risk Management
Committee. This committee has a written charter and meets to discuss Operational Risk
issues, action plans, and tracking. The minutes from the Home Lending Risk
Management Committee have been included in documentation of the Retail Financial
Systems (RFS) Risk Committee that meets monthly. Issues were escalated through the
RFS Risk Committee to the Risk Working Group and to the Bank’s Board-level Director’s
Risk Policy Committee. Enhancements are also being made to the Compliance
Management program and related reporting to ensure timely escalation of issues.
Additional staff is being added in both the Compliance and Internal Audit control functions.
In addition, the Home Lending business has hired a Chief Control Officer who will be
responsible for Quality Assurance, issue resolution, and escalation. The Control Officer
will be a member of the Risk Committee. In addition, senior management has been
strengthened and communications improved. Risk Committee and subcommittee
composition is being reviewed to ensure an independent view of business activities.
Testing and Monitoring
Independent testing and monitoring resources have been stretched, and the design and
execution of testing across functions needed to be strengthened. In addition, process
improvements and enhanced technology will facilitate testing and monitoring
effectiveness. The Home Lending business has made investments in the level of quality
assurance and quality control resources. There is now enhanced testing of key high-risk
default servicing functions to ensure process integrity.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
4
Federal Reserve Consent Order – JPMorgan Chase Response
Mortgage Servicing Operations Risk Assessment Process
In accordance with the April 13, 2011 OCC Consent Order, the Bank is conducting a
comprehensive assessment of risks in mortgage servicing. The assessment is
addressing operational, compliance-based, transactional, legal, reputational, and financial
risk. It emphasizes ten key functional areas: Loss Mitigation, Foreclosure, Real Estate
Owned, Property Preservation, Bankruptcy, Collections, Assumptions, Payments, Fees,
and Loan Integrity Operations. The Risk Assessment contains five distinct phases:
Approach, Data Gathering, Data Compilation and Gap Analysis, Findings Review, and
Documentation. The risk assessment and plan will be completed in August 2011.
Analysis, MIS and Reports
Home Lending servicing has developed substantial reporting capabilities around
operational and servicing metrics. However, the organization continues to experience
data integrity and accuracy issues stemming from gaps identified in the servicing systems’
lack of field level controls and the lack of interfaces between systems used for processing
critical transactions and for record changes. Known gaps exist in some operational
metrics due to servicing system data capture deficiencies. While reporting capabilities
capture significant amounts of data, the aggregation of data into actionable elements,
using agreed-upon key risk and performance indicators for making decisions, is less welldeveloped.
The Home Lending business has substantial MIS covering credit metrics for originations
(by product, channel, credit score, loan-to-value, geography, etc.) and portfolio
performance (delinquency, loss, etc.). Also, substantial loan production (sales) metrics
are available. The new Head of Home Lending receives a weekly report that is reviewed
every Tuesday at the Home Lending Metrics Meeting with Home Lending managers and
key support and control groups, which brings together additional key operating metrics
into one management forum. To obtain a more holistic view of the risks inherent in the
business, metrics regarding Performing and Default Servicing, Capital Markets, and Risk
Management have been added to complement credit, production, and portfolio metrics.
There is new consolidated MIS for default underwriting, loss mitigation results, third-party
monitoring, REO, technology, payment processing, and current business issues.
Management will examine whether the IT plans are sufficient, in terms of projects and
timing, to meet the needs of the Servicing business, with an expected timeframe of
August to September 2011. Metrics development is an evolving process and additional
metrics will be added to the MIS reporting as deemed necessary.
Governance
Home Lending’s overall risk management framework lays out a comprehensive and
appropriate governance framework and includes all relevant control functions in
overseeing enterprise risks. The Home Lending framework is consistent with Corporate
Risk Management, Federal Reserve and OCC risk management, and Compliance
guidelines. The current Federal Reserve and OCC guidance has been reviewed to ensure
that the governance framework is consistent. While the risk management governance
framework is clear, there have been gaps in the execution and effectiveness of
governance processes. Specific issues include:
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
5
Federal Reserve Consent Order – JPMorgan Chase Response
x
Risk Committees did not consistently provide an effective governance forum
for discussion and escalation of operational risks and weaknesses in the
control environment.
x
Risk Management did not provide sufficient oversight of default management
functions.
x
There were lapses in Operational and IT Risk governance and oversight of
controls in an environment where line organizations were operating in a
stressed mode of operation for a sustained period.
Additional Oversight
To improve oversight, Home Lending has added a Chief Control Officer position in the
business, and established an Operational Risk Subcommittee that reports to the Home
Lending Risk Management Committee with expanded content to include broader control
issues (Compliance, adverse audit findings). In addition, resources have been added in
control functions that support Home Lending (Compliance and Audit).
Risk Management has increased its engagement in a number of default related functions,
most notably in loss mitigation underwriting (including training) and the expansion of the
scope of the Home Lending Risk Committee to encompass default management strategy
oversight.
Policies and Procedures
Control gaps were found with respect to policies and procedures within the mortgage
servicing business. The process for writing, obtaining approval, and documenting policies
is not yet standardized. As a result, there are several policy and procedure inventories,
but no centralized system of record for maintaining them. In addition, policies and
procedures have, in some cases, been comingled in single documents, blurring the
distinction between approved policies and the procedures produced to support them. This
complicates the process of testing for policy compliance. The lack of a systemic, end-toend perspective on several mission critical processes also resulted in segmented,
inconsistent, and sometimes overlapping policies and procedures. The lack of clarity for
approval and authority to modify and enforce policies and procedures contributed to a
lack of controls in instances of data security, data integrity and third-party oversight.
The OCC Consent Order requires appropriate written policies and procedures to conduct,
oversee, and monitor mortgage servicing, Loss Mitigation, and foreclosure operations to
be implemented by September 12, 2011.
A review and evaluation of governance, processes, and controls for developing and
delivering policies and procedures to conduct, oversee, and monitor mortgage servicing,
Loss Mitigation, and foreclosure operations is underway. The Bank is focused on the
following activities:
x
Establishing a standard framework for developing policies and procedures.
x
Ensuring that the framework includes appropriate levels of review and approval
including independent risk and compliance.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
6
Federal Reserve Consent Order – JPMorgan Chase Response
x
Conducting an inventory of all current policies and procedures, identifying policies
and procedures requiring revisions, and new ones to be added.
x
Creating an end-to-end process that starts with a comprehensive list of applicable
laws, regulations, and investor requirements and maps those requirements to
internal policies and procedures to ensure required compliance.
x
Reviewing current repositories of policies and procedures to determine the best
long-term solution to house all policies and procedures in a single controlled
manner for ease of tracking, maintenance, access, and distribution.
Findings
The Bank identified gaps in the areas of governance, change control, and compliance
review. Specifically, policies and procedures have not been developed or maintained
according to a standard, uniform process and approach, and independent compliance and
risk reviews have not been performed consistently. Also, policies and procedures are
currently housed across multiple document repositories.
Remediation
To address the gaps identified in the policies and procedures:
x
A standard template, intake, and development process for change control has
been created. The new process defines the steps the Bank will take to review
policies and procedures. The steps are designed for the appropriate governance,
review, and approval to ensure a sustainable process. In addition, new or changed
policies and, where appropriate, procedures will be reviewed by independent
control functions including Compliance and Risk. These steps are designed with
the appropriate governance, review, and approval in mind to ensure a sustainable
process.
x
The Bank has developed a centralized inventory of over 2,000 existing Home
Lending policies and procedures. The inventory is organized to identify those
policies and procedures requiring immediate review to determine whether changes
are necessary, with priority given to those for loss mitigation and foreclosure
operations. In order to continue the centralization of procedures, the Bank has
developed a short-term workflow tool and defined the requirements for a long-term
procedures repository.
x
The Bank is focused on reviewing and re-engineering processes highlighted in the
OCC Consent Order (e.g., modifications, foreclosures). As the Bank re-defines
how the business will operate, procedure writers are mapping current inventory
and creating new content for areas of focus in the Order. Each team has a
dedicated group of control, risk, and compliance specialists as part of the review
and approval process prior to publication.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
7
Federal Reserve Consent Order – JPMorgan Chase Response
x
The Bank recognizes the need to ensure laws, regulations, and obligations are
identified and adequately reflected in policies and further detailed in procedures.
The Bank has developed a comprehensive Legal Requirements Matrix (described
in detail in Item 5), and the list of regulations is being mapped to existing policies
and procedures to identify, prioritize, and remediate any additional gaps.
x
The Bank is evaluating automated tools for storing laws, regulations, and
obligations that will link those legal requirements to the policies and procedures.
Organization
The organizations tasked with ensuring a safe and sound control and governance
framework in the mortgage business, Risk Management (including Operational and IT
Risk), Compliance, and Internal Audit, did not increase capabilities and capacity quickly
enough to keep pace with the growth in size, scope, and complexity of the mortgage
servicing operations. This resulted in a reduced ability for independent oversight to timely
identify insufficient business controls and to test, monitor, identify and mitigate risks as the
business attempted to adjust to material changes in the environment, as well as servicing
changes imposed upon it by external entities (e.g., regulators, investors).
As outlined in the Compliance and Audit Responses under this Consent Order (Items 5
and 6), significant additions to staff are in progress to support expanded testing and
reporting requirements. The Risk remediation plan also documents an assessment of
Risk Management resource requirements, which is in progress and is expected to be
completed by August 31, 2011. The Risk Management organization’s independent role
was reinforced and is responsible to ensure that a comprehensive Enterprise Risk
Management framework exists. The Risk oversight function was expanded with a new
Chief Risk Officer. In addition, Risk Management was reorganized and staff assessed
with a focus on effective oversight of default servicing activities.
Training
Mortgage Servicing struggled to absorb rapid staffing growth and, in many cases, hired
representatives with little or no home lending industry experience. This was compounded
by the need to respond to continuous demands to alter modification programs and
processes. The Home Lending organization had difficulty providing adequate time and
breadth of job skill training and job aids, as well as performing ongoing monitoring. As a
result, training was unable to keep pace and this contributed to high operational error
rates.
A comprehensive review of the Bank’s Training Program, including all activities related to
handling mortgage delinquencies, loss mitigation, and loan modifications is underway.
The Bank is assessing the current training programs and expanding them as necessary to
ensure that all staff are fully equipped to perform their roles with proficiency. Below is a
discussion of the current training programs and how the Bank is working to remediate the
identified gaps.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
8
Federal Reserve Consent Order – JPMorgan Chase Response
Findings
In reviewing the Bank’s Training Program, the Bank identified opportunities for
improvements. Specifically, in the past, managers may have elected to waive such
training for employees who enter the Bank with prior experience. In addition, the shared
responsibility of training between the centralized training team and job coaches has not
been standardized and in some cases may not be complementary enough to ensure staff
proficiency. Finally, changes in requirements and programs have not been integrated
effectively.
Remediation
To improve and strengthen the training program, the focus is on the following activities:
x
Implementing centralized oversight of all training that establishes a consistent
learning framework for all core roles and provides for greater control in the quality
and consistency of employee learning.
x
The centralized training team will manage the design and development of all
training materials and content, obtain appropriate legal and compliance approvals,
and maintain central training material archives.
x
Learner records and transcripts will be housed in a single repository,
enabling accurate MIS on learner participation rates and assessment
results.
x
The Bank is in the process of reviewing all coursework to ensure that content is
current and will be expanded to include formalized, ongoing learning and continual
assessment.
x
A process has been established to ensure that appropriate learning paths are
created for new roles.
x
Training for managers is being expanded beyond current core competency
training to functionally specific manager courses and learning paths.
x
To achieve a consistent approach in change readiness training, a dedicated
change training function will be established within the Home Lending training
organization. The team will be responsible for successful change integration.
Resources skilled in performance analysis and instructional design are dedicated
to each project team and working side-by-side with process engineers, policy and
procedure writers, and change management.
x
The training organization will partner with business owners to establish
appropriate validation, testing, or certification criteria. Learning paths will
incorporate appropriate testing and/or validation methods to confirm transfer of
knowledge and application of skill.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
9
Federal Reserve Consent Order – JPMorgan Chase Response
Employee participation in assigned learning will be tracked and reported to line
management with the expectation that managers will appropriately manage gaps. New
hires will be assigned appropriate learning paths at the time of hire and attendance will be
tracked via the Bank’s central learning management system (
). Training
records will include attendance and course assignments. Incumbent employees will be reassigned to appropriate learning paths based on role, current performance, and prior
training completion as supported by learner transcripts in
Default Underwriting Training
A summary specific to default underwriting training provides an example of how the
strengthened training program is being implemented. The following training has been
implemented and provided to default underwriting staff. A pre-training skill set
assessment was conducted in April to establish a baseline. The average score was
81.69%. Training materials were developed to address known issues from QA results,
weakness identified in the baseline assessment and the new requirements of Treasury
Supplement Directive SD 11-01. Approximately 2,900 underwriting staff have participated
in an average of 8 hours of training. The average post-training skill set assessment score
has improved 10.48% to 92.17%. Training will be continuous. Baseline training will
continue until all underwriters demonstrate required proficiency and QA scores evidence
the ability to execute properly. Monthly policy and hot topics training will be implemented
to keep skill sets current.
The completion of training programs by staff is monitored and assessed by training staff
that are separate from the business and independent from the Default Operation. The
training staff has a tool to electronically monitor participation and scoring. It provides
reporting after each assessment
Training staff, Default Underwriting management, Policy staff and QA staff collaborate on
the content of training materials. Content was designed to address known drivers of
defects with significant focus on revisions to SD 11-01 requirements and clarifications of
existing policy. Examples include the following: training on an income variability test to
cause certain transactions to be escalated to a senior underwriter; use of the income
calculator; use of P & L statements; clarification of acceptable forms of documentation;
clarifications to proper treatment of multiple forms of income such as passive, pension,
teacher, military, boarder, non-borrower, and rental income; and clarifications to fraud
detection requirements.
Conclusion
While Home Lending has the structure and components of a comprehensive risk
management framework, there are opportunities to enhance all functional risk
management program elements within Home Lending.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
10
Federal Reserve Consent Order – JPMorgan Chase Response
7. (a)
Ensure that the fundamental elements of the risk management program and any
enhancements or revisions thereto, including a comprehensive annual risk
assessment, encompass residential mortgage loan servicing, Loss Mitigation,
and foreclosure activities;
Risk Management Remediation Plan
Based on the assessment of the effectiveness of JPMC’s risk management program in
the areas of residential mortgage loan servicing, loss mitigation, and foreclosure
activities and operations, JPMC will implement the following remediation plan:
Response
Governance
Home Lending Risk Management Committee
The Home Lending Risk Management Committee (HLRMC) has been meeting
monthly and provides a forum for management review and discussion of existing or
emerging risks. The RFS Chief Risk Officer and the Home Lending Risk Officer will
co-chair the Home Lending Risk Management Committee. Membership will include
the Home Lending senior risk officers, key Home Lending leadership, the Home
Lending Chief Control Officer, and representatives from Audit, Compliance, and Legal,
and other members named at the discretion of the co-chairs. The HLRMC is
responsible for ensuring that the appropriate risk management framework and
governance processes exist for managing risks within the Home Lending business.
Oversight of the risk framework includes exception limits and reports, approval
authorities, resolution of audit and regulatory issues, profitability, collection strategies,
operational risk, approval processes, and models and performance metrics. The
HLRMC is accountable for risk identification, monitoring, and timely resolution of
issues.
As part of its charter, the HLRMC is responsible for the following:
x
Reviewing and approving credit, portfolio, operational, collateral, fraud, default,
and servicing risk-related policies.
x
Reviewing and authorizing incremental credit, portfolio, operational, collateral,
default, and servicing risk related to new product or new business development
initiatives and launches.
x
Establishing risk tolerance levels by product and LOB, including target market
definition, risk acceptance level, policy exception processing and reporting,
regulatory and compliance, and portfolio limits such as concentration, product
mix or exception limitations.
x
Overseeing the resolution of internal, external and regulatory audit issues
including current audit/regulatory results.
x
Reviewing operational Control Self-Assessment (CSA) monitoring and testing
results and key risk indicators, risk acceptances, and operational loss events
and trends.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
11
Federal Reserve Consent Order – JPMorgan Chase Response
x
Assessing and approving all acquisitions, sales or significant business
relationships with strategic implications for the Bank and advising the RFS Risk
Committee.
x
Approving risk and performance reporting standards.
x
Reviewing and evaluating loss estimates and loan loss reserve adequacy.
x
Delegating authority to various subcommittees, as needed.
Risk Governance Subcommittees of the HLRMC
Within the Home Lending business governance structure, several Risk Governance
Subcommittees of the HLRMC address risk issues for specific functional areas. In the
last 12 months, Home Lending established several additional risk subcommittees
under the HLRMC for Operational Risk, Servicing and Default, and Incentive
Compensation. Each of the Home Lending subcommittees is led by a chairperson
assigned by the HLRMC and comprises senior to mid-level risk subject matter experts
who are responsible for developing and executing risk policy and risk management in
their respective areas of control. All Home Lending Risk Management subcommittees
are accountable to the HLRMC and are responsible for appropriate escalation of
issues. Each subcommittee chairperson is responsible for determining appropriate
subcommittee membership and conducting subcommittee meetings with defined
agendas to appropriately address risks within the scope of the subcommittee. The
chairperson is also responsible to ensure that the subcommittee effectively identifies
monitors, resolves, or escalates risk issues. Within the next 90 days, Risk
Management will review the charter and membership of these subcommittees to
ensure that they have the appropriate management attention and focus, and that key
operational risks in Home Lending will be identified, communicated, and responded to
on a timely basis. Subcommittee recommendations and the resultant business actions
will be reviewed and reported to the Home Lending Risk Committee monthly.
Third-Party Oversight
Home Lending will develop and implement the following enhanced governance
controls for managing mortgage servicing functions performed by third parties as part
of the enhanced risk management framework:
x
Processes to perform appropriate due diligence on potential and current ThirdParty Provider qualifications, expertise, capacity, reputation, complaints,
information security, business continuity and financial viability, and to ensure
adequacy of staffing levels, training, work quality and workload balance.
x
Policies and procedures to ensure that work outsourced to third parties is
adequately documented, and that, taking a risk-based approach, third-party
policies and procedures will be assessed by Bank personnel.
x
Processes to ensure periodic reviews of third-party work for timeliness,
competence, completeness, compliance with applicable legal and regulatory
requirements, and supervisory guidance, and to ensure safety and soundness
of practices.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
12
Federal Reserve Consent Order – JPMorgan Chase Response
The Bank is applying significant resources to enhancing management and oversight of
Third-Party Providers, including development of a comprehensive plan to review all
outsource vendors. While a full review is appropriate, given the scope of review
required and the number of vendors involved, the Bank believes that the sequencing
of review and development of additional controls and remediation will need to be riskbased to ensure thoroughness of the process.
Management’s institution of governance and other enhancements to the Third-Party
Oversight (TPO) program includes assessing Business Criticality Classification
Tiering, which drives frequency of independent reviews. Additionally, management is
in the process of reviewing all contracts to ensure audit rights are included. Internal
Audit will perform an audit of the TPO oversight function. Additionally, TPO will be
considered in the scope of each audit and may potentially include on site
walkthroughs.
Under Article V of the OCC Consent Order, the Bank is currently engaged in
enhancing the TPO Program and has drafted a Firm-wide Third-Party Provider Policy,
both of which are now reflected in the draft of the enhanced Home Lending Policy.
The OCC Consent Order Response provides a detailed description of the Action Plan
to enhance the TPO program, which includes the elements highlighted above related
to risk management.
Systems, MIS and Data Integrity
Extensive systems development efforts are underway to combine servicing platforms
and to enhance field level data security, which will improve controls, efficiency, and
the inherent usefulness of Management Information Systems (MIS). Management will
examine whether IT plans are sufficient, in terms of projects and timing, to meet the
needs of the Servicing business. Home Lending will develop and implement an
acceptable plan for operation of its MIS for foreclosure and Loss Mitigation or loan
modification activities to ensure the timely delivery of complete and accurate
information to permit effective decision-making.
The Bank has made a significant investment in IT staff and resources over the past six
months and has formed a team to develop and manage the plan to address the
requirements of OCC Consent Article VIII and for Third-Party Management. The key
areas include changes or upgrades to monitor compliance with all applicable legal
requirements and supervisory guidance, and the requirements of the OCC Consent
Order; to ensure accuracy of records for all serviced mortgages; and to ensure that
Loss Mitigation, loan foreclosure, and modification staffs have sufficient and timely
access to information provided by the borrower regarding loan foreclosure and
modification activities.
Control Self Assessments
By August 2011, Home Lending will develop plans to strengthen the CSA program
and complete implementation by December 2011. As part of the review and
development of a plan to enhance the program, we will evaluate the frequency and
drivers of reviews, including changes in the operating environment, externalities, and
changes in volumes. In addition, Operational Risk Management, Risk, and
Compliance will partner to make sure that independent reviews of key CSA’s are
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
13
Federal Reserve Consent Order – JPMorgan Chase Response
performed on an annual basis to ensure that the process is functioning as intended
and that key risks are properly identified, evaluated, and escalated (e.g., adequate
testing is performed in a manner commensurate with the level of risk associated with
the control, and accurate conclusions are made).
CSA controls are considered in the scope determination of audits, including
consideration of open issues, in-progress action plans, and risk acceptances. Utilizing
a standardized testing program, Internal Audit specifically assesses the effectiveness
of the CSA focusing on appropriate business ownership (assessors and approvers),
composition, and control ratings. Each audit report requires a summary conclusion of
the CSA. Additionally, consistent with Internal Audit’s reporting policy, significant
issues with the CSA process would likely be captured as “Key Findings” in the audit
report. Key findings related to the CSA are evaluated with other identified issues to
determine the overall rating.
7. (b)
Response
Ensure that the risk management program complies with supervisory guidance
of the Board of Governors, including, but not limited to, the guidance entitled,
“Compliance Risk Management Programs and Oversight at Large Banking
Organizations with Complex Compliance Profiles,” dated October 16, 2008 (SR
08-08/CA 08-11); and
Risk Organization
JPMC will ensure that the risk management program has adequate staffing levels,
independence, requisite authority, and status to provide necessary governance to
JPMC’s mortgage servicing activities and operations. Home Lending management will
reinforce Risk Management’s role in the governance and oversight of mortgage
lending and servicing, including but not limited to policy and procedure governance,
default strategy review and compliance with risk policies, and adequate assessment
and testing for compliance with JPMC’s risk policies. Solid line reporting within
JPMC’s Risk organization (e.g., committees and risk management departments) will
be re-emphasized to promote independence and objectivity. Within the next 90 days,
Home Lending will also develop staffing plans to ensure an appropriate, well-governed
control environment. JPMC reviewed all aspects of the current Risk Management
program and referenced supervisory guidance (including SR8-08/CA08-11 and SR9551) and industry expert opinion to determine if the current structure is aligned with
supervisory best practices.
A comprehensive review of the Risk Management organization was completed in
September 2011. A memorandum was distributed to all Risk Management staff
across the Consumer businesses. The memorandum reinforces the independent role
of Risk Management, the primary responsibilities of Risk Management, and the
commitment that risk Management is held accountable for providing a robust risk and
control environment that reflects the learning from the recent Consent Order Actions in
Mortgage Banking. A new Mortgage Banking Chief Risk Officer,
, joined
Chase in October 2011 reporting to Sam Ramsey, Consumer Banking Chief Risk
Officer. The Mortgage Banking Risk Management organization has been reorganized
and the staff size has been increased. Final headcount will be reviewed by the new
Mortgage Banking Chief Risk Officer.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
14
Federal Reserve Consent Order – JPMorgan Chase Response
In addition, JPMC’s Risk organization will develop a plan to enhance the flow of
necessary and meaningful management information to appropriate levels and units
within the organization. This will include reports that focus on existing and emerging
risks, impacts, and recommendations to address those risks as warranted.
JPMC changed its structural reporting lines for risk management functions in March
2010. In the past, JPMC used a "dual reporting" structure for risk functions, in which
these functions had a solid line reporting to the firm's Chief Risk Officer and a dotted
line into the CEOs of the lines of business. JPMC decided in consultation with its
regulators to modify the reporting structure in order to continue to reinforce the
independence of the Risk Management function. As a result, each of the LOB Risk
Management functions now report directly to the Chief Risk Officer. This change does
not affect the participation of senior risk personnel in LOB Operating or Management
Committees, or any of the other important governance and leadership roles within
each line of business. Risk continues to maintain the same close working relationships
with each LOB as in the past, and the LOBs are expected to continue their past
practices and procedures with regard to controlling risk for the firm.
Operational (including IT) and Legal risks (which includes Reputational risk) are the
primary focus of management in Home Lending. The business has established a
program structure to ensure the development of a comprehensive action plan, which
will identify and close gaps in systems, processes, controls, and governance
procedures all supported by appropriate resources. Board oversight has been
enhanced and senior management in the business has been strengthened. Policies
and procedures are being cataloged, reviewed and re-written as appropriate along
with the governance structure around change control. Improved measurement and
monitoring of default management key risk indicators, improved issue recognition and
escalation through improved MIS, and functional and cross-functional work streams to
improve work flows will all assist in significantly reducing weaknesses in risk
management. Staff is being added to the Compliance and Audit control functions and
the composition of the Home Lending Risk Management Committee and
subcommittees is being reviewed. Additionally, both control and customer focus is
being enhanced through the introduction of individuals assigned as the single point of
contact (SPOC) for customer assistance.
Change Management
Within 90 days, Home Lending will develop and implement a disciplined and more
robust change management process along with updated new business initiative
approval (NBIA) policies and procedures to be deployed when assessing material
business changes. Risk Management will work with the business to develop a
comprehensive change management process that will:
x
Assess and rate risks related to material change (including systems, staffing
capacity and training needs).
x
Provide for timely post implementation review and issue resolution.
x
Engage appropriate control functions.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
15
Federal Reserve Consent Order – JPMorgan Chase Response
x
Develop appropriately scaled change management plans based on risk ratings
with adequate design, testing and implementation plans to address identified
risks.
x
Document and approve standards.
x
Ensure that tracking and reporting is functional and measures key risk and
performance metrics against objectives/expectations from day one.
x
Coordinate across impacted functions.
x
Communicate to senior management and appropriate Risk Committees.
While progress has been made, there are still gaps in assessment and rating of risks
related to material change (including systems, staffing capacity, and training needs),
engagement of appropriate control functions, documented approval standards,
appropriately scaled change management plans based on risk ratings with adequate
design, testing and implementation plans to address identified risks, communication to
senior management and appropriate Risk committees, and post implementation
reviews where appropriate. It is also unclear whether the organization has adequate
people resources dedicated to change management as operations managers
frequently appear to be tasked with both production and project management
responsibilities.
The lack of a well-defined risk assessment and change management process as a
core control has resulted in incomplete identification and development of process risk
mitigants for material processing changes and/or the initiation of new business
initiatives (e.g., HAMP), implementation issues (e.g., a lack of trained processing
agents), as well as ongoing operational issues (e.g., increased defects and processing
delays).
A new consumer wide policy has been reviewed at a recent RFS Risk Committee
meeting and will be up for adoption next month. The new policy will:
x
Establish a new RFS NBI Committee (RFS Risk subcommittee)
x
Define NBIs consistent with Firm Policy and OCC guidance as “Introduction of
a new or changed product, service or activity involving materially new or
different risks to RFS”
x
Establish a Risk Ranking Framework (H/M/L) based on:
o Complexity (e.g., Operations, Technology, people, third parties)
o Financial Impact (e.g., risk exposures, portfolio size, investment)
o Legal/Reputation Risk (e.g., regulation, TCF, privacy)
x
Define Roles and Responsibilities:
o LOB CRO will recommend risk rankings
o Any approver can escalate to a higher ranking
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
16
Federal Reserve Consent Order – JPMorgan Chase Response
o
Any high risk category makes the initiative “High”
x
Define minimum approval authorities for RFS and LOBs:
o All High Risk need RFS level additional approvals from RFS NBI
Committee
o Medium Risk will be approved by LOB committees and functional
heads
o Low Risk can be delegated within the LOB
x
Define key approvers (functional heads)
x
Provide guidance for Conditional Approvals, which will be discouraged
x
Define the Post Implementation Review process (6 – 12 months, or sooner)
x
Standardize documentation leveraging IB tracking system
x
Suggest templates for Initiatives and PIRs
x
RFS LOBs must adopt this policy or customize for their own specific needs, as
long as they meet RFS standards for:
o Risk Ranking
o Post Implementation
o Minimum approval authorities
o Documentation
Policies and Procedures
Home Lending will implement plans to strengthen the process for developing and
implementing policies and procedures, and to ensure that current policies and
procedures are accurate, complete, and appropriately documented. A review and
evaluation of governance, processes, and controls for developing and delivering
policies and procedures to conduct, oversee, and monitor mortgage servicing, Loss
Mitigation, and foreclosure operations is underway.
The process is expected to be completed by August 31, 2011.
As set forth in Item 7, above, the Bank identified gaps in the areas of governance,
change control and compliance review. Specifically, policies and procedures have not
been developed or maintained according to a standard, uniform process and
approach, and independent compliance and risk reviews have not been performed
consistently. Also, policies and procedures are currently housed across multiple
document repositories.
Remediation
The following is a summary of actions JPMC has taken to address the gaps identified.
Additional detailed information concerning these remediation actions is set forth above
in Item 7.
x
A standard template, intake, and development process for change control has
been created. This process addresses the steps to be taken for review of
policies and procedures.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
17
Federal Reserve Consent Order – JPMorgan Chase Response
x
The Bank has developed a centralized inventory of over 2,000 existing Home
Lending policies and procedures, and in order to continue the centralization of
procedures, the Bank has developed a short-term workflow tool and defined
the requirements for a long-term procedures repository.
x
The Bank is focused on reviewing and re-engineering processes highlighted in
the OCC Consent Order (e.g., modifications, foreclosures).
x
The Bank recognizes the need to ensure laws, regulations, and obligations are
identified and adequately reflected in policies and further detailed in
procedures. The Bank has developed a comprehensive Legal Requirements
Matrix (described in detail in Item 5), and the list of regulations is being
mapped to existing policies and procedures to identify, prioritize, and
remediate any additional gaps.
x
The Bank is evaluating automated tools for storing laws, regulations, and
obligations that will link those legal requirements to the policies and
procedures.
Corrective action plan oversight
Current Bank practices require that all regulatory Matters Requiring Attention (MRAs)
must have action plans with owners and targeted delivery dates. These action plans
are entered into the appropriate control self-assessment in
JPMC’s corporate
risk tool, for tracking and reporting purposes. A new policy has recently been
developed and implemented concerning the closure of action plans for MRAs to
ensure that senior management reviews and approves all MRA-related action plans
before they can be closed. Within the next 90 days, this senior management oversight
process will be expanded to include action plans related to high risk Internal Audit
findings and high risk items identified through Compliance, ORM, IT Risk, and investor
reviews.
While the specific review requirements are currently under development, the intent is
to ensure that senior control function managers (e.g., Risk Management, Compliance)
are engaged in the review of remediation plans and adequacy of implementation of
those plans in resolving issues that present significant operational, regulatory,
compliance, or reputational risk to the business.
Audit’s corrective action plan oversight activities include validation of MRA/MRIA
remediation plan closure, and follow-up on key issues identified in audit reports rated
less than satisfactory. Senior management receives a memorandum outlining key
issues identified in the validation work including any applicable new action items,
owners, and target dates. These results will also be reported in the Audit Executive
Management Report. Management reporting is in place to monitor compliance with
this validation standard. Results of the MRA/MRIA validations are summarized for the
Audit Committee.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
18
Federal Reserve Consent Order – JPMorgan Chase Response
7. (c)
Establish limits for compliance, legal, and reputational risks and provide for
regular review of risk limits by appropriate senior management and the board of
directors or authorized committee of the board of directors.
Risk Management Governance and Risk Appetite
A Firm-wide “Risk Appetite” Policy was adopted in December 2010. The policy
outlines the framework for establishing the firm’s overall appetite for risk. The
framework integrates return targets, risk controls and capital management and
encompasses a range of qualitative factors. The qualitative factors for which the firm
has little or no tolerance include:
x
x
x
Actions that damage the Firm’s reputation
Lack of compliance with regulatory mandates
Weak control environment
As per the Federal Reserve SR08-08/CA 08-11, Compliance risk does not lend itself
to similar processes for establishing and allocating overall risk tolerance, in part
because organizations must comply with applicable rules and standards. As a result,
the firm does not establish limits for these risks.
Response
The Head of Compliance for Home Lending is a member of the Home Lending Risk
Management Committee and Operational Risk Committee and will provide reports on
compliance activity to the appropriate risk committee or subcommittee. Compliance
will escalate MRAs, Compliance Testing and risk assessment results, and open audit
items to an appropriate committee or subcommittee of the Board. JPMC Corporate
Compliance will enhance its oversight of the effectiveness of Home Lending’s
Compliance Testing program.
The Risk Policy Committee is responsible for approving the overall framework, risk
appetite, and stated loss tolerances. The Risk Policy Committee is responsible for
oversight of the CEO's and senior management's responsibilities to assess and
manage the corporation's credit risk, market risk, interest rate risk, investment risk,
liquidity risk, and reputational risk. In performing this oversight, the Risk Policy
Committee shall:
x
review with management guidelines and policies to govern the process for
assessing and managing such risks
x
review benchmarks for and major financial risk exposures from such risks
x
receive and review reports from management of the steps it has taken to
monitor and control such exposures
x
review management's performance against these policies and benchmarks
x
receive and review reports on selected risk topics as management deems
appropriate from time to time
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
19
Federal Reserve Consent Order – JPMorgan Chase Response
x
review the corporation's capital allocation
x
review reports of significant issues prepared by internal risk oversight
functional groups.
The Chief Executive Officer (CEO) is responsible for setting the overall risk appetite of
the firm and reviewing it with the Operating Committee. LOB CEOs are responsible
for setting the risk appetite for their LOBs. The Framework includes a quarterly
process linked to the capital adequacy and liquidity processes for monitoring JPMC’s
risk appetite and loss tolerances. Key policy changes are shared with the Risk Policy
Committee.
Changes have been made to establish the appropriate governance, review and
approval of written policies to conduct, oversee, and monitor mortgage servicing, Loss
Mitigation, and foreclosure operations. These changes include requiring Risk
Management's review and approval of revised policies and new policies.
As part of the enhanced policy review process, Risk Management will ensure
alignment to Global Primary Risk Policies. The most relevant Global Primary Risk
Policies for the Home Lending business are the Consumer Risk Management,
Operational Risk Management, and the Reputational and Fiduciary Risk Management
Policies. Risk Management will address operational risk and reputational risk in
resolving issues identified in the Federal Reserve and OCC Consent Orders and
based on the results of the comprehensive risk assessment. Market, liquidity and
capital risk policies will be reviewed based on business priorities.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
December 8, 2011 - Final
20
Federal Reserve Consent Order – JPMorgan Chase Response
Item 7 – Enterprise Risk Management Plan
Summary of Response
The Federal Reserve has requested that the Bank develop and implement a plan to
enhance the enterprise risk management program (ERM) with respect to residential
mortgage loan servicing, loss mitigation, and foreclosure activities and operations.
Risk management performed an assessment of the effectiveness of the Home Lending risk
management program to develop an enhanced approach and oversight plan. Evaluation
conclusions and recommended enhancements include:
Evaluation Conclusions
x Deterioration of the housing market resulting in existing workout and loss mitigation
programs that were no longer sufficient and increasing customers requiring solutions
x Acquisition of two significant mortgage loan and servicing portfolios: Bear Stearns (EMC
Mortgage Company) and Washington Mutual.
x Rapid implementation of Government and Firm solutions to the crisis without the Firm
providing effective supporting policies, training, and technology; accompanied by
continuous changes to requirements
x Complex loan product and modification offerings and significant increases in delinquent
borrowers resulted in a material increase in the number of borrowers requiring personal
assistance.
x While the structure and components of a comprehensive risk management framework
exist, there are opportunities to enhance the effectiveness of the program.
x Core Risk Management staff did not scale consistent with the business’ need for
additional independent oversight.
Risk Management Remediation Plan
Perform a comprehensive risk assessment of Home Lending as required in Article X and
implement a process for conducting annually.
x Reassess charters of Home Lending Risk Committees within 90 days to ensure they
have the right membership and mandate.
x Implement enhancements to the Third-Party Oversight Policy and processes.
x Develop and implement plans for enhanced management information systems
x Develop plans to strengthen the Control Self Assessment testing program, aligned with
the new operating models resulting from the consent orders, including reporting and
escalation of issues, with complete implementation by December 2012.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 7: Risk – December 8, 2011
Federal Reserve Consent Order – JPMorgan Chase Response
ERM Compliance with Supervisory Guidance
x Evaluate risk staff needed to support the Home Lending business in order to provide
independent oversight and timely identification on risks.
x Reinforce risk management’s role in governance and oversight, specifically across the
areas included in the Consent Order.
x Develop and implement within 90 days a disciplined change management process with a
revised new business initiative approval policies and procedures.
x Implement plans to strengthen policies and procedures and related governance
processes.
x The Action Plan oversight process will be expanded to include senior management
review of action plans related to high risk Internal Audit findings and high risk items
identified through Compliance, ORM, IT Risk or investor reviews.
.
Risk Limits and Monitoring
x A firmwide “Risk Appetite” Policy was adopted in December 2010 and outlines the
framework for establishing the Firm’s appetite for risk.
x While the Firm does not establish limits for reputation, regulatory, and control
environment risk the Firm clearly has little or no tolerance for the qualitative factors that
relate to these risks.
Confidential Supervisory Information – Public Disclosure Strictly Prohibited
Item 7: Risk – December 8, 2011