The full text on this page is automatically extracted from the file linked above and may contain errors and inconsistencies.
ALLY FINANCIAL INC.
The Boards of Directors of Ally Financial and Residential Capital, LLC
Board Oversight Plan
Prepared for the Boards of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
Revised December 6, 2011
1
Confidential Treatment Requested
Table of Contents
Plan Overview for Board Oversight………………………………………………………..3
Principles Guiding this Plan………………………………………………………………...5
Background…………………………………………………………………………………..6
Consent Order Response…………………………………………………………………....8
Summary/Conclusion………………………………………………………………………22
Appendix I - Project Summaries…………………………………………………………..23
Appendix II - Board Level Deliverables and Due Dates…………………………………25
Appendix III - First Level Project Details………………………………………………...26
Appendix IV - Mortgage Servicing Staffing Adequacy and Workload Review………..30
2
Confidential Treatment Requested
Plan Overview for Board Oversight
This Program for Board Oversight (the “Program”) is established in response to the Consent
Order dated April 13, 2011 (the “Order”) among the Board of Governors of the Federal
Reserve System ( the “FRB”), the Federal Deposit Insurance Corporation (the “FDIC”), Ally
Bank (the “Bank”), Ally Financial Inc. (“Ally Financial” or “AFI”), and certain of Ally
Financial’s direct and indirect subsidiaries including Residential Capital, LLC (“ResCap”)
and GMAC Mortgage, LLC (“GMACM” and together with ResCap, the "Mortgage
Servicing Companies"). Capitalized terms not defined in the Program shall have the
meanings assigned to them in the Order.
The purpose of this Program is to define the activities related to Section 2 of the Order, which
states:
Within 60 days of this Order, the boards of directors of Ally Financial and ResCap, for itself
and on behalf of the Mortgage Servicing Companies shall submit to the Reserve Bank an
acceptable written plan to strengthen the boards' oversight of the Mortgage Servicing
Companies, including the boards' oversight of risk management, internal audit, and
compliance programs concerning residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities conducted by the Mortgage Servicing Companies. The plan shall also
describe the actions that the boards of directors will take to improve the Mortgage Servicing
Companies' residential mortgage loan servicing, Loss Mitigation, and foreclosure activities
and operations, and a timeline for actions to be taken. The plan shall, at a minimum, address,
consider, and include:
(a) Policies to be adopted by the board of directors of Ally Financial that are
designed to ensure that Ally Financial's enterprise-wide risk management
("ERM") program provides proper risk management with respect to the
Mortgage Servicing Companies' residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities particularly with respect to compliance
with the Legal Requirements, and supervisory standards and guidance of the
Board of Governors as they develop;
(b) policies and procedures adopted by Ally Financial to ensure that the ERM
program provides proper risk management of independent contractors,
consulting firms, law firms, or other third parties who are engaged to support
residential mortgage loan servicing, Loss Mitigation, or foreclosure activities
or operations, including their compliance with the Legal Requirements and
Ally Financial's and GMAC Mortgage's internal policies and procedures,
consistent with supervisory guidance of the Board of Governors;
(c) steps to ensure that Ally Financial's ERM, audit, and compliance programs
have adequate levels and types of officers and staff dedicated to overseeing
the Mortgage Servicing Companies' residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities, and that these programs have officers
and staff with the requisite qualifications, skills, and ability to comply with the
requirements of this Order;
3
Confidential Treatment Requested
(d) steps to improve the information and reports that will be regularly reviewed
by the board of directors or authorized committee of the board of directors of
Ally Financial regarding residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities and operations, including, compliance
risk assessments, and the status and results of measures taken, or to be taken,
to remediate deficiencies in residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities, and to comply with this Order;
(e) funding for personnel, systems, and other resources as are needed to carry out
the Mortgage Servicing Companies' residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities and operations in full compliance with
the Legal Requirements and the requirements of this Order, taking into
consideration the current and expected volume of past due loans;
(f) funding for personnel, systems, and other resources as are needed to operate
risk management and compliance programs that are safe and sound and that
are commensurate with the risk profile of the Mortgage Servicing Companies;
(g) steps to ensure that the Mortgage Servicing Companies have adequate levels
and types of officers and staff to carry out residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities in compliance with Legal
Requirements and the requirements of this Order, and taking into account the
size and complexity of the Servicing Portfolio; that they have officers and staff
with the requisite qualifications, skills, and ability to comply with the
requirements of this Order; and a timetable for hiring any necessary
additional officers and staff.
(h) periodic reviews of the adequacy of the levels and types of officers and staff to
carry out residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities in light of changes in the Servicing Portfolio or the
Legal Requirements. To conduct this review, the plan shall establish metrics to
measure and ensure the adequacy of staffing levels relative to existing and
future Loss Mitigation and foreclosure activities, such as limits for the number
of loans assigned to a Loss Mitigation employee, including the single point of
contact as hereinafter defined, and deadlines to review loan modification
documentation, make loan modification decisions, and provide responses to
borrowers;
(i) steps to ensure that the risk management, audit, and compliance programs for
the Mortgage Servicing Companies have adequate levels and types of officers
and staff and that they have officers and staff with the requisite qualifications,
skills, and ability to comply with the requirements of this Order, and a
timetable for hiring any necessary additional officers and staff;
(j) workload reviews of residential mortgage loan servicing, Loss Mitigation, and
foreclosure personnel who are responsible for handling individual loan issues
4
Confidential Treatment Requested
(including single point of contact personnel), including an initial review
within 90 days of this Order, and then annual reviews thereafter. Such
reviews, at a minimum, shall assess whether the workload levels are
appropriate to ensure compliance with the requirements of paragraphs 2(g)
and 5 of this Order. Promptly following completion of such reviews, the
Mortgage Servicing Companies shall adjust workload levels to ensure
compliance with the requirements of paragraphs 2(g) and 5 of this Order;
(k) policies to ensure that the risk management, audit, and compliance programs
have the requisite authorities and status within the organization to effectively
operate the programs, and that there is adequate coordination with respect to
these programs to ensure that any problems or deficiencies that are identified
in the Mortgage Servicing Companies' residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and operations are
comprehensively reviewed and remedied; and
(l) steps to improve the information and reports that will be regularly reviewed by
Ally Financial's and ResCap's boards of directors to assess the performance
of residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations, as well as the risk management and compliance
programs and associated functions including, compliance risk assessments,
and the status and results of measures taken, or to be taken, to remediate
mortgage servicing, Loss Mitigation, and foreclosure deficiencies, and to
comply with this Order.
In response to the Order, the boards of directors of Ally Financial and ResCap (“the
Boards”), for themselves and on behalf of the Mortgage Servicing Companies, have prepared
this Program in response to Item 2 of the Order and the requirements therein.
Principles Guiding this Plan
This Plan to strengthen Board oversight of the Mortgage Servicing Companies and related
risk management, compliance, and audit functions is based upon the requirements of the
Order and incorporates guidance set forth in the following:
x
Supervision and Regulation Letter SR 08-8 from the Board of Governors of the
Federal Reserve System entitled “Compliance Risk Management Programs and
Oversight at Large Banking Organizations with Complex Compliance Profiles"
(October 16, 2008), Section IV of which provides clear guidance related to the
responsibilities of boards of directors (and senior management); and
x
Basel Committee on Banking Supervision, Principles for Enhancing Corporate
Governance (October 2010).
5
Confidential Treatment Requested
Relevant guiding principles include:
1. Multiple Lines of Defense: Responsibility to ensure compliance with applicable
rules and standards resides across various business areas – operations (first line of
defense), risk management and compliance (second line of defense), and audit (third
line of defense).
2. Key Board Responsibilities: The Boards are responsible for setting an appropriate
culture of control and risk management, for establishing clear policies regarding the
management of key risks, and for ensuring that these policies are adhered to in
practice.
3. Boards' Level of Understanding: The Boards should have an appropriate
understanding of the types of risks to which the organization is exposed.
4. Senior Management: The Boards should ensure that senior management is fully
capable, qualified, and properly motivated to manage the risks arising from the
organizations' business activities in a manner that is consistent with the Boards'
expectations.
5. Reviews by the Boards: The Boards should review and, where appropriate, approve
key elements of the overall risk management program and oversight framework,
including firm-wide risk management and compliance policies, compliance and risk
management standards, and roles and responsibilities of key committees and functions
(e.g., risk management, compliance, and audit) providing independent and objective
oversight of operations.
Background
The board of directors of Ally Financial (“AFI Board”) is comprised of nine directors,
including a non-executive Chairman and one management director, Ally’s Chief Executive
Officer, (“CEO”). The AFI Board maintains three standing committees, including: a Risk
and Compliance Committee (“RCC”), an Audit Committee, and a Compensation,
Nominating and Governance Committee. The AFI Board's duties and responsibilities,
membership, and other Board-related governance matters are codified in the “Ally Board of
Directors Governance Policy,” which is posted on AFI’s website. ResCap maintains a
separate board of directors (“ResCap Board”), comprised of five directors, including two
independent directors that serve on the ResCap Audit Committee. The Ally Board and its
committees, along with the ResCap Board and its Audit Committee (collectively, “the
Boards”) oversee and govern the activities of the Mortgage Servicing Companies and the
related risk management, compliance and internal audit activities.
The Boards are aware of their duties and responsibilities for governing and overseeing
residential mortgage servicing, Loss Mitigation, and foreclosure activities, including the
adoption of adequate policies, procedures, and strategies to prudently conduct Ally’s
operations. The Boards discharge their duties and responsibilities in these areas, appropriately
delegating authority to Ally and the Mortgage Servicing Companies’ management as well as
6
Confidential Treatment Requested
to various board and management committees, councils, risk and compliance management,
and audit functions.
In addition to this delegation of authority, the AFI and ResCap Boards have each established
separate Consent Order Compliance Committees (“COCCs”), comprised of outside directors.
The primary purpose of these two new committees is to monitor oversight of the Companies’
compliance with the provisions of the Order.
The COCCs have the following
responsibilities:
x
Monitor oversight of the Companies’ compliance with the provisions of the Order.
x
Review progress and developments relating to compliance with the Order.
x
Review plans and other documentation developed with respect to the Order, as
appropriate.
x
Review key reports and trends and monitor the Companies’ progress under the
Order, as appropriate.
x
Submit progress reports to the applicable regulator with respect to the form and
manner of all actions taken to secure compliance with the Order and the results
thereof.
x
Meet with the Boards in connection with the Order.
x
Take action on matters as required by the Order.
The COCCs will work with the Boards to ensure that Board meeting agendas allocate
adequate time to discuss Order-related items and properly address issues, as necessary.
7
Confidential Treatment Requested
Consent Order Response
Ally’s response to the Order is comprised of actions to strengthen the Boards' oversight of the
Mortgage Servicing Companies, and related risk management, compliance, and audit
activities. These actions are organized in this Plan into the following four categories:
1.
2.
3.
4.
Governance and Authorities
Policies and Procedures
Workloads, Staffing, and Funding
Information and Reporting
The following table provides a reference to where each Section of the Order is addressed by
this Plan.
Consent Order
Paragraphs
Board Oversight Plan Response
Page
Plan Section
2a
Page 10
2. Policies and Procedures
2b
Page 10
2. Policies and Procedures
2c
Page 17
3. Workloads, Staffing, and Funding
2d
Page 19
4. Information and Reporting
2e
Page 13
3. Workloads, Staffing, and Funding
2f
Page 17
3. Workloads, Staffing, and Funding
2g
Page 13
3. Workloads, Staffing, and Funding
2h
Page 13
3. Workloads, Staffing, and Funding
2i
Page 17
3. Workloads, Staffing, and Funding
2j
Page 13
3. Workloads, Staffing, and Funding
2k
Page 9
1. Governance and Authorities
2l
Page 20
4. Information and Reporting
The Boards and senior management anticipate that additional actions may be required going
forward as a result of: (a) implementing other action plans related to the Order; (b)
strengthening Board Oversight as determined by the impending ERM Plan (to comply with
Section 14 of the order) and Mortgage Servicing Companies’ Risk Management Program (to
comply with Section 15 of the Order); and/or (c) taking actions beyond the requirements of
the Order, as warranted,. Additionally, the Boards are aware of the ongoing risk assessment
activities (Sections 12 and 13) and foreclosure review activities (Sections 3 and 4) related to
the Order; hence, the findings from these activities may determine that additional Board
Oversight actions are warranted and amendments to the Board Oversight Plan are necessary.
Finally, the Companies will expand the educational information provided to the Boards in the
8
Confidential Treatment Requested
normal course of business to increase their awareness of mortgage servicing operations,
industry trends, and the changing regulatory landscape, among other potential topics.
In addition to the narrative descriptions that follow, first-level project details are provided in
Appendices I and III of this plan.
1. Governance and Authorities
Consent Order section 2k requires:
(k) Policies to ensure that the risk management, audit, and compliance programs have
the requisite authorities and status within the organization to effectively operate the
programs, and that there is adequate coordination with respect to these programs to
ensure that any problems or deficiencies that are identified in the Mortgage Servicing
Companies' residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations are comprehensively reviewed and remedied.
The Boards along with Ally and the Mortgage Servicing Companies’ senior management are
committed to strengthening the risk management1, compliance, and audit functions and their
respective oversight of the Mortgage Servicing Companies. This Plan includes two key
governance and authorities-related actions by the Boards and senior management to improve
risk management, compliance, legal, and audit oversight of Ally’s residential mortgage
servicing, Loss Mitigation, and foreclosure activities.
x
1
2
3
Review Requisite Authorities and Status: Review and approve policies and/or
charters2 for AFI’s risk management program and for compliance, audit 3 and legal
functions and approve, where appropriate, any needed policy changes to ensure these
programs and/or functions have the requisite authorities and status to effectively
perform their respective oversight roles and programs related to residential mortgage
loan servicing, Loss Mitigation, and foreclosure. The AFI RCC will review and
approve policies and/or charters for AFI’s risk management and compliance programs
no later than June 30, 2012 and January 1, 2012, respectively (Appendix III-Section
III, Bullet 1 and Bullet 2 and Section IV, Bullet 1 and Bullet 2, respectively). The
AFI and ResCap Audit Committees will review and approve the audit policy and
charter by July 1, 2011 and August 1, 2011, respectively (Appendix III-Section II,
Bullet 1).
For purposes of this Plan, risk management is defined as the collection of activities across the first line and
second line of defense that have a role in the identification, assessment, management, monitoring and
reporting of risk.
Charters are stand-alone documents that outline the mission, scope, accountability and responsibilities,
independence as well as objectivity, and authority of a particular function.
The Audit Charter, which is required under professional standards for the practice of internal auditing, was
substantially modified in July 2010 following a comprehensive benchmarking against industry peers, and
reviews by Legal, outside counsel, and Ally’s external auditors. The Boards believe the Audit Charter provides
sufficient clarity regarding Audit’s authority and stature and Audit’s need for coordination with other control
functions. The Audit Charter and related policies and procedures will continue to be subject to annual review
by the Audit Committees and were most recently reviewed by the AFI Audit Committee in June 2011.
9
Confidential Treatment Requested
x
Coordination of Oversight Programs: The RCC will continue to support and monitor
the ongoing Risk Convergence 1 activities to promote continued effectiveness of
communication and coordination among the various risk management, compliance,
legal and audit functions. Additionally, risk management, compliance and audit
leadership will continue to attend and participate in Audit Committee and RCC
meetings and in the various management committees and councils (such as Global
Risk Management Committee, Compliance Risk Committee, etc.) at the AFI level.
Risk management, compliance and audit personnel that are focused on the Mortgage
Servicing Companies will continue to attend and participate in mortgage businessrelated committees and councils, such as the Mortgage Operational Risk and
Compliance Committee (“MORCC”). These forums and routines help to promote
effective coordination among the various risk and control functions and, coupled with
the sharing of issues tracking and reporting routines among these groups, helps ensure
that any problems or deficiencies that are identified are comprehensively reviewed
and remedied in a prompt and effective manner.
These activities are already
operating in practice; therefore, additional measures are not required to be taken to
comply with the Order.
We expect that these actions will further strengthen the company’s oversight and governance
and will ensure adequate coordination with respect to residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and the related risk, compliance, and audit
programs in full compliance with the requirements of the Order Section 2k.
2. Policies and Procedures
Consent Order sections 2a and 2b require:
(a) Policies to be adopted by the board of directors of Ally Financial that are designed to
ensure that Ally Financial's enterprise-wide risk management ("ERM") program
provides proper risk management with respect to the Mortgage Servicing Companies'
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities
particularly with respect to compliance with the Legal Requirements, and supervisory
standards and guidance of the Board of Governors as they develop; and
(b) Policies and procedures adopted by Ally Financial to ensure that the ERM program
provides proper risk management of independent contractors, consulting firms, law
firms, or other third parties who are engaged to support residential mortgage loan
servicing, Loss Mitigation, or foreclosure activities or operations, including their
compliance with the Legal Requirements and Ally Financial's and GMAC Mortgage's
internal policies and procedures, consistent with supervisory guidance of the Board
of Governors.
1
Risk Convergence was initiated in the first quarter of 2011 and includes ongoing activities facilitated by the
Risk Practices Council under the Risk and Compliance Committee (RCC). The goals of Risk Convergence are
to enhance efficiency and improve transparency around the management of operational risks, and to promote
effective communication and coordination across risk, compliance, audit, and other “control” functions.
10
Confidential Treatment Requested
Global policies are formulated within AFI and adopted throughout the company. Primary
responsibilities for policies and procedures (“P&Ps”) related to Ally’s residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities are developed within the Mortgage
Servicing Companies. It is expected that numerous new and/or modified P&Ps will be
required to comply with the changes resulting from the Order. These changes (including, for
example, support for the new Single Point of Contact requirements) will result in significant
incremental work by Ally’s and the Mortgage Servicing Companies’ resources to: (a) ensure
the P&Ps are kept current, (b) effectively communicate the changes throughout the
organization in a timely manner, and (c) consistently ensure compliance with the new P&Ps.
The Boards and senior management understand the importance of adopting a robust set of
policies to properly govern residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities. In order to ensure compliance with the Legal Requirements, and
supervisory standards and guidance of the Board of Governors as they develop related to
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities, the Boards
and senior management are taking the following two key actions:
x
Adopt Adequate ERM Policies: The RCC will review changes and/or enhancements
to existing risk policies1 as well as new and/or modified policies resulting from: (a)
the comprehensive risk assessment underway (that addresses, among other things,
Consent Order Sections 12 and 13), and (b) the impending program to review risk
management activities (that addresses Consent Order Sections 14 and 15) to ensure
such policies have been adequately designed and adopted to address risk management
with respect to residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities. The RCC will review any changes or enhancements to existing policies
and/or new risk policies by July 30, 2012, respectively (Appendix III-Section III,
Bullets 1 and 3).
x
Adopt Third-Party Provider2 Policies and Procedures: The RCC will monitor and
oversee the implementation of policies and procedures (“P&Ps”) that address proper
risk management of Third-Party Providers engaged to support residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities (as documented in the
Third-Party Management Plan that addresses Consent Order Section 6) , including
their compliance with the Legal Requirements and Ally's and GMACM's P&Ps are
consistent with supervisory guidance of the Board of Governors, and have been
adequately adopted. Global Supply Chain and Mortgage Supplier Office management
will present to the RCC the enhanced process, policies and procedures for addressing
risk management of Third Party Providers no later than July 30, 2012(Appendix IIISection III, Bullet 6).
We expect that these actions will strengthen the company’s P&Ps needed to ensure adequate
and proper ERM, and that ERM incorporates Third-Party Management with respect to
1
2
Existing risk policies include, for example, the Global Operational Risk Management Policy and the Global
Enterprise Governance and Risk Management Policy.
Third Party Providers include independent contractors, consulting firms, law firms, or other third parties who
are engaged to support residential mortgage loan servicing, loss Mitigation, or foreclosure activities or
operations.
11
Confidential Treatment Requested
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities on an ongoing
basis and in full compliance with the requirements of Order Sections 2a and 2b, and in
compliance with the Legal Requirements, and supervisory standards and guidance of the
Board of Governors as they develop.
3. Workloads, Staffing, and Funding
The Boards will address the Order's requirements relating to oversight of staffing and funding
by focusing action items on the Mortgage Servicing Companies (e.g., oversight of the first
line of defense) distinctly from action items for the risk management, audit, and compliance
programs (e.g., oversight of the second and third lines of defense). This approach will allow
the Boards to be more responsive to the differing maturity levels of these areas, as well as to
leverage existing oversight mechanisms, which are depicted in the diagram below:
Staffing and training needs to support the servicing of loans and end-to-end mortgage
servicing operations is within the purview of the ResCap and AFI Boards. Accordingly, the
action items described below in sub-section 3.1 of this plan will be overseen by the Boards.
The Boards will also oversee the Order requirements relating to workload reviews as well as
on ensuring that sufficient funding is allocated to the personnel, systems, and other resources
needed to support the Mortgage Servicing Companies and its support functions in compliance
with this Order.
The Boards will strengthen their oversight of existing processes that are in place to ensure the
adequacy of funding and staffing for the Mortgage Servicing Companies. Further, they will
oversee the implementation and the ongoing monitoring of results of the Single Point of
Contact (“SPOC”) Consent Order Action Plan (in connection with Consent Order Paragraph
5), and accordingly will address the workload, staffing, and funding requirements needed by
the SPOC program.
The adequacy of Compliance and Risk staffing levels and related funding is the responsibility
of the RCC. Audit staffing levels and funding needs are overseen by the Audit Committees.
These areas are addressed in the action items presented in sub-section 3.2 of this plan.
12
Confidential Treatment Requested
3.1 Workloads, Staffing, and Funding for Mortgage Servicing Operations
Consent Order sections 2e, 2g, 2h, and 2j require:
Funding for personnel, systems, and other resources as are needed to carry out the Mortgage
Servicing Companies' residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations in full compliance with the Legal Requirements and
(e) the requirements of this Order, taking into consideration the current and expected
volume of past due Funding for personnel, systems, and other resources as are
needed to carry out the Mortgage Servicing Companies' residential mortgage loan
servicing, Loss Mitigation, and foreclosure activities and operations in full
compliance with the Legal Requirements and the requirements of this Order, taking
into consideration the current and expected volume of past due loans;
(g) Steps to ensure that the Mortgage Servicing Companies have adequate levels and
types of officers and staff to carry out residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities in compliance with Legal Requirements and the
requirements of this Order, and taking into account the size and complexity of the
Servicing Portfolio; that they have officers and staff with the requisite qualifications,
skills, and ability to comply with the requirements of this Order; and a timetable for
hiring any necessary additional officers and staff;
(h) Periodic reviews of the adequacy of the levels and types of officers and staff to carry
out residential mortgage loan servicing, Loss Mitigation, and foreclosure activities in
light of changes in the Servicing Portfolio or the Legal Requirements. To conduct this
review, the plan shall establish metrics to measure and ensure the adequacy of
staffing levels relative to existing and future Loss Mitigation and foreclosure
activities, such as limits for the number of loans assigned to a Loss Mitigation
employee, including the single point of contact as hereinafter defined, and deadlines
to review loan modification documentation, make loan modification decisions, and
provide responses to borrowers; and
(j) Workload reviews of residential mortgage loan servicing, Loss Mitigation, and
foreclosure personnel who are responsible for handling individual loan issues
(including single point of contact personnel), including an initial review within 90
days of this Order, and then annual reviews thereafter. Such reviews, at a minimum,
shall assess whether the workload levels are appropriate to ensure compliance with
the requirements of paragraphs 2(g) and 5 of this Order. Promptly following
completion of such reviews, the Mortgage Servicing Companies shall adjust workload
levels to ensure compliance with the requirements of paragraphs 2(g) and 5 of this
Order.
Currently, Ally Financial and its Mortgage Servicing Companies perform periodic workload
reviews at the business unit and support function levels. These reviews include a gap
analysis to determine where adjustments or improvements are needed in terms of the skills of
existing staff performing specific mortgage servicing functions, their training and
13
Confidential Treatment Requested
development needs, and the qualifications needed for new hires. Each business unit and staff
function is responsible for determining and supporting the expected workloads and personnel
levels needed.
The AFI Board will continue to monitor and leverage the results of current staffing and
training processes. These include the annual CEO Talent Review/Assessment of the top
several hundred positions, which includes more than two dozen employees of the Mortgage
Servicing Companies. The review covers such key areas as performance reviews, flight risk
reviews, succession planning/bench strengths, and an analysis of various levels of authority.
This review process is performed in each business unit, and results in the identification of
gaps and issues, including training and development needs for existing staff. The Boards will
also oversee completion of staffing-related process improvements currently underway (in
particular those arising out of prior supervisory actions), including, for example, risk
management-related training for all employees, updates to position descriptions and hiring
qualifications, as well as training for new hires.
The Boards will oversee results of these current processes to ensure that staffing needs are
being met. In addition, as part of this action plan, the Boards will ensure that improvements
will be made to the process by which the mortgage servicing, Loss Mitigation, and
foreclosure functions perform workforce capacity planning activities. Changes being made
in policies and procedures (to meet new and emerging regulatory and business requirements)
are, in turn, driving changes in roles and responsibilities. As a result, a current and clear
understanding of the activities related to these new roles will be assessed as part of the staff
plans being prepared by the business and reviewed by senior management and the Boards.
In addition to utilizing existing volume-based ratios projected by the business units within
Mortgage Servicing Operations (which take into consideration the size and complexity of the
Servicing Portfolio), the workload/capacity analyses conducted by the businesses will be
enhanced to include a consideration of qualitative factors (e.g., allowing for more thorough
legal documentation reviews, etc.) in order to better determine resource levels in the future.
The workload analyses will directly incorporate factors such as: limits for the number of
loans assigned to a Loss Mitigation employee, including the SPOC, and deadlines to review
loan modification documentation, make loan modification decisions, and provide responses
to borrowers. The analyses will include an assessment of workload changes across
interdependent functions (e.g., assessing the impact on the Legal group’s needs if business
transaction volumes increase or more SPOCs are required).
Establishing quantitative, company-wide metrics or reporting as to the qualifications, skills
and ability of officers and staff is not practicable. However, the Mortgage Servicing
Companies maintain job descriptions that outline the requirements for each position. The
Mortgage Servicing Companies also maintain a comprehensive performance management
process that incorporates individual goal setting, development objectives, interim reviews,
and year-end performance evaluations. This process, along with monitoring of individual
performance and quality metrics for many of the volume-sensitive positions, helps to ensure
individual employees’ skills, experience, qualifications and performance is commensurate
with the requirements of his or her position. While reporting on these activities in a
meaningful way is not practicable, the Mortgage Servicing Companies will incorporate some
14
Confidential Treatment Requested
high-level demographic statistics (overall experience, credentials, etc.), along with
information on learning and development activities, into the proposed quarterly staffing
reporting to be provided to the ResCap board of directors.
Funding requirements and forecast updates are driven from business management, and are
reviewed at quarterly CEO business meetings with senior management team members,
including weekly meetings with the CEO’s direct reports, and monthly business reviews with
each mortgage-related business area to address funding needs, decisions, and approvals. This
information and analysis form a baseline of information to be considered for review by the
Boards. The Boards will review workload, staffing, and funding requirements across Ally’s
end-to-end mortgage servicing operations as well as in the support functions. Actions taken
will result in providing the Boards with timely reports that highlight workloads and staffing
information for their review.
Appendix IV includes an overview of the components anticipated to be included in the
enhanced management analysis and board oversight of workload review and staffing
adequacy for the Mortgage Servicing Companies.
The Boards, along with management’s advice and leadership, will be taking two key actions
related to addressing “Workloads, Staffing, and Funding for Mortgage Servicing Operations:"
x
Adequate Staffing of Mortgage Servicing Operations: This includes:
- The ResCap Board will oversee and review the results of management’s process
for reviews of the Mortgage Servicing Companies’ workload requirements, staff
forecasts, and gaps, including a timetable for hiring any necessary additional
officers and staff which will, in part, be informed by such reviews. Management
of the Mortgage Servicing Companies will present to the ResCap Board the
results of the initial workload review and staffing adequacy analysis no later than
July 12, 2011 (Appendix III-Section V, Bullets 3 and 4), and at least quarterly
thereafter (with monthly updates on key staffing and workload issues, as
necessary).
- The ResCap Board will review the results of other initiatives relating to the Order
(including SPOC requirements) to help ensure appropriate levels and types of
officers and staff required to oversee mortgage servicing processes. This will be
accomplished through the work of the COCC (Appendix III-Section VI) and the
COCC’s updates to the ResCap Board of Directors (Appendix III-Section V,
Bullet 6) as needed.
- The Boards will oversee and review the results of management’s assessment of
staffing levels and whether the staff has requisite qualifications, skills, and related
requirements, including demographic data about the staff and information
regarding the extent of learning and development programs. Management of the
Mortgage Servicing Companies will present to the ResCap Board the results of
the initial workload review and staffing adequacy analysis no later than July 12,
15
Confidential Treatment Requested
2011 (Appendix III-Section V, Bullets 3 and 4), and at least quarterly thereafter
(with monthly updates on key staffing and workload issues, as necessary).
- The Boards will review the results of the workload review of mortgage servicing
(including SPOC) personnel and authorize, as appropriate, adjustments to
workload levels as needed; the Boards will ensure such reviews occur at least
annually and the initial review will occur no later than August 11, 2011.
Management of the Mortgage Servicing Companies will present to the ResCap
Board the results of the initial workload review and staffing adequacy analysis no
later than July 12, 2011 (Appendix III-Section V, Bullets 3 and 4), and at least
quarterly thereafter (with monthly updates on key staffing and workload issues, as
necessary).The Boards will oversee progress on the Mortgage Servicing
Companies’ staffing plans (including training, hiring and internal reassignment
actions) as appropriate. Management of the Mortgage Servicing Companies will
present to the ResCap Board the results of the initial workload review and staffing
adequacy analysis no later than July 12, 2011 (Appendix III-Section V, Bullets 3
and 4), and at least quarterly thereafter (with monthly updates on key staffing and
workload issues, as necessary).
x
Adequate Funding of Mortgage Servicing Operations: This encompasses:
- The ResCap Board will oversee and approve as necessary requests by the
Mortgage Servicing Companies’ for additional funding for systems, personnel or
other resources to meet the requirements of the Order, taking into consideration,
among other things, the current and expected volumes of past due loans. The
ResCap Board will oversee and approve requests by the Mortgage Servicing
Companies’ for necessary funding no later than January 1, 2012 as part of the
creation of the 2012 business plan (Appendix III-Section V, Bullet 2). Additional
investments required during 2011 to ensure compliance with the requirements of
the Order will be approved by the COCCs (Appendix III-Section VI, Bullet 3).
- Mortgage Servicing Companies’ management will provide the ResCap and AFI
Boards reports on the Mortgage Servicing Companies’ business plans and
forecasts to assist the Boards in their monitoring of progress on business plans and
the adequacy of resources (systems, personnel, and other) relative to the Mortgage
Servicing Companies’ risk profile and requirements of the Order. The ResCap
Board will oversee and approve requests by the Mortgage Servicing Companies’
for necessary funding no later than January 1, 2012 as part of the creation of the
2012 business plan (Appendix III-Section V, Bullets 2 and 3).
Additional
investments required during 2011 to ensure compliance with the requirements of
the Order will be approved by the COCCs (Appendix III-Section VI, Bullet 3).
The AFI Board will establish a process, by December 1, 2011 for its oversight of
the Mortgage Servicing Companies’ business plans and resource adequacy, taking
into consideration the efforts of the ResCap Board and the RCC (Appendix IIISection I, Bullet 4).
16
Confidential Treatment Requested
In carrying out the above actions, the COCC’s will work with management to review the
proposed metrics to measure and ensure the adequacy of staffing levels relative to existing
and future Loss Mitigation and foreclosure activities, such as limits for the number of loans
assigned to a Loss Mitigation employee, including the single point of contact, and deadlines
to review loan modification documentation, make loan modification decisions, and provide
responses to borrowers.
3.2 Staffing and Funding for the Risk Management, Audit, and Compliance Programs
Consent Order sections 2c, 2f, and 2i require:
(c) Steps to ensure that Ally Financial's ERM, audit, and compliance programs have
adequate levels and types of officers and staff dedicated to overseeing the Mortgage
Servicing Companies' residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities, and that these programs have officers and staff with the
requisite qualifications, skills, and ability to comply with the requirements of this
Order;
(f) Funding for personnel, systems, and other resources as are needed to operate risk
management and compliance programs that are safe and sound and that are
commensurate with the risk profile of the Mortgage Servicing Companies; and
(i) Steps to ensure that the risk management, audit, and compliance programs for the
Mortgage Servicing Companies have adequate levels and types of officers and staff
and that they have officers and staff with the requisite qualifications, skills, and
ability to comply with the requirements of this Order, and a timetable for hiring any
necessary additional officers and staff.
The company’s Audit program is relatively mature in terms of addressing audit staffing
requirements, and is supported through quarterly reporting to the Audit Committees,
providing updates on metrics and audit plans which highlight staffing levels and skills needed
to implement the audit plans, and which are tied into the annual audit plan.
Recently, Audit Services engaged a third party to help it conduct a detailed organizational
effectiveness study to identify any key talent gaps and necessary training. This work included
an independent assessment of key leaders on the team and their requisite industry expertise.
The results of this review were favorable.
Audit Services, as part of its Action Plan in response to Paragraphs 16 and 17 of the Order,
created a Servicing Center of Excellence (CoE) that brings together a cross-functional team
within Audit from various disciplines and business lines. Among other things, the CoE will:
review and discuss emerging risks in servicing, review scoping of servicing-related audits,
review progress and potential issues arising from audit work, and review and discuss
servicing audit results to evaluate cross-firm risks. Finally, CoE members will actively
participate on servicing audits and relevant training, helping to staffing for audits of the
Mortgage Servicing Companies includes individuals with requisite qualifications, skills and
ability.
17
Confidential Treatment Requested
The Audit Committees (reporting into the Boards) will continue to monitor the Audit
program, which is further described and addressed in the “Ally Audit Services Consent Order
Action Plan” (in connection with Consent Order Sections 16 and 17). For further detail,
please reference Audit Action Plan Section under Plan Overview for Audit Services
section c.
Compliance will, as necessary, enhance reporting and monitoring of staffing needs/gaps,
training, hiring, and related issues (including supporting legal resources as appropriate),
while enhancement of staffing needs/gaps relating to the risk management program will be
separately considered in connection with Consent Order Sections 14 and 15. The RCC will
oversee the initiatives described in the Compliance Program Consent Order Action Plan (in
connection with Consent Order Sections 7 and 8), and the Risk Management Consent Order
Action Plan (in connection with Consent Order Sections 14 and 15) to increase the
transparency of staffing-related needs to the Boards for these programs. The ResCap Board
will increase its oversight of the line of business compliance and risk staffing dedicated to the
mortgage business through at least annual reporting by those groups on their plans and results
of their work. For further detail, please reference Enterprise Compliance Program Action
Plan Appendix I, item B.6 and Mortgage Compliance Program Section k. first bullet, and
Risk Management Action Plan Section 15 of the Order, bullet (b).
The RCC and Audit Committees are taking the following two key actions:
x
Adequate Staffing of the Risk Management, Audit, and Compliance Programs:
This includes the following activities that, for Audit, are already in process (Appendix
III-Section II, Bullet 3) for the risk and compliance functions will be in place by June
30, 2012 (Appendix III-Section III, Bullet 4) and January 1, 2012 (Appendix IIISection IV. Bullet 4), respectively.
- Continue to monitor the Audit program and its staffing plans and updates thereto
on at least a quarterly basis (Audit Committees), including timetables for hiring
any necessary additional officers and staff.
- Oversee the ongoing process for reviews of staff forecasts and gaps in the Risk
Management and Compliance programs, including legal support staff needs
(RCC) and timetables for hiring any necessary additional officers and staff.
- Understand key metrics, thresholds, and board-level workload and staff reporting
requirements for these support functions such as quarterly staffing analysis reports
to the RCC (similar to the Audit program’s quarterly reporting to the Audit
Committee) and a summary report on risk management and compliance’s
assessments of skills gaps (RCC).
- Review results of other relevant Order action plan initiatives to help analyze
appropriate levels and types of officers and staff required to oversee the Risk
Management, Audit, and Compliance programs (RCC and Audit Committees).
Oversee staff counts and requisite qualifications, skills, and related requirements
for key positions in Risk Management and Compliance programs and address
18
Confidential Treatment Requested
required staffing, leveraging the results of the talent reviews and skills gap
assessments currently performed by Human Resources and the support functions,
as applicable (RCC).
- Monitor Risk Management and Compliance (RCC) and Audit (Audit Committees)
staffing plans and reporting.
x
Adequate Funding of the Risk Management, Audit, and Compliance Programs:
This encompasses the following activities that are already in place for Audit
(Appendix III-Section II, Bullet 4) and that will be implemented for risk and
compliance functions by June 30, 2012 (Appendix III-Section III, Bullet 5) and
January 1, 2012 (Appendix IIII-Section IV, Bullet 5), respectively:
- Continue to monitor the existing Audit program and its funding requirements and
updates (Audit Committees).
- Monitor results of the Risk Management and Compliance Order action plans as a
basis for confirming the ongoing process for assessing the appropriateness of
funding requests for these functions (RCC).
- Review the process for assessing funding with senior management and the Boards
(including the Audit Committee and the Risk and Compliance Committee), as
appropriate.
- Conduct annual management and Board evaluations of the Risk Management (per
Order Sections 14 and 15) and Compliance Management (per Order Sections 7
and 8) program plans and forecasts to ensure investment adequacy in line with
Mortgage’s risk profile.
We expect that these actions will strengthen the Boards’ oversight to ensure that adequate
levels and types of officers and staff are dedicated and trained in the appropriate mortgage
servicing and support functions, with the requisite qualifications, skills, and ability, and that
adequate funding is provided to the mortgage servicing and support functions, to comply with
the requirements of the Order.
4. Information and Reporting
Consent Order sections 2d and 2l require:
(d) Steps to improve the information and reports that will be regularly reviewed by the
board of directors or authorized committee of the board of directors of Ally Financial
regarding residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities and operations, including, compliance risk assessments, and the status and
results of measures taken, or to be taken, to remediate deficiencies in residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities, and to comply
with this Order; and
19
Confidential Treatment Requested
(l) Steps to improve the information and reports that will be regularly reviewed by Ally
Financial's and ResCap's boards of directors to assess the performance of residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations,
as well as the risk management and compliance programs and associated functions
including, compliance risk assessments, and the status and results of measures taken,
or to be taken, to remediate mortgage servicing, Loss Mitigation, and foreclosure
deficiencies, and to comply with this Order.
Given the size, complexity, and geographic dispersion of the Mortgage Servicing Companies’
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities, improved
information and reporting will be invaluable in proactively overseeing the business. The
COCCs will work with the Mortgage Servicing Companies’ management to identify for the
Boards the appropriate operational performance metrics, and to design and implement
appropriate Board-level reports, including metrics on loan modifications and foreclosure
activities, workload levels, staffing, and funding needs, as well as progress related to the
SPOC function. Management of the Mortgage Servicing Companies will work with the
COCCs to develop and/or enhance reports, which will ultimately be provided to the Boards
for their review.
Similarly, enhanced reporting related to the support functions’ (e.g., Risk Management,
Compliance, and Audit) monitoring and assisting the mortgage servicing operations are
essential, and will be a primary part of this action plan. Audit reporting, which is part of a
relatively more mature Audit program, will continue to be reviewed and assessed by the
Audit Committees, including clear identification in such reports of audit results regarding
mortgage servicing. Compliance and Risk Management reporting will be further developed
to ensure transparency around these groups’ activities related to residential mortgage loan
servicing, loss mitigation and foreclosure activities. The Boards will also require
management to incorporate the results of initiatives described in the Compliance Program
Consent Order Action Plan (in connection with Consent Order Paragraphs 7 and 8), and the
Risk Management Consent Order Action Plan (in connection with Consent Order Paragraphs
14 and 15) to ensure discussion of key risks and compliance issues, as well as to inform the
Boards’ review and decisions related to staffing and funding needs of the Mortgage Servicing
Companies’ operations. The RCC and the ResCap Board will also receive timely reporting on
the results of compliance risk assessments and measures taken, or to be taken, to assess the
performance of and to remediate deficiencies in residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities.
Status reporting for the various Action Plans related to the Consent Order is also essential,
and will be monitored by the COCCs, which will also provide committee reports to the
respective Boards.
While Ally’s current management reports are similar to those of many peer organizations,
management believes there is an opportunity to improve upon the quality of information
regularly reviewed by senior management and provided in support of board oversight.
Examples of opportunities for improvement may include: (a) better approaches to using a
common framework to help indicate the relative magnitude of various risk exposures, (b)
enhanced visibility into the relative priorities of remedial actions in foreclosure activities, (c)
20
Confidential Treatment Requested
greater use of benchmark data, peer group comparisons, etc. to help identify issues, (d)
increased visibility regarding external industry data and macro-level information, and (e)
more robust approaches and the identification of specific industry-related indicators relevant
to identifying and reporting on emerging risks. This action plan will also confirm the
appropriate depth of information and the frequency of reporting to be provided to the Boards,
including key metrics/indicators to highlight top risks, alternative scenarios, results, and
trends across all key areas of mortgage servicing and support functions, on a monthly and
quarterly basis, as needed, and as summarized in Appendix III.
Understanding the importance of “asking the right questions, getting the right answers, and
taking the right actions” as they pertain to mortgage servicing performance, workloads,
staffing, funding, risks, compliance, and audit, Ally’s Boards and senior management are
planning two key actions:
x
Enhanced Mortgage Servicing Reporting: Review existing mortgage servicing
reporting, identify appropriate operational performance metrics (both internal and
external), design enhanced reports, and oversee a sustainable process and tools to
support the needs of senior management and the Boards. Mortgage Servicing
Companies’ management will create an enhanced suite of reporting to facilitate
improved oversight by the Boards. A draft of the proposed reporting will be
presented to the COCCs by November 1, 2011 (Appendix III-Section VI, Bullet 5)
and will subsequently be implemented for at least quarterly reporting to the ResCap
Board of Directors by December 16, 2011 (Appendix III-Section V, Bullet 5.) The
AFI Board, as previously noted, will establish processes by which it will leverage the
work of the ResCap Board and the RCC (Appendix III-Section 1, Bullet 4) and will
also require a review of the mortgage servicing operations at least annually,
commencing in 2012 (Appendix III-Section I, Bullet 2).
x
Enhanced Risk Management, Compliance, and Audit Reporting: As above, but
for: (a) support functions including risk management, compliance, and internal audit
(leveraging existing audit reports) as well as for (b) status reports and dashboards
related to the Order, as coordinated by the COCCs. Reporting for risk and
compliance functions will be provided to the RCC by June 30, 2012 (Appendix IIISection III, Bullet 7) and February 29, 2012 (Appendix III-Section IV, Bullet 6),
respectively. Audit reporting to the Audit Committees already exists and will be
continued (Appendix III-Section II, Bullet 5). The COCC’s will receive at least
quarterly updates related to the Order starting October 28, 2011 (Appendix IIISectionVI, Bullet 3).
We expect that these actions will improve the information and reporting reviewed regularly
by the Boards and will strengthen their ability to assess performance and related remediation
initiatives on an ongoing basis, in full compliance with the requirements of the Order.
* * *
21
Confidential Treatment Requested
Project summaries and more-detailed Action Plans with tasks, responsible parties, timelines,
and deliverables to address each identified area for improvement are included in Appendices
I, III and IV, respectively.
Summary/Conclusion
The action items and supporting information provided in this plan are the result of
discussions with key Ally stakeholders, a review of relevant materials/reports provided to the
Boards (e.g., at board meetings), and other relevant reference documentation, plus input
related to relevant corporate governance and industry best practices.
The Board Oversight team conducted discussions with numerous key stakeholders including
members of the Boards, and senior management personnel in the areas of Mortgage
Servicing, Risk Management, Compliance, Legal, Finance, Human Resources, Public Policy
& Government Affairs, and other functional areas pertinent to the Order.
We expect that these actions will strengthen the Boards’ ability to provide the oversight of
the company’s residential mortgage loan servicing, Loss Mitigation, and foreclosure
activities, and the risk management, audit, and compliance programs for the Mortgage
Servicing Companies, in full compliance with the requirements of the Order.
22
Confidential Treatment Requested
Appendix I - Project Summaries
Below is a summary of the projects that support the Board Oversight Action Plan.
Action Plans:
1. Governance and Authorities
1.1 Review Requisite Authorities and Status: review policies and/or charters for the
Risk Management Compliance, Audit and Legal functions to ensure these functions
have the requisite authorities and status, and are appropriately communicating and
coordinating activities, to effectively perform their respective oversight roles and
programs related to residential mortgage loan servicing, Loss Mitigation, and
foreclosure.
1.2 Coordination of Oversight Programs: Continue to support and monitor ongoing
Risk Convergence activities related to residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities, which promote effective communication and
coordination across oversight programs (i.e., risk management, compliance, and
audit programs) and other control functions, and ensure deficiencies identified are
comprehensively reviewed and remedied.
2. Policies and Procedures
2.1. Adopt Adequate ERM Policies: Review existing ERM policies as well as new
and/or modified policies resulting from (a) the comprehensive risk assessment
underway (that addresses Consent Order Sections 12 and 13) and (b) the impending
program to review risk management activities (that addresses Consent Order Sections
14 and 15) to ensure policies have been adequately designed and adopted to address
risk management (the second line of defense) with respect to residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities.
2.2. Adopt Third-Party Provider Policies and Procedures:
Monitor the
implementation of the proposed ERM policies and procedures (“P&Ps”) that address
proper risk management of Third-Party Providers engaged to support residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities (as documented
in the Third-Party Management Plan that addresses Consent Order Section 6) to
ensure all related P&Ps have been adequately adopted.
3. Workloads, Staffing, and Funding
3.1a Adequate Staffing of Mortgage Servicing Operations: Review management’s
mortgage servicing workload and staffing forecasts/plans. Establish a process for
reviewing, at least annually, workload requirements, staff forecasts, and gaps.
Confirm that the initial workload review of mortgage servicing (including SPOC)
personnel is conducted by August 11, 2011 (per the required 90-day period of the
Order), and adjust workload levels as needed.
23
Confidential Treatment Requested
3.1b Adequate Funding of Mortgage Servicing Operations: Critically review
mortgage servicing expenditure requests. Monitor an ongoing process for assessing
the appropriateness of mortgage servicing funding requests, and conduct, at least
annually, management and board evaluations of mortgage servicing business plans
and forecasts to ensure investment adequacy in line with mortgage’s risk profile and
to meet the requirements of the Order.
3.2a Adequate Staffing of Risk Management, Audit, and Compliance Programs:
Review existing risk, compliance, and audit staffing forecasts/plans. Oversee the
ongoing process for reviewing staff forecasts and gaps in the Risk Management,
Compliance and Audit programs, and continue to monitor each function’s staffing
needs and plans for addressing gaps. Monitor staffing levels and needs for the risk
management, compliance and audit functions, and review results of the risk,
compliance, and audit action plans relating to the Order.
3.2b Adequate Funding of the Risk Management, Audit, and Compliance Programs:
Review risk, audit, and compliance expenditure requests. Establish a process for
assessing, at least annually, the appropriateness of audit, risk and compliance
funding, conduct at least annual management and board committee evaluations of
each function’s plans and forecasts to ensure adequate funding levels.
4. Information and Reporting
4.1
Enhanced Mortgage Servicing Reporting: Review existing mortgage servicing
reporting, and work with management to identify appropriate operational
performance metrics (both internal and external) and enhanced reports.
4.2
Enhanced Risk Management, Compliance, and Audit Reporting: As above, but
for (a) support functions such as risk management, compliance, and internal audit as
well as for (b) status reports and dashboards related to the Order, as coordinated by
the Consent Order Compliance Committees.
24
Confidential Treatment Requested
Appendix II - Board Level Deliverables and Due Dates
Board Level Deliverable
Approval of this Board Oversight Plan by the AFI Board and ResCap Board.
Each deliverable described in Appendix III will be reviewed and/or approved
by the Boards and/or COCCs, as appropriate.
Due Date
6/09/11
In accordance with
Appendix III.
25
Confidential Treatment Requested
Appendix III - First Level Project Details
I. Ally Financial Board of Directors
1.
2.
3.
4.
Action
Establish a Consent Order Compliance Committee
Receive and review annual reporting by management regarding
residential mortgage loan servicing, loss mitigation and
foreclosure, including related risk assessments
Receive updates from the Consent Order Compliance
Committee so as to monitor progress on the requirements of the
Order
Establish a process for overseeing activities undertaken by the
ResCap board with regard to: a) funding for personnel, systems
and other resources; and b) workload reviews of servicing
personnel
Order
Section
n/a
New or
Existing
New
2(d)
2(l)
New
12/16/11
Annual
21
New
10/28/11
As
Needed
n/a1
New
12/16/11
Order
Section
New or
Existing
Due2
2(k)
Existing
7/01/11
8/01/11
n/a
New
7/01/11
8/01/11
2(c)
2(i)
Existing
10/06/11
Quarterly
n/a
Existing
n/a
Existing
Due
5/16/11
II. Ally Financial and ResCap Audit Committees
1.
2.
3.
4.
Action
Review the Internal Audit Charter and Policy to ensure: a) it
conveys appropriate authority and stature; and b) the policy
requires appropriate communication and coordination with
risk management and compliance
Review and, as appropriate, approve changes to Internal
Audit’s program, plans, resource requirements and/or
budget for matters required under the Order
Review and, as appropriate, approve Internal Audit’s staffing
plans and ensure Internal Audit has adequate staff and
officers with sufficient skills and qualifications
Review and approve Internal Audit’s budget and plans
5. Quarterly review of audit results and audit plan progress
1
2
10/06/11
Annual
7/28/11
Quarterly
Establishing such a process will enable AFI Board to leverage the activities of the ResCap Board
and eliminate duplication, where appropriate (effectively delegating certain activities to the ResCap
Board subject to monitoring/oversight by the AFI Board).
Items 1 and 2 will be provided to the AFI Audit Committee by July 1, 2011 and to the ResCap Audit Committee
by August 1, 2011
26
Confidential Treatment Requested
III. Ally Financial Risk and Compliance Committee—Risk Management 1
Order
Action
Section
1. Review and, as appropriate, approve Risk Management Policies
to ensure: a) they convey appropriate authority and stature; b)
a-2(k)
such policies require appropriate communication and
b-2(k)
coordination with audit and compliance; and c) such policies
c-2(a)
ensure adequate risk management with regard to residential
mortgage loan servicing, loss mitigation and Foreclosure.
2. If appropriate, approve a Charter or Framework for the Risk
Management functions to aid in communication and awareness
2(k)
of their authority and stature across the organization
3. Review and, as appropriate, approve changes to Risk
Management programs, plans, resource requirements and/or
n/a
budget for matters required under the Order
4. Review and, as appropriate, approve Risk Management staffing
2(c)
plans and ensure risk management program has adequate staff
2(i)
and officers with sufficient skills and qualifications
5. Review and, as appropriate, approve budgets/funding to ensure
a risk management program that is commensurate with the
2(f)
Mortgage Servicing Companies’ risk profile
6. Obtain an update from Management on Policies and Procedures
to be adopted by Ally Financial to ensure proper risk
management of Third Party Suppliers who are engaged to
2(b)
support residential mortgage loan servicing, loss mitigation and
Foreclosure
7. Review risk assessments and results of any monitoring and/or
n/a
testing conducted and/or facilitated by risk management
1
New or
Existing
Due
Existing
6/30/12
New
6/30/12
New
6/30/12
New
6/30/12
New
6/30/12
New
6/30/12
Existing
8/26/11
6/30/12
Timing for Risk Management actions are pending completion of the plans required under Sections
14 and 15 of the Order.
27
Confidential Treatment Requested
IV. Ally Financial Risk and Compliance Committee - Compliance
1.
2.
3.
4.
5.
6.
Action
Review and, as appropriate, approve Compliance Policies, to
ensure: a) they convey appropriate authority and stature; and b)
such policies require appropriate communication and
coordination with risk management and compliance.
If appropriate, approve a Charter for the Compliance function
to aid in communication and awareness of Compliance’s
authority and stature across the organization
Review and, as appropriate, approve changes to Compliance’s
program, plans, resource requirements and/or budget for
matters required under the Order
Review and, as appropriate, approve Compliance’s staffing
plans and ensure Compliance has adequate staff and officers
with sufficient skills and qualifications
Review and, as appropriate, approve Compliance’s budget to
ensure adequate funding to ensure a compliance program that is
commensurate with the Mortgage Servicing Companies’ risk
profile
Review compliance risk assessments and results of enterprise
monitoring and testing conducted by Compliance
Order
Section
New or
Existing
Due
2(k)
Existing
7/01/11
2(k)
New
1/01/12
n/a
New
10/06/11
2(c)
2(i)
New
1/01/12
2(f)
New
1/01/12
n/a
Existing
2/29/12
Order
Section
n/a
New or
Existing
New
Due
5/06/11
2(e)
New
1/01/12
Annual1
2(g)
2(h)
New
7/12/11
Quarterly
2(h)
2(j)
New
7/12/11
Quarterly
2(d)
2(l)
New
12/16/11
Quarterly
n/a
New
V. ResCap Board of Directors
1.
2.
3.
4.
5.
6.
1
Action
Establish a Consent Order Compliance Committee
Authorize appropriate funding for personnel, systems and other
resources necessary to carry out residential mortgage loan
servicing, loss mitigation and foreclosure activities in
compliance with Legal Requirements, including adequate
staffing and officers.
Review and, as appropriate, approve staffing plans and ensure
the Mortgage Servicing Companies have adequate staff and
officers with sufficient skills and qualifications
Establish a process for reviews of workload levels that
incorporate appropriate metrics and limits on loans assigned to
servicing personnel, with the first such review to occur before
July 12, 2011
Receive and review quarterly reporting by management
regarding residential mortgage loan servicing, loss mitigation
and foreclosure, including related risk assessments
Receive updates from the Consent Order Compliance
Committee so as to monitor progress on the requirements of the
Order
10/28/11
As Needed
Timed with the approval of the annual business plan for Mortgage.
28
Confidential Treatment Requested
VI. Consent Order Compliance Committees
Action
1. Approve Committee Charters
2. Approve Board Oversight Plan
3. Receive at least quarterly updates from management on
progress towards compliance with the Consent Order and
authorize funding and resources sufficient to achieve
compliance
4. Approve quarterly reports to Fed on progress towards
compliance with the Consent Order
5. Review management’s proposed enhancements to board
reporting by management regarding residential mortgage loan
servicing, loss mitigation and foreclosure, including related risk
assessments1
1
Order
Section
n/a
2
New or
Existing
New
New
n/a
New
10/28/11
Ongoing
21
New
8/01/11
Quarterly
2(d)
2(l)
New
11/01/11
Due
7/12/11
7/12/11
The COCC’s will review the proposed enhanced board reporting prior to it being presented to the
boards on an ongoing basis.
29
Confidential Treatment Requested
Appendix IV - Mortgage Servicing Staffing Adequacy and Workload Review
The Mortgage Servicing Companies intend to develop a comprehensive Mortgage Servicing Staffing
Adequacy and Workload Review (“Review”), which will be executed at least quarterly and discussed
with the ResCap Board of Directors. In addition to this quarterly comprehensive analysis, any areas
with significant staffing shortfalls or issues will require a monthly update to the ResCap Board of
Directors. The following summarizes the content of the proposed “Review”:
x
Executive Summary delineating overall market conditions and key matters outlined in the
remainder of the Review
x
Overview of key statistics, historical and forecasted, impacting staffing capacity drivers
overall, including portfolio size, composition, delinquency, number of foreclosures and
bankruptcies, and level of REO, and a separate analysis of key capacity drivers and
assumptions for each functional area within Mortgage Servicing
x
Overview of learning and development activity for Mortgage Servicing employees
x
A summary analysis of existing capacity, by functional area within Mortgage Servicing,
highlighting any deficiencies and the impact of a 10% adverse increase in the applicable
volume driver
x
Highlights, Staffing Adequacy Indicators, and Capacity Planning detail for each functional
area within Mortgage Servicing:
Customer Care
Default Call Center
SPOC
Loss Mitigation
Foreclosure
Bankruptcy
REO
Investor Operations
Servicing Quality Management
Loan Administration and Customer Operations
HOPE
x
Recommendations for staffing changes based on capacity indicators to ensure quality and
accurate service within industry-specified timelines
30
Confidential Treatment Requested
ALLY FINANCIAL INC.
GMAC Mortgage
Single Point of Contact
Prepared for the Board of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
Revised on December 14, 2011
1
Confidential
Table of Contents
Plan Overview for Single Point of Contact ........................................................................ 3
Principles Guiding this Plan ............................................................................................... 5
Prerequisites to SPOC Plan................................................................................................ 5
Consent Order Response .................................................................................................... 8
Consent Order Response to Section 5(a): Staff Communication ...................................... 9
Consent Order Response to Section 5(b): Response Timelines ....................................... 12
Consent Order Response to Section 5(c): Single Point of Contact.................................. 13
Consent Order Response to Section 5(d): Identifying SPOC Name ............................... 21
Consent Order Response to Section 5(e): Information and Personnel Access ............... 23
Consent Order Response to Section 5(f): Decision Communication............................... 25
Consent Order Response to Section 5(g): Holding Foreclosure...................................... 25
Consent Order Response to Section 5(h): Customer Complaints ................................... 26
Consent Order Response to Section 5(i): Complaint Review Process ............................ 26
Consent Order Response to Section 5(j): Second Liens .................................................. 27
Consent Order Response to Section 5(k): Letters ........................................................... 28
Consent Order Response to Section 5(l): Documentation ............................................... 28
General Consent Order Response .................................................................................... 30
Appendix I - First Level Project Details .......................................................................... 33
2
Confidential
Plan Overview for Single Point of Contact
This Program for Single Point of Contact ("Program") is established in response to the
Consent Order dated April 13, 2011 (the “Order”) among the Board of Governors of the
Federal Reserve System (“the FRB”), the Federal Deposit Insurance Corporation (the
“FDIC”), Ally Bank (the "Bank") Ally Financial Inc. ("Ally Financial" or “AFI”), and certain
of Ally Financial's direct and indirect subsidiaries including Residential Capital, LLC
(“ResCap”) and GMAC Mortgage, LLC (“GMACM” and together with ResCap, the
"Mortgage Servicing Companies"). Capitalized terms not defined in the Program shall have
the meaning assigned to them in the Order.
The purpose of this Plan is to set forth the actions and responsibilities necessary for GMACM
to comply fully with its obligations under Section 5 of the Order.
Section 5 of the Order requires:
Within 60 days of this Order, GMAC Mortgage shall submit to the Reserve Bank an
acceptable plan, along with a timeline for actions to be taken, for strengthening
coordination of communications between the Mortgage Servicing Companies and
borrowers, both oral and written, related to Loss Mitigation and foreclosure activities
to ensure: (i) that communications are timely and effective, and are designed to avoid
confusion to borrowers; (ii) continuity in the handling of borrowers’ loan files during
the Loss Mitigation and foreclosure processes by personnel knowledgeable about the
borrower’s situation; and (iii) that decisions concerning Loss Mitigation options or
programs continue to be made and communicated in a timely fashion.
Prior to submitting the plan, the Mortgage Servicing Companies shall conduct a
review to determine: (i) whether processes involving past due mortgage loans or
foreclosures overlap in such a way that they may impair or impede a borrower’s
efforts to effectively pursue a Loss Mitigation option or program, and (ii) that
employee incentive compensation practices do not discourage Loss Mitigation.
The plan shall, at a minimum, provide for:
(a) Measures to ensure that staff processing a borrower’s Loss Mitigation request
routinely communicates and coordinates with staff processing the foreclosure on
the borrower’s property;
(b) Appropriate deadlines for responses to borrower communications and requests
for consideration of Loss Mitigation, including deadlines for decision making on
Loss Mitigation Activities, with the metrics established not being less responsive
than the timelines in HAMP;
(c) Establishment of an accessible and reliable single point of contact for the
borrower so that the borrower has access to an employee of the Mortgage
Servicing Companies to obtain information throughout the Loss Mitigation and
3
Confidential
foreclosure processes;
(d) A requirement that written communications with the borrower identify by name
the primary single point of contact along with one or more direct means of
communication with the primary single point of contact, together with information
about secondary points of contact in the event that the primary single point of
contact is unavailable;
(e) Measures to ensure that the single point of contact has access to current
information and personnel (in-house or third-party) sufficient to timely,
accurately, and adequately inform the borrower of the current status of the Loss
Mitigation and foreclosure activities;
(f) Procedures and controls to ensure that a final decision regarding a borrower’s
Loss Mitigation request (whether on a trial or permanent basis) is made and
communicated to the borrower in writing, including the reason(s) why the
borrower did not qualify for the trial or permanent modification and, if
applicable, the net present value calculations utilized by the Mortgage Servicing
Companies, and that involve the single point of contact within a reasonable time
before any foreclosure sale occurs;
(g) Procedures and controls to ensure that when the borrower’s loan has been
approved for modification on a trial or permanent basis, (i) no foreclosure or
further legal action predicate to foreclosure occurs, unless the borrower is past
due on two or more payments post-dating the trial or permanent modification;
and (ii) the single point of contact remains available to the borrower and
continues to be referenced on all written communications with the borrower;
(h) Policies and procedures to enable borrowers to make complaints regarding the
Loss Mitigation process, denial of Loss Mitigation requests, the foreclosure
process, or foreclosure activities that prevent a borrower from pursuing Loss
Mitigation options, and a process for making borrowers aware of the complaint
procedures;
(i) Procedures for the prompt review, escalation, and resolution of borrower
complaints, including a process to communicate the results of the review to the
borrower on a timely basis;
(j) Policies and procedures to consider loan modification or other Loss Mitigation
Activities with respect to junior lien loans owned by Ally Financial, ResCap, the
Mortgage Servicing Companies, or Ally Bank where the Mortgage Servicing
Companies service the associated first lien mortgage and become aware that such
first lien mortgage is delinquent or has been modified;
(k) Policies and procedures to ensure that timely information about Loss Mitigation
options is sent to the borrower in the event of a delinquency or default, including
4
Confidential
plain language notices about the pendency of loan modification and foreclosure
proceedings; and
(l) Policies and procedures to ensure that foreclosure and related documents
provided to borrowers and third parties are appropriately maintained and
tracked, and that borrowers generally will not be required to resubmit the same
documented information that has already been provided, and that borrowers are
notified promptly of the need for additional information.
Principles Guiding this Plan
As described herein, GMACM’s plan to strengthen the communication process with
borrowers primarily centers on: a) enhancing policies and procedures governing interactions
with borrowers during the Loss Mitigation process; and, b) the establishment of Single Point
of Contact (“SPOC”) employees known as "Relationship Managers" to improve service for
Eligible Homeowners during the Loss Mitigation and foreclosure process. Eligible
Homeowners are defined as homeowners or their authorized third party representative(s) with
a first lien serviced by GMACM, where the property securing the mortgage loan is the
homeowner’s primary residence. In cases where GMACM services the associated secondary
lien(s) of an Eligible Homeowner, GMACM’s Loss Mitigation processes will be designed to
address both the primary and secondary lien(s).
This plan provides for:
x
Timely and effective communications with Eligible Homeowners that are designed to
avoid confusion during Loss Mitigation process;
x
Timely communication to the Eligible Homeowner of decisions concerning Loss
Mitigation options or programs; and
x
Continuity in the handling of Eligible Homeowners’ loan files during the Loss
Mitigation and foreclosure processes by personnel knowledgeable about their
situation.
Prerequisites to SPOC Plan
Prior to completing the enclosed plan, GMACM conducted two reviews as required by
Section 5 of the Order.
First, GMACM’s Servicing Quality Management Department (“SQMD”) conducted a review
to determine whether existing processes involving past due mortgage loans or foreclosures
overlap in such a way that they may impair or impede a borrower’s efforts to effectively
pursue a Loss Mitigation option or program.
x
GMACM recognizes that overlap of Loss Mitigation and foreclosure processes could
cause confusion and therefore impair or impede Eligible Homeowner’s efforts in
5
Confidential
pursuing alternative Loss Mitigation options. GMACM further believes that the
United States Treasury’s Home Affordable Modification Program (“HAMP”)
Supplemental Directive 10-02 (“Directive 10-02”) guidelines for borrower
communication and foreclosure actions minimize this overlap while mitigating the
foreclosure impact. As such, in late 2010 GMACM elected to adopt the Directive1002 program guidelines for all eligible loans. Eligible loans are defined as non-GSE
(Fannie Mae and Freddie Mac being GSE), investor delegated, and/or HAMP eligible.
x
At GMACM, loan status, active Eligible Homeowner communication and Loss
Mitigation activities are identified, tracked, and managed through the loan
servicing system of record,
The
system provides robust loan
level communication capability through a work order framework known as
(“
also provide functional ownership
identification and the basis for systematic triggers that facilitate the halting of
further foreclosure actions while eligible regulatory or active Loss Mitigation hold
activities are on-going.
x
SQMD completed a detailed review of GMACM’s existing Loss Mitigation and
foreclosure processes, including the review of the
functionality, involving
pre-foreclosure (past due mortgage loans) and foreclosure loans. Based on that
independent review SQMD concluded that processes are in place to prevent
foreclosure referral or sale depending on the status of the Loss Mitigation activity
and therefore minimize foreclosure impact.
x
Where GMACM has been given delegated authority by the investor, processes
follow the guidelines outlined in Directive 10-02. Foreclosure activity and events
are placed on hold while the following activities take place (details of the
foreclosure hold requirements are listed in the Directive 10-02 (Appendix 5.1):
x
x
x
x
x
x
x
x
x
x
x
Active Military
Bankruptcy
Litigation
FEMA moratorium
Workout option solicitation letter is mailed to the Eligible
Homeowner
Workout package is sent to the Eligible Homeowner
Financial package is received and is under review
Financial package is incomplete; awaiting missing items
Approved workout
Denied modification request
For investors such as Fannie Mae and Freddie Mac, who have their own defined
foreclosure guidelines, or where GMACM has not been given delegated authority,
foreclosure activities and events are only placed on hold for the following
activities:
6
Confidential
x
x
x
x
x
x
Active Military
Bankruptcy
Litigation
FEMA Moratorium
Approved trial
Approved modification
Fannie Mae and Freddie Mac do not follow all the Directive 10-02 guidelines
listed above. GMACM will request investor approval for loans that meet such
guidelines and will apply Directive 10-02 upon approval only.
x
As an added measure, to ensure Eligible Homeowner Loss Mitigation
communications are timely, accurate, and in accordance with defined procedures,
exception reports are in place. These reports are monitored and any discrepancies
are addressed timely by the responsible functional areas. In addition, SQMD
performs monthly agent and process level quality reviews to ensure compliance
with documented Collection and Loss Mitigation policies and procedures.
x
Further, Operational Controls within the SQMD performs daily comprehensive
loan level reviews prior to foreclosure referral and prior to foreclosure sale, to
confirm various default activities were properly handled and managed within
various regulatory, legal and internal guidelines and processes, and that no active
Loss Mitigation option exists that would otherwise prohibit foreclosure referral or
sale. For details, please refer to appendices in Section 5(g) (Foreclosure Review
Definition and Foreclosure Review Template).
x
Lastly, the results of this internal review by SQMD have been independently
reviewed and confirmed by the Ally Operational Risk Management Group.
Second, GMACM completed a review to ensure that employee incentive compensation
practices do not discourage Loss Mitigation.
x
GMACM concluded that the incentive compensation plans already in place in the
Collections and Loss Mitigation Departments are consistent with GMACM's
commitment to pursue all available Loss Mitigation solutions and are based upon
the achievement of quality and timeline metrics (such as average speed of
answering borrower phone calls, call abandon rates, etc.) and the promotion of
modification and other Loss Mitigation options that keep customers in their
homes. The incentive amount is calculated first based on the volume of Loss
Mitigation solutions such us repayment plans, modifications and short sales
completed. The payout amount is then weighted up or down based on quality
assurance scores that measure accuracy and timeliness of the Loss Mitigation
solutions. The quality reviews are performed independently by SQMD.
x
In addition, these incentive plans are reviewed and approved annually by Finance,
Risk, Compliance, Human Resources, Mortgage Servicing and Global
7
Confidential
Compensation departments. In accordance with requirements imposed under the
Troubled Asset Relief Program (“TARP”), the Compensation, Nominating &
Governance Committee of the Board of Directors of Ally Financial Inc. also
conducts a risk review of compensation plans at least every six months.
x
Initially, Relationship Managers will not be included in any type of monthly
incentive compensation plan. They will instead be included in the GMACM
annual incentive plan, which rewards employees based on performance against
key departmental, and individual performance metrics (refer to Section 5(c)). This
will avoid incenting the Relationship Managers for any particular Loss Mitigation
outcome and focus them on the Eligible Homeowners experience and the ability
to help Eligible Homeowners navigate the Loss Mitigation and default processes.
As GMACM learns more about the impacts of a single point of contact business
model, this decision may be reevaluated.
Details around the various incentive plans discussed above are included as Appendices to this
Plan as follows:
x
Appendix 5.2: Collections Incentive Plan
x
Appendix 5.3: Loss Mitigation Associate Incentive Plan
x
Appendix 5.4: Loss Mitigation Supervisor Incentive Plan
Consent Order Response
The following high-level organizational chart shows GMACM’s Default Servicing
Operations as a whole and helps clarify the reporting structure as the specific responses to the
Order are documented:
8
Confidential
Consent Order Response to Section 5(a): Staff Communication
Consent Order section 5a states: Measures to ensure that staff processing a
borrower’s Loss Mitigation request routinely communicates and coordinates with
staff processing the foreclosure on the borrower’s property
GMACM acknowledges that the Loss Mitigation and foreclosure processes can
potentially cause customer confusion and frustration and is committed to always
working to minimize that confusion. We further acknowledge that providing industry
leading customer service is a key goal and the Company is committed to continuous
improvement of our customer interaction. To that end we are enhancing current
processes to ensure Eligible Homeowners are able to speak with individuals that are
knowledgeable about their circumstances within both the Loss Mitigation and
foreclosure processes.
GMACM plans to utilize the following to ensure that staff processing and/or fulfilling
Loss Mitigation routinely communicate with staff processing foreclosure actions: a)
improved utilization of management information systems (“MIS”), b) enhanced
monitoring and controls of the interaction between Loss Mitigation and foreclosure,
9
Confidential
and c) direct communication between the Relationship Manager and associates in the
Loss Mitigation and foreclosure areas.
Management Information Systems
As mentioned earlier, GMACM’s loan servicing system
utilizes multiple
tracking systems to enable effective communication between the Relationship
Manager, Loss Mitigation and foreclosure, and provides robust loan level data to
these areas that facilitate day-to-day operations and controls. In most cases these loan
level, systematic forms of communication are preferred in that they provide
consistency and control that is superior to manual efforts. As an example, as loans
move through the Loss Mitigation process the system generates triggers for key
events. Key events include the receipt of a completed financial package or approval of
a trial loan modification. Foreclosure and collections personnel are alerted about those
events and have additional access to view and ensure the suspension of further
foreclosure and Loss Mitigation actions.
Monitoring and Controls
To ensure the tracking systems and communication mechanism between Loss
Mitigation and foreclosure functions are operating effectively and in accordance with
policies, procedures, and legal requirements, GMACM expanded and enhanced
oversight functions in its Servicing Quality Management Department as follows. In
November 2010, SQMD enhanced the quality control reviews for foreclosure referrals
and implemented a daily 7-day pre foreclosure sale review. This loan level
comprehensive review verifies that the system tracking mechanisms have identified
loan status and activities correctly, that handoffs between departments are
occurring timely and effectively, and lastly, prior to foreclosure sale, that all activities
were properly handled and managed within various regulatory, legal and internal
guidelines and processes, and all Loss Mitigation efforts have been satisfied. In
addition to expanding scope, the quality control program(s) will continue to be
enhanced through a) monthly results and calibration meetings with the functional
business units, b) partnership and participation in training and development
curriculums, and c) monthly quality performance reporting.
Additional quality controls and measures that will be implemented in response to
specific requirements of this Order are discussed throughout this Plan. They will help
ensure that processes are working as designed, foreclosure processes are ceasing
when appropriate, and customer communication is effective and in accordance with
policies. Attached as Appendix 5.5 is a detailed description of the functions, staffing
and focus of the SQMD (SQMD Overview).
Direct Communication
GMACM will establish written policies and procedures to ensure that the
Relationship Managers, Loss Mitigation specialists and foreclosure staff have
enhanced ability to interact to resolve specific Eligible Homeowner issues. These
10
Confidential
policies and procedures will be designed to leverage the
system in addition
to provisions for direct communication between staff.
within
will
monitor and track the interactions between Relationship Managers, Loss Mitigation
specialists, and foreclosure staff and management. This tracking allows for not only
controls over
turnaround times but also provides the ability to track the quality of
requests and responses. The following example illustrates
functionality; the
Relationship Manager will communicate specific changes about the Eligible
Homeowner’s situation to the Loss Mitigation department and request a new review
of the loan by utilizing a specific
Daily internal management reporting will be
used to manage the day-to-day work flow of the groups handling communication
around Eligible Homeowner requests. These reports will help ensure timely and
effective communication among the areas and be a part of employee performance
measurements ensuring that they remain focused on customer response and
satisfaction. Weekly reporting will be established and provided to senior servicing
management to document compliance. Additionally, reporting will be included in
monthly operating reports and provided to Executive GMACM and Ally
management. These enhanced and new policies and procedures will be documented
by October 1, 2011.
The chart below shows key Loss Mitigation and foreclosure functions, activities, and
timelines and how they relate to the Relationship Manager role.
x
Appendix 5.6: Handoffs between LossMit and Foreclosure Departments
11
Confidential
Consent Order Response to Section 5(b): Response Timelines
Consent Order section 5b requires: Appropriate deadlines for responses to borrower
communications and requests for consideration of Loss Mitigation, including
deadlines for decision making on Loss Mitigation Activities, with the metrics
established not being less responsive than the timelines in HAMP
As a leading HAMP servicer, GMACM currently complies with the United States
Treasury’s HAMP Directive 10-02 for all HAMP-eligible borrowers. Directive 10-02
covers HAMP eligible loans and governs requirements for mailing of Loss Mitigation
solicitation and application packages, completion of required follow-up calls,
borrower notification when applications received are incomplete, and mailing of
acknowledgement letters upon receipt of the application package. These timelines are
as follows:
Timing
45 - 50 days
delinquency
1 Business Day
After Receipt of
Package
2 Business Days
After Receipt of
Package
10 Business Days
After Receipt of
Complete
Package
2 Business Days
After Decision
Description of Communication
GMACM mails a Loss Mitigation Solicitation package (“Package”)
to each delinquent Eligible Homeowner as of the 45th day of
delinquency, or upon request, whichever comes sooner.1
If an Eligible Homeowner has not returned the Package to GMACM
after this initial mailing, an additional Package is mailed on the 60th
day of delinquency. Finally, an additional letter is sent at the time of
breach expiration, between the 62nd and 92nd day of delinquency.
GMACM sends an acknowledgement letter to each applicable
Eligible Homeowner one day after receipt of the Package.2
GMACM sends a letter to Eligible Homeowner whose Packages are
incomplete. These letters include a description of the missing
information.
GMACM completes its review for HAMP and non-HAMP
modifications including other foreclosure alternatives such as short
payoffs and deeds-in-lieu, and makes an appropriate decision.
GMACM mails approval notices for trial modifications or, if
applicable, denial notification including the reason for denial.
1
The Package (Appendix 5.8) consists of a cover page and a financial form used to provide a
summary of the Eligible Homeowner’s financial information and a brief description of the Eligible
Homeowner’s hardship. The Package also provides a list of required supporting documentation
needed to process the Loss Mitigation request.
2
As noted in the response to Section 5(k), GMACM plans to modify certain standardized form
communications to ensure they identify the Relationship Manager.
12
Confidential
2 Business Days At the end of the 3 month Trial period3 Eligible Homeowners who
After Approval of successfully complete the Trial are approved for a modification and
Permanent
GMACM mails the appropriate permanent modification documents.
Modification
The Loss Mitigation Fulfillment Department, which is responsible for processing
Loss Mitigation documents including modification and trial agreements and other
Loss Mitigation related correspondence, maintains controls to ensure timeliness and
consistency. These controls include daily review of letter generation processes and
reconciliation of reports to help ensure that required notifications are mailed in a
timely manner. Automated reports are reviewed manually by the Loss Mitigation
Fulfillment Department to identify discrepancies, which are addressed within 24-48
hours. These controls will be independently monitored by SQMD on a monthly basis
and will be in place by October 1, 2011.
To comply with the Order, effective October 1, 2011, GMACM will meet or exceed
Directive 10-02 in all instances (HAMP and non-HAMP). As part of this
implementation, GMACM will also implement daily and monthly monitoring of
compliance with these communication standards by SQMD.
Consent Order Response to Section 5(c): Single Point of Contact
Consent Order section 5c requires: Establishment of an accessible and reliable single
point of contact for the borrower so that the borrower has access to an employee of
GMACM to obtain information throughout the Loss Mitigation and foreclosure
processes
GMACM initiated a single point of contact (“SPOC”) Relationship Manager Pilot
program in April 2011 (“Pilot”). The goal of the Pilot was to dedicate a Relationship
Manager to assist Eligible Homeowners experiencing difficulty in the Loss Mitigation
process, to help resolve outstanding issues and find a solution that fits the Eligible
Homeowner’s circumstances. A Homeowner was considered to be experiencing
difficulty if they had submitted a request for Loss Mitigation but had not received a
decision within 30 days of the submission either due to their application being
incomplete and remaining incomplete after 30 days of follow up or due to any other
exceptions.
GMACM entered into the Consent Order subsequent to the launch of the
Pilot. Additionally, on May 18, 2011, Treasury issued Supplemental Directive 11-04
3
Trial period is generally three months long. During this period communication with the Eligible
Homeowner is limited unless they have specific questions or become delinquent on their trial
payments. Upon receipt of the final trial payment the account is prepared for a permanent
modification.
13
Confidential
(“Directive 11-04”) which provided further guidance on SPOC as it pertains to
HAMP-eligible borrowers (see Appendix 5.7). This guidance includes, among other
requirements, the following:
x
A requirement that the same Relationship Manager is responsible for
managing the borrower relationship throughout the entire delinquency or
imminent default resolution process, including any home retention and nonforeclosure liquidation options, and, if the loan is subsequently referred to
foreclosure, must be available to respond to Homeowner inquiries regarding
the status of the foreclosure.
x
No later than September 1, 2011, the servicer must assign a Relationship
Manager to a delinquent Homeowner or a Homeowner who requests
consideration under imminent default immediately upon the successful
establishment of Right Party Contact4 with the borrower and the determination
that the servicer will consider the borrower for the Treasury’s modification
(HAMP), short sale (“HAFA”) and unemployment (“UP”) programs.
x
Borrowers who are in the process of being evaluated for HAMP, HAFA or
UP, who are in a Trial Period Plan or an UP forbearance plan or who have
executed a HAFA Short Sale or Deed- In-Lieu Agreement as of the effective
date of Directive 11-04 must be assigned a Relationship Manager no later than
November 1, 2011.
Following the issuance of Directive 11-04, GMACM learned that adoption of the
Directive 11-04 guidance would meet the expectations of this Consent
Order. Accordingly, GMACM has decided to adopt the provisions of Directive 11-04
for all Eligible Homeowners (as previously defined). GMACM will structure its
SPOC program to comply with both this Order and Directive 11-04.
SPOC Program Overview
GMACM plans to commence the full implementation of SPOC Program beginning
September 1, 2011. GMACM will assign each Eligible Homeowner a Relationship
Manager who will remain assigned to the Eligible Homeowner throughout the Loss
Mitigation and foreclosure processes. The assignment of a Relationship Manager is
also referred as the Entry Point.
Once it is determined during the phone conversation that the cause of the Eligible
Homeowner’s hardship appears to be of a permanent nature and normal collection
solutions such as full reinstatement or a short term repay plan will note cure the
delinquency, GMACM mails a Package regardless of the stage of delinquency. This
4
Right Party Contact is defined as a successful effort by GMACM to speak with the Eligible
Homeowner about resolution of a delinquency.
14
Confidential
Package (Appendix 5.8) has a cover sheet which explains the SPOC concept, and
advises the Eligible Homeowner of the following:
x
Return of a completed Package is the fastest path to finding a permanent
solution to their hardship and assignment of a Relationship Manager
x
Return of the cover sheet only (or in fact any piece of paper through which
Eligible Homeowner/account can be identified) will also trigger a Relationship
Manger assignment
x
If the Eligible Homeowner has any difficulty with completing the Package,
they are instructed to call us and we will assign a Relationship Manger the
next day as a result of that call
In addition, for Eligible Homeowners who do not intend to remain in the home, a
Relationship Manager will be assigned upon receipt of a listing agreement, or an offer
on the property.
Eligible Homeowners who are in the process of being evaluated for HAMP, HAFA or
UP, who are in a Trial Period Plan or an UP forbearance plan or who have executed a
HAFA Short Sale or Deed- In-Lieu Agreement as of the effective date of Directive
11-04 but have not been assigned a Relationship Manager, will be assigned a
Relationship Manager no later than November 1, 2011.
In the case of Eligible Homeowners in Default5, beginning January 1, 2012, a
Relationship Manager will be assigned upon Right Party Contact and verbal
determination that the Homeowner is potentially eligible for Loss Mitigation.
All other Eligible Homeowners in the process of being evaluated for traditional
modifications, who are in a traditional trial period plan or who have a valid short sale
or deed-in-lieu agreement, but have not been assigned a Relationship Manager, will
be assigned a Relationship Manager no later than April 30, 2012.
5
“Default” for purposes of Relationship Manager assignment is defined as any loan that is eligible for
referral to foreclosure. This is the point at which the loan is sufficiently delinquent to be referred to
foreclosure pursuant to GMACM’s procedures, the terms of the mortgage instrument, and/or the
applicable investor/servicer agreements. GMACM generally refers loans to foreclosure at the
expiration of a 30 breach notice which is mailed on the 60th day of delinquency.
15
Confidential
Relationship Manager Assignment Implementation Schedule
Completion
Date
Phase
9/1/2011
11/1/2011
1/1/2012
4/30/2012
Official SPOC Launch
Assignment of Relationship Manager
All Eligible Homeowners upon meeting
Entry Point (as defined above)
Eligible Homeowners who are in the
process of being evaluated for HAMP,
HAFA or UP, or who are in a Trial Period
Plan or an UP forbearance plan - if not
Treasury 11-04 Assignment already assigned a Relationship Manager
Eligible Homeowners in default, upon
Verbal SPOC Assignment right party contact
Eligible Homeowners who are in the
process of being evaluated for nonTreasury loss mitigation
options/foreclosure alternatives - if not
already assigned a Relationship Manager
Final Assignment Phase
GMACM expects that as of January 1, 2012, approximately 80% of Eligible
Homeowners in the process of Loss Mitigation will have been assigned a
Relationship Manager. Between January 1 and April 30, 2012, the remaining 20%
will be assigned a Relationship Manager.
The Relationship Manager will remain assigned to each Eligible Homeowner until
one of the following conditions occurs: a) the Eligible Homeowner brings the loan
current or pays the loan in full; b) the servicing of the loan is released or transferred;
c) a foreclosure sale occurs and the redemption period expires in accordance with
applicable state or local laws; or d) a short sale or deed-in-lieu liquidation occurs. In
the case of loans that are brought current through a permanent modification, the
Relationship Manager will remain available to the Eligible Homeowner for two
months following the effective date of the permanent modification. In such cases, the
Relationship Manager will be available to answer any questions and address any
concerns related to the executed modification. All other servicing activities (such as
customer service inquiries and collection activities) will continue as normal. The end
of the Relationship Manager assignment is also referred to as the Exit Point. If the
Relationship Manager is unable to contact the Eligible Homeowner for a period of 30
days despite continuous attempts including efforts to obtain updated Homeowner
contact information, the loan will be identified as "inactive." In such cases, the
Relationship Manager will remain assigned to the Homeowner of the inactive loan;
however, GMACM may use its Collection Contact Centers in an effort to reach the
Eligible Homeowner to ensure compliance with investor guidelines.
16
Confidential
In the event that a Relationship Manager is out of the office for planned or unplanned
reasons, other Relationship Managers in the primary Relationship Manager’s team
(see details on Page 19, SPOC Workload and Gearing Ratios section), who back up
the lead Relationship Manager, will ensure that incoming inquiries are handled with
minimal impact to the Eligible Homeowner. If the primary Relationship Manager is
absent for an extended period (two or more weeks) or leaves the GMACM
organization, that Relationship Manager’s portfolio will be temporarily reassigned to
their supervisor and/or team lead. Eligible Borrowers will be notified about the
change in the Relationship Manager assigned to them in accordance with timelines
stated in Directive 11-04. Effective January 2012, each written communication
regarding change in Relationship Manager will be labeled “Change in Relationship
Manager Contact Information.” Supervisors and team leads will not have permanently
assigned portfolios and the reassignment will be temporary pending permanent
replacement of the Relationship Manager.
If an Eligible Homeowner who has exited the SPOC program needs to re-enter the
program and meets eligibility criteria , GMACM will make its best effort to re-assign
the Homeowner’s previous Relationship Manager whenever possible if the
Homeowner so requests.
The Relationship Manager will have primary responsibility for:
x
Serving as the primary GMACM contact for the Eligible Homeowner
x
Communicating the options available to the Eligible Homeowner, the actions
the Eligible Homeowner must take to be considered for these options and the
status of GMACM’s evaluation of the Eligible Homeowner for these options;
x
Coordinating receipt of all documents associated with loan modification or
Loss Mitigation activities;
x
Being knowledgeable about the Eligible Homeowner’s situation and current
status in the delinquency/imminent default resolution process; and
x
Ensuring that an Eligible Homeowner who is not eligible for HAMP programs
is considered for proprietary modifications and other alternatives to
foreclosure, such as short sale or deed-in-lieu.
The Relationship Manager shall, at a minimum, provide the following services to
Eligible Homeowners:
x
Promptly contact the Eligible Homeowner and introduce himself/herself as the
Eligible Homeowner’s Relationship Manager;
17
Confidential
x
Explain Loss Mitigation programs for which the Eligible Homeowner may be
eligible, and the requirements of these programs;
x
Provide basic information about the status of the Eligible Homeowner’s
account, including pending loan modification applications and other Loss
Mitigation alternatives;
x
Identify missing documents and facilitate the submission of documents so that
the Eligible Homeowner has submitted a completed loan modification
application;
x
Communicate GMACM’s decision regarding loan modification applications
and other Loss Mitigation alternatives to the Eligible Homeowner;
x
Assist the Eligible Homeowner in pursuing alternative non-foreclosure options
upon denial of a loan modification;
x
Confirm and document, prior to a scheduled foreclosure sale, that, to the best
of the Relationship Manager’s knowledge, all available loss mitigation
alternatives have been exhausted and a non-foreclosure outcome could not be
reached;
x
Work with GMACM personnel responsible for initiating a foreclosure action
to confirm the past due status of the account prior to resuming, restarting,
initiating or taking any legal action predicate to foreclosure;
x
If a loan modification is approved, call the Eligible Homeowner to explain the
program;
x
Communicate with the foreclosure department to provide answers to
foreclosure-related questions from the Eligible Homeowner, should Loss
Mitigation efforts not succeed;
x
Provide information regarding where to obtain credit counseling when
necessary;
x
Help to clear any internal processing requirements for the Eligible
Homeowner; and
x
Document on the servicing system all of the Relationship Manager’s
communication with and actions taken with respect to the Eligible
Homeowner for record keeping purposes.
18
Confidential
SPOC Workload and Gearing Ratios
GMACM retained Oliver Wyman in October 2010 to help develop a statistical
process and model that identifies Eligible Homeowners who, based on data attributes,
which include number of prior modifications, stage of delinquency, and income
source, would be designated as more complex Loss Mitigation cases and likely
require a higher interaction frequency level of service from their respective
Relationship Manager. GMACM will assign loans to Relationship Managers at a ratio
ranging from 75 to 150 loans per Relationship Manager, depending on the case status.
The status of each individual case drives the level of activity and thereby the capacity
of an individual Relationship Manager as cases pre-decision (i.e., approval or denial
of a Loss Mitigation request) require significantly more work than cases post
decision. Further details on these ratios are explained in the General Consent Order
Response section of this response (Page 31). These ratios will be set based on loans
that are active in the Loss Mitigation and foreclosure process. Inactive (as previously
defined) loans will remain in the Relationship Manager’s portfolio but will not be
considered when determining portfolio capacity.
GMACM has adopted a team concept whereby the primary Relationship Manager is
backed up by three secondary Relationship Managers with similar qualifications and
authority. A Team Lead, who is not assigned a portfolio of loans, is responsible for
two such teams. Relationship Managers and Team Leads receive the same training
and complete the same certification process. This approach facilitates expanded
hours of operation, 8 a.m. to 9 p.m. Central Time, ensures borrowers have access to
live, qualified Relationship Managers, and avoids reliance on voice mail messages
when the assigned Relationship Manager is not available.
Based on a projected SPOC portfolio size anticipated to range between 27,000 and
30,000 loans, current staffing projections indicate that GMACM will need to staff the
Relationship Manager / SPOC department with in excess of 350 Relationship
Managers, including appropriate management and supervisory support. To
accomplish this, GMACM currently has 51 Relationship Managers and will move and
train 150 Relationship Managers from existing staff by August 1, 2011. We will also
hire and train approximately 150 external hires between July 1, 2011 and October 1,
2011 to provide sufficient opportunity to complete training by the November full
implementation date. Training will occur throughout the hiring process and will be
completed by November 1, 2011. Relationship Managers training is described more
fully below. In order to maximize flexibility and draw from different talent pools,
GMACM will staff Relationship Managers in both Waterloo, IA and Dallas, TX.
Aggressive recruiting efforts are already underway to ensure GMACM will have
adequate staffing to meet November 1, 2011 implementation date.
19
Confidential
Relationship Manager Communications
Upon Entry Point, the Relationship Manager will send a welcome letter (Appendix
5.9) introducing themselves to each Eligible Homeowner in their queue (“Welcome
Letter”). The Welcome Letter will identify the Relationship Manager and Team Lead
by name, and provide their hours of availability and contact information (i.e., phone
number and address), as well as alternative means of communicating with both the
Team Lead and the assigned Relationship Manager. Relationship Managers will be
required to make outbound attempts to reach Eligible Homeowners to introduce the
program, call proactively with updates on each related account, and return calls as
scheduled through our appointment setting process. Our appointment setting process
enables all Relationship Managers to view the each others’ calendars real time and set
up appointments that fit both the Homeowner and the assigned Relationship
Manager’s schedule. This eliminates voice mail and ensures contact at a time that is
convenient for the Homeowner.
When communicating with a non-English speaking Eligible Homeowner, a
Relationship Manager will follow GMACM’s procedures for communicating to a
borrower in a language other than English including the (re)assignment of Spanishspeaking Eligible Homeowners to a Spanish-speaking Relationship Manager.
Oversight of Relationship Manager’s Performance
In addition to operational controls discussed in Section 5a and throughout this
document, SQMD will review samples of recorded calls to ensure Relationship
Managers provide accurate information, work toward a Loss Mitigation solution, and
provide a positive experience. SQMD will manually document and score each
Relationship Manager’s call monitoring results and review the results with his or her
supervisor within 24 hours of completion. Relationship Managers with negative
results or trends will receive additional coaching or training to address any noted
deficiencies. Continued negative results will result in disciplinary action up to and
including termination. These enhanced controls will be implemented by October 1,
2011.
Relationship Manager Qualifications and Training
For the April Pilot, GMACM selected 28 Relationship Managers from existing
associates who had an average of more than 6 years of mortgage experience and
demonstrated strong communication and homeowner service skills along with strong
Loss Mitigation knowledge. Each Relationship Manager completed a two-week
training program with an emphasis on homeowner service, all aspects of internal
underwriting policies and procedures, complaint process, and Loss Mitigation and
foreclosure processing. Relationship Managers will be required to have ongoing
training including, but not limited to, Loss Mitigation program updates, empathy
training, and certain aspects foreclosure. In addition, scripts and/or talking point
guidelines will be developed by July 1, 2011, to assist the Relationship Manager in
20
Confidential
navigating specific aspects of conversations with Eligible Homeowners, including but
not limited to eligibility and denial discussions.
Training of Relationship Managers will be customized based on the Relationship
Manager's previous experience, as shown below:
Relationship Manager’s Experience
Existing, experienced employee
External hire with Loss Mitigation experience
External hire with no Loss Mitigation experience
Length of Training
2 weeks
6-8 weeks
15-20 weeks
We also recognize that we will not always be able to find candidates with previous
experience. In order to draw from a larger pool of candidates we will build a
Relationship Manager Development Program which will first train prospective
Relationship Managers on mortgage banking, customer care and collections and then
layer in the detailed Relationship Manager training and certifications over time. We
anticipate that this development program will consist of 15 to 20 weeks of extensive
training and on-the-job experience in our call centers before a new hire will move into
the Relationship Manager role.
As part of the anticipated training curriculum, all Relationship Managers will
complete a Loss Mitigation Certification Program that will certify their understanding
of all Loss Mitigation programs and tools, investor requirements, regulatory
limitations, and foreclosure referral standards. GMACM will continue to expand on
the Loss Mitigation Certification Program, Relationship Manager desktop procedures
and tools, and training curriculum utilized for the Pilot program and will have them
finalized by July 1, 2011.
Relationship Manager Location
All Relationship Managers will be employees of GMACM and will be located in the
continental United States. Relationship Managers will not concurrently serve in
another capacity within a different function of GMACM. In the event that an Eligible
Homeowner that is assigned a Relationship Manager dials a generic GMACM number
and is connected to an off-shore facility, GMACM will establish processes and
procedures to ensure the call will be transferred to the appropriate Relationship
Manager assigned to that account. The procedures will be designed in such a way that
the call will be transferred and announced directly to a Relationship Manager. This
will be in place by September 1, 2011.
Consent Order Response to Section 5(d): Identifying SPOC Name
Consent Order section 5d requires: A requirement that written communications with
the borrower identify by name the primary single point of contact along with one or
21
Confidential
more direct means of communication with the primary single point of contact,
together with information about secondary points of contact in the event that the
primary single point of contact is unavailable
GMACM will enhance existing policy and process to include the requirement that
written loss mitigation communications with Eligible Homeowners include the name
of the Relationship Manager along with required contact information. GMACM will
also modify standard Loss Mitigation communications to include the Relationship
Manager’s contact information. These revised communications will be in production
by September 1, 2011.
There are over 600 possible communications and notices that GMACM could
potentially mail to its borrowers during the loan servicing life cycle, approximately
190 of which are collections, Loss Mitigation and foreclosure correspondence.
Standard Loss Mitigation communications that contain the Relationship Manager’s
name and contact information comprise 44 out of over 65 collections and Loss
Mitigation notices mailed by GMACM to over 130,000 Eligible Homeowners
monthly based on varying state, investor and insurer/guarantor triggers. In addition,
there are over 125 foreclosure related notices and court motions mailed to borrowers
by GMACM’s network of foreclosure attorneys and trustees. It is the opinion of many
of these foreclosure attorneys that it would be inappropriate, misleading and a
potential violation of FDCPA to include the Relationship Manager’s contact
information in many of these legal notices and motions.
Further, expanding this requirement beyond standard Loss Mitigation
communications to cover all collections and foreclosure correspondence would
require that GMACM develops an external default correspondence system for the
entire servicing platform. Such a change would not be limited to loans that are
assigned a Relationship Manager.
A broad external correspondence system would result in the following risks that
expose GMACM to potential violations of state, federal, and investor regulations
governing communication requirements:
x
x
x
The risk associated with accurately replicating an intricate network of state,
federal and investor rules embedded in our primary system
Maintaining multiple systems requires development of interfaces with the
primary system resulting in numerous potential points of failure in the process
in addition to the risk of business and service interruption
The need to write data back and forth between systems makes such systems
prone to errors associated with reconciliation differences and latency
GMACM does, however, recognize that including the Relationship Manager's name
and number on all collections and foreclosure correspondence serves as a reminder to
the borrower of the Relationship Manager’s name and contact information. GMACM
22
Confidential
proposes to achieve that same objective by enhancing its systems and processes as
follows:
x
x
x
x
x
x
GMACM will enhance its systems so Eligible Homeowners do not need to
know or remember the Relationship Manager’s extension. Eligible
Homeowners who dial any of GMACM’s 1-800 numbers will be
automatically routed to the assigned Relationship Manager. The system will
identify the Eligible Homeowner based on his or her social security number or
loan number. Eligible Homeowners will continue to have the option of dialing
the Relationship Manager’s extension.
GMACM’s 1-800 numbers and Relationship Manager’s name will be added to
all standard Loss Mitigation communications.
Further, GMACM’s 1-800 number is on its website and billing statements in
addition to the Welcome Letter mailed to each Eligible Homeowner upon
assignment of a Relationship Manager.
As an additional enhancement GMACM will revise the Welcome Letter to
instruct borrowers to call their assigned Relationship Manager for assistance
on any correspondence they receive.
The Relationship Manager will continue have access to all collections, Loss
Mitigation and foreclosure correspondence, in addition to access to the
relevant department specialists to answer any questions the Eligible
Homeowner may have.
Further, the Relationship to explain the aforementioned communication and
correspondence services to the Eligible Homeowners in the initial verbal
contact.
GMACM believes that these steps represent significant improvement to its
communications with Eligible Homeowners and make it possible for the Eligible
Homeowner to receive the services necessary without placing any additional burden
on their ability to access and communicate with the assigned Relationship Manager.
Consent Order Response to Section 5(e): Information and Personnel Access
Consent Order section 5e requires: Measures to ensure that the single point of
contact has access to current information and personnel (in-house or third-party)
sufficient to timely, accurately, and adequately inform the borrower of the current
status of the Loss Mitigation and foreclosure activities
It is important to note that Relationship Managers serve as conduits between their
Eligible Homeowners and other business units (Loss Mitigation and Foreclosure)
within the servicing organization. To illustrate, while the Relationship Manager has
the tools and authority to recommend action, the actual process of approving a loan
modification or delaying the referral or continuation of foreclosure remains in the
23
Confidential
Loss Mitigation Underwriting Department, Foreclosure and Operational Controls
Group.
Measures GMACM will take to meet the objectives of Section 5(e) consist of
enhancements to policies and procedures, implementation of new system access
profiles, and monitoring of compliance by SQMD as noted below. These will be
completed by September 1, 2011.
x
GMACM will establish policies and procedures designed to ensure and
promote open lines of communication between Relationship Managers and
personnel in other departments, such as foreclosure, Loss Mitigation,
cashiering and escrow processing, as well as with third parties (such as default
counsel). These policies and procedures will enable the Relationship Manager
to address Eligible Homeowners’ issues holistically, timely and accurately.
x
GMACM will provide Relationship Managers appropriate levels of access to
all MIS required to provide timely and accurate responses to Eligible
Homeowners’ questions and issues and meet their responsibilities. This
includes but is not limited to access to
and ancillary systems that
contain relevant information such as Loss Mitigation Workout Packages
(Looking Glass) and the LPS Desktop system (Foreclosure Attorney
Network). A specific security profile is being created and will be in place
prior to August 1, 2011 for all Relationship Managers to ensure access to the
appropriate systems while also adhering to GMACM’s guidelines for
segregation of duties and to ensure Relationship Managers have the ability to
initiate but not approve or execute transactions unilaterally. Relationship
Manager training will include training regarding the use of these systems,
which will enable Relationship Managers to access information needed in
order to address Eligible Homeowners’ inquiries timely and accurately.
x
The SPOC department management will, at a minimum, conduct quarterly
reviews of the security profiles and system access capabilities of the
Relationship Managers, and the training thereon (as required under Directive
11-04). Based on quality monitoring reviews conducted by SQMD, feedback
from borrowers, and feedback from the Relationship Managers, additional
access or system security will be granted as needed. This is intended to
provide Relationship Managers with the ability to access the most current and
relevant account information and to provide a consistently high level of
service to Eligible Homeowners.
A list of MIS available to the Relationship Manager is included as Appendix 5.10.
24
Confidential
Consent Order Response to Section 5(f): Decision Communication
Consent Order section 5f requires: Procedures and controls to ensure that a final
decision regarding a borrower’s Loss Mitigation request (whether on a trial or
permanent basis) is made and communicated to the borrower in writing, including the
reason(s) why the borrower did not qualify for the trial or permanent modification
and, if applicable, the net present value calculations utilized by GMACM, and that
involve the single point of contact within a reasonable time before any foreclosure
sale occurs
As previously noted, GMACM currently mails a denial letter within 48 hours of an
adverse decision and has consistently done so throughout 2011. Denial reasons
specified in the denial letters are system-generated based on the specific Loss
Mitigation solution for which the Eligible Homeowner has been denied. If a Net
Present Value ("NPV") was calculated as part of the modification evaluation process,
the NPV inputs are included in the denial letter to borrowers of non-GSE owned loans
who are denied a HAMP modification.
As required by the Order, by September 1, 2011 GMACM will incorporate into denial
letters the most recent NPV for all Eligible Homeowners for whom denial was based
on the NPV results. This will be implemented for both HAMP and non-HAMP loans,
including GSE loans.
GMACM will implement additional changes to Loss Mitigation correspondence as a
whole, based on the recommendations of a review of existing correspondence
conducted by an outside consultant in April of 2011. The objective of the external
review was to improve the clarity and conciseness of default correspondence as part
of a larger effort to improve overall customer experience. These enhancements will be
fully implemented by September 1, 2011.
Consent Order Response to Section 5(g): Holding Foreclosure
Consent Order section 5g requires: Procedures and controls to ensure that when the
borrower’s loan has been approved for modification on a trial or permanent basis, (i)
no foreclosure or further legal action predicate to foreclosure occurs, unless the
borrower is past due on two or more payments post-dating the trial or permanent
modification; and (ii) the single point of contact remains available to the borrower
and continues to be referenced on all written communications with the borrower
To comply with the Order, GMACM will implement processes to notify the related
foreclosure counsel to cease any foreclosure actions for Eligible Homeowners who
25
Confidential
have accepted an approved trial plan or permanent modification. . In addition,
procedures will be implemented to ensure that foreclosure action will not resume
unless the Eligible Homeowner who has accepted trial modification plan misses two
payments under the trial or permanent modification agreement as defined in the
Order. SQMD will also implement process controls and quality assurance measures to
monitor and help ensure compliance with these requirements. The implementation of
the aforementioned changes is scheduled for September 1, 2011.
Controls to prevent continuation of foreclosure action outside of guidelines as defined
by the Order will include exception reports reviewed on a daily basis by the Loss
Mitigation and foreclosure departments and their management. This process will be in
place by November 1, 2011. In addition, SQMD performs a review of all loans prior
to foreclosure referral and then seven and three days prior to sale to ensure that there
is no ongoing Loss Mitigation activity, as previously noted.
As previously noted in Section 5(c), the Relationship Manager will remain available
to each Eligible Homeowner throughout the Loss Mitigation and foreclosure process.
The Relationship Manager’s name will be referenced in Loss Mitigation
correspondence, as detailed in Section 5(d).
The following appendices contain information related to the policies, procedures and
practices noted in this section.
x
Appendix 5.11: Foreclosure Review Definition
x
Appendix 5.12: Foreclosure Review Template
Consent Order Response to Section 5(h): Customer Complaints
Consent Order section 5h requires: Policies and procedures to enable borrowers to
make complaints regarding the Loss Mitigation process, denial of Loss Mitigation
requests, the foreclosure process, or foreclosure activities that prevent a borrower
from pursuing Loss Mitigation options, and a process for making borrowers aware of
the complaint procedures
This section is addressed together with Section 5(i) below.
Consent Order Response to Section 5(i): Complaint Review Process
Consent Order section 5i requires: Procedures for the prompt review, escalation, and
resolution of borrower complaints, including a process to communicate the results of
the review to the borrower on a timely basis
26
Confidential
GMACM’s current practice is to handle escalated calls from borrowers immediately
and at the supervisory level. The Relationship Managers will have direct access to
their supervisor for those Homeowners requesting escalation. The supervisor will take
ownership of the call, complete an initial assessment and handle required follow up
with the Eligible Homeowner. In the event that immediate handling is not possible, a
call back by the team lead or supervisor will occur within 24 hours.
While most elevated situations will be handled within the SPOC Department, we
recognize that some Eligible Homeowners will feel the need to elevate beyond this
area. To ensure that all Eligible Homeowners clearly understand how they can submit
complaints, GMACM will adopt enhanced procedures for promoting awareness of
complaint handling. For instance, Welcome Letters (described in Section 5(d)) will
include a description of the complaint process and identify a toll free hot-line
(Complaint Hot-line) and e-mail address, separate and independent from the SPOC
function, where Eligible Homeowners can submit complaints. The Complaint HotLine will be a part of our Voice of the Customer Unit, which is independent of all
Default related call centers including the Relationship Managers. This group reports
into the Customer Care area of Contact Center Operations with direct access to
GMACM executive management. Seasoned resources with extensive servicing,
customer service and default processes experience, as well as established support
functions in all default related departments, will handle these escalated complaints to
resolution. Turnaround time to complete resolution of Eligible Homeowner
complaints is 6-8 days. This resolution requires a letter to the Eligible Homeowner. In
addition, the complaint process will be documented and available on the GMACM
website for Eligible Homeowner’s access and reference. GMACM will use complaint
data to foster continuous improvement by identifying process improvement
opportunities and Relationship Manager performance coaching and training
enhancements. The implementation of the process is scheduled to begin October 1,
2011.
Consent Order Response to Section 5(j): Second Liens
Consent Order section 5j requires: Policies and procedures to consider loan
modification or other Loss Mitigation Activities with respect to junior lien loans
owned by Ally Financial, ResCap, GMACM, or Ally Bank where GMACM service the
associated first lien mortgage and become aware that such first lien mortgage is
delinquent or has been modified
When GMACM becomes aware that the first lien it services on behalf of Ally Bank or
ResCap has become delinquent or has been modified, it will review the borrower’s
situation and may modify the second lien in accordance with the servicing agreement
to achieve an affordable payment considering both the first and second lien
obligations. Processes for contacting Eligible Homeowners and completing
modifications for the associated second liens will be defined and implemented by
November 1, 2011.
27
Confidential
To accomplish this GMACM will develop an internal process to match first liens it
services with the associated second lien. A matched loan pair will be defined as a first
and second lien on the same property with a common borrower. This matching
process will be performed on a monthly basis and will be in place by November 1,
2011.
For loans that are confirmed matches, the following actions will be taken.
x
Where Ally Bank or ResCap owns the first lien and associated second liens
and GMACM as the servicer of the associated second lien mortgage becomes
aware that the first lien is delinquent or has been modified, or that the second
lien is delinquent, the servicer will review the borrower’s situation and may
modify the second lien in accordance with the servicing agreement that apply
to the Bank owned second lien such that an overall (combined first and second
lien) affordable payment is reached.
x
Where Ally Bank or ResCap owns only the second lien and both the first and
second liens are serviced by GMACM and GMACM as the servicer of the
second lien becomes aware that the first lien has become delinquent or has
been modified, GMACM will review the borrower’s situation and may modify
the second lien in accordance with the servicing agreement to achieve an
affordable payment considering both the first and second lien obligations.
Consent Order Response to Section 5(k): Letters
Consent Order section 5k requires: Policies and procedures to ensure that timely
information about Loss Mitigation options is sent to the borrower in the event of a
delinquency or default, including plain language notices about the pendency of loan
modification and foreclosure proceedings
As previously noted,
automates the process of mailing various standard and
statutorily required notifications to borrowers on pre-defined schedules. As an
example, GMACM leverages this infrastructure to automatically trigger the mailing
of information about Loss Mitigation options no later than the 50th day of
delinquency. The delivery of information relating to Loss Mitigation options is also
governed by various contractual obligations including Directive 10-02. In addition,
the automated processes are used to provide borrowers with timely information
regarding the status of their account throughout the loan modification and foreclosure
proceedings. To monitor compliance with the required letter timing schedule, internal
controls to ensure timely delivery to the Eligible Homeowner have been in place
throughout 2011. These controls include a series of daily exception reports that
identify any accounts where criteria to generate a letter was met but a letter was not
created via the automatic system process. These reports are reviewed and exceptions
are addressed by the appropriate department on a daily basis. The individual business
units within the Loss Mitigation and Contact Center Operation that are responsible for
28
Confidential
generating letters also perform random validation of letters on a daily basis to ensure
letters were produced timely and accurately.
To improve the overall content of default-related borrower correspondence, GMACM
commissioned an independent review of borrower correspondence as previously
noted. These letters and notices underwent an extensive review by the external
advisor to ensure that they are written in plain language and clearly identify the
actions required and options available to the customer. While correspondence related
to early stages of delinquency has been adjusted, correspondence related to Loss
Mitigation including Loss Mitigation solicitation, status, trial and permanent
modification communications remain under review. Appropriate changes to such
correspondence will be implemented as necessary no later than August 1, 2011.
Remaining enhancements on correspondence unrelated to Loss Mitigation, such as
Cash Processing, Escrow and Customer Care, will be completed by October 1, 2011.
Consent Order Response to Section 5(l): Documentation
Consent Order section 5l requires: Policies and procedures to ensure that foreclosure
and related documents provided to borrowers and third parties are appropriately
maintained and tracked, and that borrowers generally will not be required to
resubmit the same documented information that has already been provided, and that
borrowers are notified promptly of the need for additional information
Eligible Homeowners may submit a Loss Mitigation Workout Package in a manner
that best meets their needs. They may submit the Package via fax, e-mail, USPS mail
or at the gmacmortgage.com web site. The cover page of the Package provides
specific instructions on the required information and documentation to complete and
return to determine eligibility for a Loss Mitigation solution.
Loss Mitigation reviews Packages and documentation within 24 hours of receipt
through a consistent process, which provides controls to ensure documents do not get
lost. The review process documents all contents of the Package, reviews the
documentation for completeness, enters key information into the
servicing
system and uploads all the received documentation into the imaging system (Looking
Glass). 90% of Packages are received via fax, e-mail or the web so the documents are
already in electronic format. Packages received through the mail are scanned by a
centralized team within Loss Mitigation the same day that they are received. Year to
date, 99.8% of packages have completed this initial review process within 24 hours of
receipt. To control for completeness, a daily reconciliation is performed that compares
the total incoming documents to the total disposition of documents for that day.
Eligible Homeowners must only submit the Package documentation once during their
eligibility evaluation process. As described in Section 5(b), GMACM mails an
acknowledgement letter to each Eligible Homeowner the next business day after the
receipt of their Package. If documentation is missing, a process is in place to mail
letters promptly (average of 2 business days after receipt of the Package) to inform
29
Confidential
the Eligible Homeowner exactly what is needed to determine eligibility and
specifically where to submit the missing documentation. Calling campaigns will be
completed by the Relationship Manager to follow up for missing documentation.
Package information, documentation and system notations are reviewed by two
separate areas within GMACM servicing operations (Loss Mitigation Fulfillment and
Loss Mitigation Underwriting) to determine whether Packages are complete. These
reviews provide additional control points to prevent repeated requests for information
that Eligible Homeowners may have already submitted. In addition, metrics designed
to measure quality and accuracy of package processing are in place. SQMD performs
a review on this process daily and provides an additional key control point to help
ensure that GMACM only requests the required documentation from the Eligible
Homeowner once. Year-to-date service level results on quality are 98.21%.
All of the processes and controls described above help prevent documents from
becoming lost and ensure Eligible Homeowners are notified of any missing
documentation immediately. All incoming and outgoing Loss Mitigation
correspondence including trial and permanent modification agreements are stored
within our imaging system and are easily accessible to the Relationship Manager
(further described in Section 5(e)).
Controls over foreclosure-related documents that are outside of the Loss Mitigation
department are discussed in detail in the response to Section 6 of the Order (Third
Party Management) as foreclosure documents are sent to the borrowers by third party
foreclosure law firms and GMACM itself does not send documents to borrowers as
part of the foreclosure process.
General Consent Order Response
The Board Oversight section of the Order (Section 2) requires that “programs have officers
and staff with the requisite qualifications skills and ability to comply with requirements of the
Order." As this relates to Relationship Managers, GMACM has developed a job description
to facilitate the initial implementation of the SPOC program. The job description defines the
Relationship Manager’s role and responsibilities for managing the relationship with Eligible
Homeowner throughout the entire delinquency or imminent default resolution process,
including any home retention and non-foreclosure liquidation options as well as
responsiveness to Eligible Homeowner inquiries regarding the status of the foreclosure where
necessary.
The Relationship Manager position requires best-in-class communication and negotiation
skills, empathy, and vast and detailed knowledge of all Loss Mitigation programs, investor
requirements, regulatory limitations, foreclosure referral standards and foreclosure processes
in general. Prerequisites for this position are: college education/degree (preferred); high
30
Confidential
school diploma or equivalent (required); previous Call Center, Collections, or Loss
Mitigation experience (required).
GMACM's performance management process will be leveraged for the assessment and
review of Relationship Managers' performance. The performance review process will include
formal semi-annual assessments of Relationship Managers and a review of individual
development plans. In addition, monthly evaluation of the Relationship Manager will include
detailed scorecards that focus on quality and the Relationship Manager’s consistency of
service provided to Eligible Homeowners. A success measure score card designed to measure
Relationship Managers, the department supervisors, managers and the department’s overall
performance will be developed and implemented by September 1, 2011. In addition
GMACM will utilize an independently conducted customer satisfaction survey in an effort to
gauge overall customer experience at the department level. This survey will be implemented
by November 1, 2011.
To ensure the Relationship Managers have the knowledge and tools to successfully meet the
requirements of their job functions, a Certification Program has been established to train and
test for knowledge of Loss Mitigation in addition to the Relationship Manager’s
comprehension of the training on GMACM servicing systems and processes. The
Certification Program will be implemented for existing and new Relationship Managers and
line management, and will include a minimum of annual refresher training and recertification
after initial certification. The initial Certification Program for the current Relationship
Managers in the Pilot program will be completed by July 1, 2011. GMACM plans to update
this training as the SPOC program matures and evolves.
The Board Oversight section of the Order (Section 2) also requires management to perform
"periodic review of adequacy of levels of staffing (officer/staff); plan shall establish metrics
to measure and ensure the adequacy of staffing levels relative to existing and future Loss
Mitigation and foreclosure activities, such as limits for the number of loans assigned to a
Loss Mitigation employee, including Relationship Managers, and deadlines to review loan
modification documentation, make loan modification decisions, and provide responses to
borrowers."
An initial staffing model has been completed and utilized for the Relationship Manager Pilot
program (described in Section 5(c)). This model will be refined to comply with Directive 1104 in addition to knowledge we gain from actual results experienced in the Relationship
Manager Pilot. GMACM management will review the staffing model and adjust staffing on a
monthly basis.
Workloads for Relationship Managers will be set based on an active portfolio of 75 to 150
borrowers per Relationship Manager, depending upon the complexity of the anticipated Loss
Mitigation efforts with a goal of blending complex and less complex loans within each
Relationship Manager’s portfolio. The initial staffing levels will be calibrated based on
anecdotal data from other servicers, and on similar SPOC models in GMACM Lending
Division and Special Servicing Department that have experience with similar ownership
models. The Pilot program will also provide a basis through which GMACM will gain
31
Confidential
additional information required to calibrate the workload per Relationship Manager in order
to achieve required service levels and responsiveness. GMACM will continue to measure
service levels, borrower experience and quality of service and recalibrate the workloads of
Relationship Managers to ensure that each Relationship Manager has a manageable work
load to effectively service their assigned borrowers. This capacity analysis will be completed
by monitoring daily, weekly and monthly service level, quality and production management
reports to ensure Key Performance Indicators (“KPI”s) are being maintained. Additionally,
volume forecasts along with staffing models will be used to project future staffing, ensuring
sufficient staff to handle projected volume workloads.
GMACM will also identify and establish key metrics and performance against those metrics.
Daily KPI reporting will be established to facilitate day-to-day administration of the SPOC
department’s performance. Monthly operating reports will be completed with distribution up
to and including the Chief Executive Officer of GMACM. Success under these KPIs will be
the true measure of our overall staffing effectiveness and adequacy. This will be in place by
October 1, 2011.
Details on deadlines to review loan modification documents, make loan modification
decisions and provide response to borrowers are covered in Section 5(b).
32
Confidential
Appendix I - First Level Project Details
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
Single Point of Contact
1.
Establishment of SPOC Department
SPOC program
flow charts
5c
Develop and document SPOC
process/flow charts based on Consent
Order and Directive 11-04 requirements
5/15/11
7/15/11
SPOC training
and certification
program
5c
4/01/11
7/15/11
RM hiring
5c
Complete training and certification
curriculum for Relationship Managers
(RM), including Legal & Compliance
approval
Complete RM hiring to accommodate
expected loan volume for 9/1 launch
4/15/11
7/15/11
RM training
5c
Train and certify RMs for the 9/1 launch
5/01/11
9/01/11
RM hiring
5c
7/15/11
9/15/11
RM training
5c
7/15/11
11/01/11
SPOC telephony
system
Technological
changes
5c
Complete RM hiring to accommodate full
expected loan volume
Train and certify RMs for full expected
loan volume
Align telephony needs
4/15/11
9/01/11
5c
Implement required technology changes
4/15/11
9/01/11
SPOC Welcome
Letter
Updated P&P
manual
5d
Develop Welcome Letter to introduce
RM
Update P&P manual
4/01/11
9/01/11
5/15/11
9/01/11
RM daily work
queue reports
Capacity Plan
5c
Develop and document daily RM work
queue reports
Develop and document capacity plan
4/01/11
8/15/11
4/01/11
7/01/11
Loan assignment
scoring model
Loan assignment
structure
RM score card
metrics
5c
Implement scoring model for loan
assignment
Develop and document loan assignment
structure
Develop metrics for RM score card
5/01/11
7/01/11
4/15/11
8/01/11
5/01/11
7/15/11
Success measure
score card
SPOC Quality
Monitoring
standards
System access
5c
Develop success measure score card for
RM and above
Develop Quality Monitoring standards
and processes
5/01/11
9/01/11
4/15/11
10/01/11
Grant system access for all RMs
4/15/11
9/01/11
5c
5c
5c
5c
5c
5e
33
Confidential
6/01/11
9/01/11
5c
RM assignment
Assignment or RM upon Right Party
upon Default
Contact in Default
RPC
2. Customer Communication
11/30/11
1/01/12
SPOC KPI
reporting
measures
KPI reporting
5a
Define measures for SPOC KPI reporting
6/01/11
7/15/11
5a
7/01/11
10/01/11
Written
communication
controls
10-02 response
timelines
Monitoring of 1002 standards
GSEs’ response is
received,
recorded and
complied with
5b
Develop daily/weekly/monthly KPI
reporting
Enhance controls around written
communication in response to request for
Loss Mitigation
Apply Directive 10-02 standards to all
loans with delegated authority
Develop monitoring of Directive 10-02
standard implementation
Ensure official correspondence is sent to
GSEs regarding Directive 10-02
compliance
6/01/11
10/01/11
4/15/11
10/01/11
6/01/11
10/01/11
7/01/11
10/01/11
Master Servicing
or Investor
response
received,
recorded and
complied with
5b
Coordinate Directive 10-02
implementation with Master Servicing for
HAMP non-participating investors
7/01/11
10/01/11
Include NPV results in denial letters
when appropriate
Enhance Loss Mitigation correspondence
4/15/2011
9/01/11
4/15/2011
9/01/11
Identify RM by name in Loss Mitigation
correspondence
6/01/11
9/01/11
Interdepartmental
communication
structure
5e
5b
5b
5b
NPV result in
5f
denial letters
Enhanced Loss
5f
Mitigation
correspondence
RM identified by
5d,g
name in Loss
Mitigation
correspondence
3. Foreclosure Holds
Foreclosure on
hold until 2nd
payment missed
Foreclosure
actions stopped
upon trial
approval
Controls around
foreclosure holds
Establish dedicated SPOC support
structure in other GMACM departments
5g
Implement process to keep foreclosure on
hold until 2nd trial payment missed
4/15/11
9/01/11
5g
Implement process to prevent foreclosure
initiation/stop foreclosure action upon trial
approval
5/01/11
9/01/11
5g
Enhance controls around foreclosure holds
6/01/11
9/01/11
34
Confidential
4.
Complaint Process
SPOC complaint
process
Teams to support
SPOC complaint
process
SPOC hot-line
5.
5h,i
Establish SPOC complaint process
6/01/11
10/01/11
5h,i
Create dedicated teams to support complaint
process and escalations
6/01/11
10/01/11
5h,i
Develop complaint hot-line
6/01/11
10/01/11
6/15/11
11/01/11
7/15/11
11/15/11
Junior/Senior Lien Coordination
5j
Matched 1st and
Match 1st and 2nd liens on the same property
nd
2 liens
5j
Loss Mitigation
Implement Loss Mitigation daily
solicitation
solicitation process for matched 2nd liens
process on
matched 2nd liens
6. Letter Review Process
Timely and clear
Loss Mitigation
correspondence
Timely and clear
other
correspondence
5k
Ensure all letters are timely and in plain
language - Loss Mitigation
5/01/11
8/01/11
5k
Ensure all letters are timely and in plain
language - other letters
5/01/11
10/01/11
35
Confidential
GMAC Mortgage, LLC
Third Party Management
Prepared for the Board of Governors of the Federal Reserve System & the Federal Deposit
Insurance Corporation
Revised on December 8, 2011
Confidential Treatment Requested
1
Table of Contents
Plan Overview for Third Party Management ............................................................................................. 3
Description and Use of Third Party Suppliers ............................................................................................ 4
Principles Guiding the Program ................................................................................................................. 6
Consent Order Response ............................................................................................................................ 8
Summary / Conclusion ............................................................................................................................. 23
Appendix I – Project Summaries.............................................................................................................. 25
Appendix II - Board Level Deliverables and Due Dates ............................................................................ 26
Appendix III - First Level Project Details ................................................................................................ 26
Confidential Treatment Requested
2
Plan Overview for Third Party Management
This Program for Third Party Management (the “Program”) is established in response to the
Consent Order dated April 13, 2011 (the “Order”) among the Board of Governors of the
Federal Reserve System (the "FRB") and the Federal Deposit Insurance Corporation (the
"FDIC"), Ally Bank (the “Bank”), Ally Financial Inc. (“Ally Financial” or “AFI”), and
certain of Ally Financial’s direct and indirect subsidiaries including Residential Capital, LLC
(“ResCap”) and GMAC Mortgage, LLC (“GMACM” or “GMAC Mortgage” and together
with ResCap, the “Mortgage Servicing Companies”). Capitalized terms not defined in the
Program shall have the meanings assigned to them in the Order.
The purpose of this Program is to set forth the actions and responsibilities necessary for
GMACM to comply fully with its obligations under Section 6 of the Order (see Appendix I).
Section 6 of the Order requires that:
Within 60 days of this Order, GMAC Mortgage shall submit to the Reserve Bank acceptable
policies and procedures for the outsourcing of any residential mortgage loan servicing, Loss
Mitigation, or foreclosure functions, by the Mortgage Servicing Companies to any
independent contractor, consulting firm, Legal Supplier, property manager, or other third
party (including any subsidiary or affiliate of Ally Financial) (collectively, “Third-Party
Providers”). Third-Party Providers include local counsel in foreclosure or bankruptcy
proceedings retained to represent the interests of owners of mortgages in the Servicing
Portfolio (“Foreclosure Counsel”). The policies and procedures shall, at a minimum,
address, consider, and include:
6(a) Appropriate oversight of Third-Party Providers to ensure that they comply with
the Legal Requirements, supervisory guidance of the Board of Governors, and
GMAC Mortgage’s policies and procedures;
6(b) Processes to prepare contingency and business continuity plans that ensure the
continuing availability of critical third-party services and business continuity of
the Mortgage Servicing Companies, consistent with supervisory guidance of the
Board of Governors, both to address short-term and long-term service
disruptions and to ensure an orderly transition to new service providers should
that become necessary;
6(c) Measures to ensure that all original records transferred by the Mortgage
Servicing Companies to Third-Party Providers (including the originals of
promissory notes and mortgage documents) remain within the custody and
control of the Third-Party Provider (unless filed with the appropriate court or
the loan is otherwise transferred to another party), and are returned to the
Mortgage Servicing Companies or designated custodians at the conclusion of
the performed service, along with all other documents necessary for the
Mortgage Servicing Companies’ files;
6(d) Measures to ensure the accuracy of all documents filed or otherwise utilized on
behalf of the Mortgage Servicing Companies or the owners of mortgages in the
Servicing Portfolio in any judicial or non-judicial foreclosure proceeding,
Confidential Treatment Requested
3
related bankruptcy proceeding, or in other foreclosure-related litigation,
including, but not limited to, documentation sufficient to establish ownership of
the note and right to foreclose at the time the foreclosure action is commenced;
6(e) Processes to perform appropriate due diligence on potential and current ThirdParty Provider qualifications, expertise, capacity, reputation, complaints,
information security, document custody practices, business continuity, and
financial viability; and measures to ensure the adequacy of Third-Party
Provider staffing levels, training, work quality, and workload balance;
6(f) Processes to ensure that contracts provide for adequate oversight, including
requiring Third-Party Provider adherence to GMAC Mortgage foreclosure
processing standards, measures to enforce Third-Party Provider contractual
obligations, and processes to ensure timely action with respect to Third-Party
Provider performance failures;
6(g) Processes to ensure periodic reviews of Third-Party Provider work for
timeliness, competence, completeness, and compliance with all applicable Legal
Requirements, and GMAC Mortgage’s contractual obligations to GSEs and
investors, and to ensure that foreclosures are conducted in a safe and sound
manner;
6(h) Processes to review customer complaints about Third-Party Provider services;
6(i) A review of fee structures for Third-Party Providers to ensure that the method of
compensation considers the accuracy, completeness, and legal compliance of
foreclosure filings and is not based solely on increased foreclosure volume or
meeting processing timelines; and
6(j) A periodic certification process for Legal Suppliers (and recertification of
existing Legal Supplier providers) that provide residential mortgage foreclosure
and bankruptcy services for the Mortgage Servicing Companies as qualified to
serve as Third-Party Providers to the Mortgage Servicing Companies, including
that attorneys are licensed to practice in the relevant jurisdiction and have the
experience and competence necessary to perform the services requested.
In response to the Order, GMACM has prepared this Program for the Mortgage Servicing
Companies as a response to Item 6 of the Order and the requirements therein.
Description and Use of Third Party Suppliers
GMACM’s servicing operation uses third party service providers (“Suppliers”) to enhance its
performance, capacity, profitability, and focus on strategic objectives. Drawing expertise
from Suppliers often leads to attaining efficiencies and scale, accelerating knowledge
transfer, offering a champion-challenge opportunity, allowing for a more targeted focus on
strategic imperatives and enabling clearer and more consistent focus on GMACM’s core
competencies. In essence, Suppliers represent a value-add extension of the GMACM
servicing operation business model.
Confidential Treatment Requested
4
Specific to law firms and foreclosure trustee firms providing default-related legal services to
GMACM’s servicing operation (“Legal Suppliers”), GMACM’s servicing operation must use
a large number of external Legal Suppliers to pursue foreclosure and bankruptcy proceedings
on its behalf and on behalf of the owners of the mortgages in the Servicing Portfolio. This
external use of Legal Suppliers is necessary due to the local nature of foreclosure and
bankruptcy proceedings and the ethical and bar rules governing the practice of law which
restricts the use of internal company counsel for these activities. The roster of Legal
Suppliers used by GMACM largely has been drawn from the “approved counsel” listings
published by Fannie Mae and Freddie Mac (the “GSEs”) and, in line with common industry
practice, the Legal Suppliers had been managed by GMACM’s servicing default operations
group.
the AFI Legal staff is in process of: i) redirecting Legal Supplier management and oversight
from default operations to the AFI Legal staff, ii) conducting diligence on existing Legal
Suppliers to identify issues and, where needed implement remediation plans, (iii) drafting and
implementing emergency file removal procedures for use when moving case loads between
Legal Suppliers; and iv) coordinating with the GSEs in an expansion to their approved
counsel listings as a measure to remediate Legal Supplier concentration risks.
To enhance the management of Supplier risks, GMACM is evaluating its Supplier
management model and will introduce a mortgage supplier office to coordinate Supplier
activities (“Mortgage Supplier Office”) associated with non Legal Suppliers and, as part of
that initiative, will have the AFI Legal staff continue to and document its efforts described
above and maintain overall responsibility for the selection, management, oversight and offboarding of Legal Suppliers. They will better leverage servicing operations and global
business partner expertise while coordinating due diligence, contracting and oversight
activities. GMACM’s Supplier management model will result in redefining mortgage
operation and global support function roles relating to Supplier management while reemphasizing the importance of risk, compliance, legal, and information technology
involvement in higher risk Supplier relationships. The Mortgage Supplier Office (with input
from AFI Legal Staff for Legal Suppliers) will reinforce the necessary risk analysis measures
while reporting risks to executives through the Mortgage Executive Leadership Team. The
figure on the following page highlights the Supplier governance structure.
Confidential Treatment Requested
5
Principles Guiding the Program
The cornerstone of the Program is a comprehensive review of compliance with the terms of
the FDIC Financial Institution Letter (FIL-44-2008 dated June 6, 2008), the Comptroller of
the Currency OCC Bulletin (OCC 2001-47 dated November 1, 2001) and Federal Financial
Institutions Examination Council guidance (collectively, “Supervisory Guidance”) to
facilitate the development of the Program. This comprehensive review remains underway and
focuses on an assessment of: i) existing Supplier policies, procedures and risk monitoring
tools which will conclude by December 2011, ii) existing Legal Suppliers, which will
conclude by 6/30/12; and iii) other existing Suppliers, which will conclude by December
2013. In support of the Program, GMACM is conducting a detailed review of its Supplier
process, which will better enable monitoring activities and resulting risk mitigation.
GMACM is proposing, and in some cases implementing, the following actions relating to its
ongoing use of Suppliers for its servicing operation:
(1) Establishment of a Mortgage Supplier Office on July 15, 2011
(2) Establishment of a mortgage Supplier discussion segment with the Mortgage Executive
Leadership Team by January 31, 2012
(3) Global Supply Chain (GSC), in partnership with the GMACM Supplier Office, developed
and published Ally Global Supplier management policy and procedures on September 30,
2011. GMACM reevaluated their initial draft policy and procedures submitted on 6/13/11
and made a decision to adopt the Global policy and procedures as they covered areas
Confidential Treatment Requested
6
previously addressed by the draft Mortgage policy and procedures as well as provided
additional governance and standards related to:
a) Responsibility of business owners and global partners
b) Due diligence and monitoring activities
c) Contracting and Sourcing activities
The following Ally Global Supplier management policy and procedures will be
implemented within Mortgage Servicing by February 1, 2012.
(a) Global Third Party Supplier Management Policy
(b) GSC Exception Procedure
(c) GSC Risk Assessment Procedure
(d) GSC Supplier Issue Escalation Procedure
(e) GSC Managing-Monitoring-Reporting Procedure
(f) GSC SMO Oversight Procedure
(g) GSC Contracting Procedures
(h) GSC Offboarding Procedure
(i) GSC Sourcing Procedures
(4) Drafting of Legal Supplier Management policy and procedures targeting the GMACM
servicing operation and implementing them by February 1, 2012. The Legal Supplier
Management policy and procedures align with the GSC policy and procedures. Based on
the unique nature of Legal suppliers and services performed, Ally Legal will manage and
monitor all Legal Servicing suppliers to ensure adherence to the documented policy and
procedure and the changing regulatory environment.
(a) Mortgage Legal Supplier Management Policy
(b) Mortgage Legal Supplier Management Procedure
(5) Drafting of a mortgage Supplier quality assurance workplan and implementing it by May
1, 2012
(6) Business Continuity is addressed by the Global Business Continuity Policy (Appendix L).
This policy has an annual review cycle and was initially implemented in March 2010.
GMACM will also utilize GSC’s existing Supplier Contingency Plan template to address
the potential need to dissolve and backfill a supplier relationship. In addition,
Operational Competency, Technology and Business Continuity Assessments which are
published and being implemented on 2/1/12 are part of the inherent product/service risk
assessment that address a supplier’s ability to deal with service disruptions, onboarding
and offboarding. The GSC Risk Assessment Procedure (Appendix C) documents this
Risk Assessment process.
(7) Enhancing the Supplier risk framework:
(a) Completed the Legal Supplier framework on July 1, 2011, which is currently with
AFI Audit staff for review. AFI Legal will complete the assessment of existing
Legal Suppliers by 6/30/12
Confidential Treatment Requested
7
(b) Currently drafting enhanced Supplier risk monitoring tools which will be
implemented by February 1, 2012 and will be used to complete an assessment of
existing non-Legal Suppliers by December 1, 2013
GMACM is in the process of performing reviews of remedial actions and Appendix III
provides a summary of the nature of GMACM’s review and the remedial actions.
Consent Order Response
A. Consent Order Response to Section 6a
Consent Order section 6a requires:
a) Appropriate oversight of Third-Party Providers to ensure that they comply with the
Legal Requirements, supervisory guidance of the Board of Governors, and GMAC
Mortgage’s policies and procedures;
GMACM is utilizing the GSC Supplier Management Policy, Mortgage Legal Supplier
Management Policy and related procedures to ensure compliance with Legal Requirements,
Investor Requirements, Supervisory Guidance, and AFI’s applicable policies and procedures.
Global Supply Chain, in partnership with the GMACM Supplier Office, developed and
published Ally Global Supplier management policy and procedures on September 30, 2011.
GMACM reevaluated their initial draft policy and procedures submitted on 6/13/11 and made
a decision to adopt the Global policy and procedures as they covered areas previously
addressed by the draft Mortgage policy and procedures as well as provided additional
governance and standards related to:
a) Responsibility of business owners and global partners
b) Due diligence and monitoring activities
c) Contracting and Sourcing activities
These procedures further detail how GMACM will conduct its due diligence, contracting and
oversight. All policy, procedure and related documents will be implemented by February
2012 and result in a strengthened Supplier management process. Attached to this Program
are copies of the following documents:
x Appendix A: Global Third Party Supplier Management Policy
x
Appendix B: GSC Exception Procedure
x
Appendix C: GSC Risk Assessment Procedure
x
Appendix D: GSC Supplier Issue Escalation Procedure
x
Appendix E: GSC Managing-Monitoring-Reporting Procedure
x
Appendix F: GSC SMO Oversight Procedure
x
Appendix G: GSC Contracting Procedures
x
Appendix H: Draft Mortgage Legal Supplier Management Policy
x
Appendix I: Draft Mortgage Legal Supplier Management Procedure
Confidential Treatment Requested
8
x
Appendix J: GSC Offboarding Procedure
x
Appendix K: GSC Sourcing Procedures
The following global policies were implemented in March and April 2010 respectively.
Although they were not specifically developed as a response to the Consent Order these
policies will be utilized in conjunction with the documentation identified above to support
management and oversight of third party providers:
x Appendix L: Global Business Continuity Policy
x Appendix M: Global Records Management Policy
GMACM is also in the process of enhancing its risk monitoring tools for its Suppliers to
better identify risks and ensure compliance with AFI’s policies and procedures. These riskmonitoring tools will be implemented by February 2012 and include items such as an
inherent product/service risk assessment analysis, a series of Supplier questionnaires and
oversight/risk scorecards. The risk monitoring tools will consider Legal Requirements,
Investor Requirements, Supervisory Guidance, and AFI’s applicable requirements and the
review process will better inform Legal, Compliance, Risk and IT staff providing for a more
comprehensive understanding of how their area of expertise influences the mortgage business
model. To determine the level of inherent product/service risk, the risk monitoring tools will
focus on six key triggers:
x
x
x
x
x
x
Operational Competency;
Legal/Compliance;
Technology;
Financials;
Reputation; and
Control Assessment (such as security, business continuity and privacy).
The introduction of a Mortgage Supplier Office in July 2011 facilitates governance and
monitoring of the inherent and residual risks and focuses mostly on Significant Supplier
Relationships (defined below) while enhancing the timely identification and remediation of
Supplier risks and/or performance failures. The Mortgage Supplier Office (with input from
AFI Legal staff for Legal Suppliers) will report and escalate Significant Supplier
Relationship performance issues and failures to the Mortgage Executive Leadership Team
and the appropriate Board(s). A Significant Supplier Relationship is one in which the
Supplier delivers an inherently high or medium-high risk service to AFI (“Significant
Supplier Relationship”).
The Supplier policies and applicable procedures will result in a standardized approach for
rating the inherent and residual risk of Significant Supplier Relationships and will establish
the review requirements based on the inherent and residual risk level. Review standard
minimums were established by Global Supply Chain for Medium High and High risk
suppliers and established by the Mortgage Supplier Office (and AFI Legal for Legal
Suppliers) for Low and Medium Low risk suppliers.
Confidential Treatment Requested
9
Non Legal Supplier review standard minimums:
Oversight
Scorecard
Detailed
Supplier
Review
Inherently
Low
Risk
At least
annually
At least every
18 months
Inherently
Medium-Low
Risk
At least
annually
At least
annually
Inherently
Medium-High
Risk
At least
monthly
At least
annually
Inherently
High
Risk
At least
monthly
At least every
6 months
Inherently
Medium-Low
Risk
At least
annually
At least every
9-18 months
Inherently
Medium-High
Risk
At least
monthly
At least every
6-18 months
Inherently
High
Risk
At least
monthly
At least every
6 -12 months
Legal Supplier review standard minimums:
Oversight
Scorecard
Detailed
Supplier
Review
Inherently
Low
Risk
At least
annually
At least every
9-18 months
Review standards are based on demonstrated risk management controls by the supplier. An
inherently high or medium-high risk reflects a product or service that, by its nature and
without consideration of controls and their effectiveness, exposes AFI to a significant level of
risk that requires active risk management. An inherently medium-low or low risk reflects a
product or service that, by its nature, exposes AFI to a lower level of risk that does not
require active risk management activities to address. GMACM and AFI are continuing to
coordinate with AFI’s Enterprise Risk Management group, amongst other groups, to enhance
the risk monitoring tools.
AFI’s Legal staff will govern risk management with regard to Legal Suppliers and the
Mortgage Supplier Office will govern risk management relating to other GMACM Supplier
relationships. They will accomplish Supplier risk management, performance management
and relationship management by:
x
x
x
x
Adhering to Supplier policies and procedures (including Legal Supplier policies
and procedures) that incorporate Supervisory Guidance;
Engaging operations, compliance, risk, legal and technology subject matter experts
having the requisite mortgage banking knowledge and alignment with the
GMACM and AFI strategic objectives;
Leveraging those global functions to manage risk assessments affiliated with areas
such as reputation, financial/credit, privacy, information security, physical security
and business continuity/disaster recovery; and
Communicating risks and affiliated mitigation strategies associated with
Significant Supplier Relationships to the Mortgage Executive Leadership Team,
AFI’s Global Supply Chain and the ResCap/AFI boards of directors.
Confidential Treatment Requested
10
The Mortgage Supplier Office with input from AFI Legal staff will better leverage the
Mortgage Executive Leadership Team to evaluate and communicate Significant Supplier
Relationship risks. The establishment of a mortgage Supplier discussion segment with the
Mortgage Executive Leadership Team by January 31, 2012 will provide the Mortgage
Supplier Office (with input from AFI Legal for Legal Suppliers) a forum for
communicating Supplier-related risks and initiatives. The Mortgage Supplier Office (or
AFI Legal staff with regard to Legal Suppliers) will also coordinate activities with
independent risk advisors whose responsibilities include, but are not limited to, ensuring
ongoing compliance with policies and procedures and recommending changes to adapt to
the changing environment. This quality assurance function will highlight and report on
non-compliant activities and suggest policy and procedure changes allowing for
continuous process improvements. GMACM is working with the quality assurance staff
to complete the drafting of a quality assurance workplan structure that will be
implemented by May 2012.
The enhanced oversight process remains under review and activities will be coordinated
by the AFI Legal staff for Legal Suppliers and the Mortgage Supplier Office for other
Suppliers. The enhanced oversight process will by implemented by February 2012 and
include representation from mortgage operations, risk, technology, compliance, legal and
various areas of the company as appropriate. The frequency of oversight will vary based
on the inherent risk and will evaluate/assess/review (as appropriate):
x
x
x
x
x
x
x
x
x
x
x
x
Performance;
Overall effectiveness of the Supplier relationship and the consistency of the
relationship with AFI’s strategic goals;
Compliance;
Licensing or registration status;
Financial condition;
Insurance coverage;
Business continuity and disaster recovery plans and testing;
Employee matters and training;
Customer complaints and resolution;
File management;
Accuracy of documents; and
Re-certification of Legal Suppliers.
AFI’s Legal staff began a process of developing and documenting a risk assessment
framework with respect to Legal Suppliers in February 2011. They completed the
framework on July 1, 2011, which is currently with AFI Audit staff for review, and by
6/30/12, the Legal staff will complete a review of all Legal Suppliers. This process serves
as an expansion of the Supplier assessment process and has considered applicable
Supervisory Guidance, recent experience with and issues faced by Legal Suppliers, the
current foreclosure environment and other factors, resulting in AFI Legal staff’s
development of:
Confidential Treatment Requested
11
x
x
x
x
Desktop procedures (pertaining to areas such as file review and Legal Supplier
file removal desktop procedure);
Due diligence materials (such as a Legal Supplier questionnaire, engagement
documents, and certification letter);
Oversight materials (such as interview/site visit guide, risk scorecard,
recertification letter and remediation letter); and
Change management materials (such as the Legal Supplier file removal desktop
procedure and deficiency notice).
B. Consent Order Response to Section 6b
Consent Order section 6b requires:
b) Processes to prepare contingency and business continuity plans that ensure the
continuing availability of critical third-party services and business continuity of the
Mortgage Servicing Companies, consistent with supervisory guidance of the Board of
Governors, both to address short-term and long-term service disruptions and to
ensure an orderly transition to new service providers should that become necessary;
Business Continuity is addressed by the Global Business Continuity Policy (Appendix
L). This policy has an annual review cycle and was initially approved and implemented
in March 2010. This policy establishes an ongoing process to identify the impact of
business disruptions, maintain viable recovery strategies and recovery plans, and
optimize continuity of services for Ally Financial Inc. and its direct and indirect
subsidiaries, including Lines of Business (LoBs) and Global Functions (collectively,
“Ally”). This Policy outlines minimum standards regarding the protection of critical
business processes, technology, facilities, data, and safety throughout Ally, including all
employees, contractors, third parties, and other parties representing Ally.
This Policy applies to all Ally entities, including all LoBs, Global Functions, and thirdparty service providers. This Policy covers minimum Business Continuity Planning
(BCP) requirements and standards for: Business Impact Analysis / Assessment (BIA);
Business Resumption Plans (BRPs); IT Disaster Recovery / Service Continuity Plans (IT
DR/SC); Crisis Management Plans (CMPs)/Incident Response Plans (IRP); Plan
Exercising/Testing; and BCP reporting.
This Policy and the supporting standards are designed to establish minimum BCP
practices for Ally. While this Policy incorporates many minimum practices required by
certain regulatory agencies, LoBs must adopt local practices as necessary to comply with
regulatory requirements applicable to their business that may go beyond this Policy.
The scope of this Policy is to establish:
x Enterprise-wide requirements and minimum standards addressing BCP practices
x Standard definitions and terminology for BCP activities
x Clear ownership of BCP programs at both the enterprise and LoB levels
GMACM will also utilize GSC’s existing Supplier Contingency Plan template to address
the potential need to dissolve and backfill a supplier relationship. In addition,
Confidential Treatment Requested
12
Operational Competency, Technology and Business Continuity Assessments which are
published and being implemented on 2/1/12 are part of the inherent product/service risk
assessment that address a supplier’s ability to deal with service disruptions, onboarding
and offboarding. The GSC Risk Assessment Procedure (Appendix C) documents this
Risk Assessment process.
C. Consent Order Response to Section 6c
Consent Order section 6c requires:
c) Measures to ensure that all original records transferred by the Mortgage Servicing
Companies to Third-Party Providers (including the originals of promissory notes and
mortgage documents) remain within the custody and control of the Third-Party
Provider (unless filed with the appropriate court or the loan is otherwise transferred
to another party), and are returned to the Mortgage Servicing Companies or
designated custodians at the conclusion of the performed service, along with all
other documents necessary for the Mortgage Servicing Companies’ files;
Records Management is addressed by the Global Records Management Policy (Appendix
M). This policy has an annual review cycle and was initially approved and implemented
in April 2008. This policy establishes the framework for managing all company Records
throughout their lifecycle, including creation, access, use, storage, retention, and disposal.
Compliance with this Policy will ensure satisfaction of legal and regulatory records
requirements, operational obligations, and establishes consistent and accountable company
recordkeeping practices.
This Policy applies to any and all recorded information created or received by Ally
Financial Inc. and its direct and indirect subsidiaries (collectively, Ally) in the transaction
of business or in the fulfillment of legal obligations, but excludes publicly available
generic material not unique to Ally, such as trade journals, reference and other
professional association materials. This Policy applies to recorded information regardless
of the forms, characteristics or media (e.g. electronic, paper, audio, video, flash drives,
voicemail, databases, PDAs, etc.), that are used and owned or possessed by Ally and any
subsidiaries and affiliates controlled by Ally, and all of their employees, officers,
directors, agents, contractors, and vendors.
x
x
x
x
Require records to be accessible and retrievable by designated individuals to
support operations and to meet legal obligations;
Require the Supplier to maintain documentation in the control and custody of the
Supplier, unless filed with the appropriate court, and to make documentation
available to GMACM upon request;
Require all documents to be returned to AFI at the conclusion of the performed
service or at the termination of the Supplier’s services; and
Require compliance with the Legal Supplier file removal desktop procedure when
transitioning/off-boarding Legal Suppliers.
Attached to this Program are copies of the above mentioned documents:
x Appendix M: Global Records Management Policy
Confidential Treatment Requested
13
x
x
Appendix H: Draft Mortgage Legal Supplier Management Policy
Appendix I: Draft Mortgage Legal Supplier Management Procedure
D. Consent Order Response to Section 6d
Consent Order section 6d requires:
d) Measures to ensure the accuracy of all documents filed or otherwise utilized on
behalf of the Mortgage Servicing Companies or the owners of mortgages in the
Servicing Portfolio in any judicial or non-judicial foreclosure proceeding, related
bankruptcy proceeding, or in other foreclosure-related litigation, including, but not
limited to, documentation sufficient to establish ownership of the note and right to
foreclose at the time the foreclosure action is commenced;
GMACM is designing a Mortgage Legal Supplier Management Policy and related
Mortgage Legal Supplier Management Procedure to address items such as the accuracy of
documentation. These procedures will be implemented by February 2012 and further
detail how GMACM will conduct reviews with respect to document accuracy as part of
the due diligence, oversight and governance process. The due diligence and oversight
process will include sampling a portion of the Supplier’s documents filed, or otherwise
utilized on behalf of GMACM or the owners of mortgages, in any judicial or non-judicial
foreclosure proceeding, related bankruptcy proceeding, or in other foreclosure-related
litigation. The sampling methodology is under review, but will take into account industry
practices and will adjust based on factors such as caseload and scrutiny particular to a
given jurisdiction due either to its volume of foreclosures or the complexity of its legal
requirements. Accuracy of documentation will be a component of the Legal Supplier
oversight scorecard, currently under development, which will ensure timely action with
respect to Supplier performance failures. Furthermore, the quality assurance function will
be implemented by May 2012 and provide an additional level of review by verifying the
accuracy of the figures and the information contained in the filed documents.
Attached to this Program are copies of the above mentioned draft documents:
x Appendix H: Draft Mortgage Legal Supplier Management Policy
x Appendix I: Draft Mortgage Legal Supplier Management Procedure
E. Consent Order Response to Section 6e
Consent Order Section 6e requires:
e) Processes to perform appropriate due diligence on potential and current Third-Party
Provider qualifications, expertise, capacity, reputation, complaints, information
security, document custody practices, business continuity, and financial viability; and
measures to ensure the adequacy of Third-Party Provider staffing levels, training,
work quality, and workload balance;
As mentioned in section 6A of the Program, GMACM is utilizing the GSC Supplier
Management policy and procedures to ensure compliance with Legal Requirements,
Confidential Treatment Requested
14
Investor Requirements, Supervisory Guidance, and AFI’s applicable policies and
procedures. Global Supply Chain, in partnership with the GMACM Supplier Office,
developed and published Ally Global Supplier management policy and procedures on
September 30, 2011. GMACM reevaluated their initial draft policy and procedures
submitted on 6/13/11 and made a decision to adopt the Global policy and procedures as
they covered areas previously addressed by the draft Mortgage policy and procedures as
well as provided additional governance and standards related to:
a) Responsibility of business owners and global partners
b) Due diligence and monitoring activities
c) Contracting and Sourcing activities
These documents will include the appropriate requirements necessary to evaluate Supplier
capabilities, align the product/service with AFI’s strategic objectives, identify inherent
risks, assess and monitor Supplier’s governance and risk management
practices/performance specific to criteria such as those specified in our response to section
6A of the Order. These policies and procedures will be implemented by February 1, 2012,
with GMACM addressing its Supplier due diligence by identifying, analyzing and
quantifying:
x
x
x
x
x
x
Strategic risk;
Reputation risk;
Operational risk;
Transaction risk;
Credit risk; and
Compliance risk.
The enhanced due diligence process will also involve a review of relevant information
about a potential Supplier with focus on items such as:
x
x
x
x
x
x
x
x
x
x
x
x
Audited financial statements, annual reports, SEC filings, and other available
financial indicators;
Significance of the proposed contract on the Supplier’s financial condition;
Experience and ability in implementing and monitoring the proposed activity;
Business reputation;
Certification of Legal Suppliers;
Qualifications and experience of the Supplier’s principals;
Strategies and goals, including service philosophies, quality initiatives, efficiency
improvements, and employment policies;
Existence of any significant complaints or litigation, or regulatory actions against
the Supplier;
Ability to perform the proposed functions using current systems or the need to
make additional investment;
Use of other parties or subcontractors by the Supplier;
Scope of internal controls, systems and data security, privacy protections, and
audit coverage;
Business resumption strategy and contingency plans;
Confidential Treatment Requested
15
x
x
x
x
x
x
x
Knowledge of relevant consumer protection and civil rights laws and regulations;
Adequacy of management information systems;
Insurance coverage;
Foreign based services;
Capacity, staffing levels, work quality, and training programs;
Customer complaint handling; and
Document custody practices.
Also, as mentioned in section 6A of this Program, GMACM is in the process of enhancing
its Supplier risk assessment tools to better identify risks and ensure compliance with AFI’s
policies and procedures. These risk assessment tools will be implemented by February
2012 and include items such as an inherent product/service risk assessment analysis, a
series of Supplier questionnaires, and scorecards. The risk monitoring tools will consider
Legal Requirements, Investor Requirements, Supervisory Guidance, and AFI’s applicable
requirements and the review process will better inform Legal, Compliance, Risk and IT
staff providing for a more comprehensive understanding of how their area of expertise
influences the mortgage business model.
Based on the output of the due diligence assessment, GMACM will decide if it will
proceed with the Supplier relationship based on the risk score and alignment with the AFI
strategic objectives. As mentioned in section 6A of this Program, the risk monitoring
tools will consider Legal Requirements, Investor Requirements, Supervisory Guidance,
and AFI’s applicable requirements and the review process will better inform Legal,
Compliance, Risk and IT staff providing for a more comprehensive understanding of how
their area of expertise influences the mortgage business model. To determine the level of
inherent product/service risk, the risk monitoring tools will focus on six key triggers:
x
x
x
x
x
x
Operational Competency;
Legal/Compliance;
Technology;
Financials;
Reputation; and
Control Assessment (such as security, business continuity and privacy).
An inherently high or medium-high risk score reflects a product or service that, by its
nature and without consideration of controls and their effectiveness, exposes AFI to a
significant level of risk that requires active risk management. An inherently medium-low
or low risk score reflects a product or service that, by its nature, exposes AFI to a lower
level of risk that does not require active risk management activities to address. GMACM
is continuing to coordinate with AFI’s Enterprise Risk Management group, amongst other
groups, to enhance its risk monitoring tools.
Also mentioned in section 6A, AFI’s Legal staff began a process of developing and
documenting a risk assessment framework with respect to Legal Suppliers in February
2011. They completed the framework on July 1, 2011, which is currently with AFI Audit
staff for review, and by 6/30/12, the Legal staff will complete a review of all Legal
Suppliers. This process serves as an expansion of the Supplier assessment process and has
Confidential Treatment Requested
16
considered applicable Supervisory Guidance, recent experience with and issues faced by
Legal Suppliers, and the current foreclosure environment and other factors, resulting in
AFI Legal staff’s development of:
x
x
x
x
Desktop procedures (pertaining to areas such as file review and Legal Supplier
file removal desktop procedure);
Due diligence materials (such as a Legal Supplier questionnaire, engagement
documents, and certification letter);
Oversight materials (such as interview/site visit guide, risk scorecard,
recertification letter and remediation letter); and
Change management materials (such as Legal Supplier file removal desktop
procedure and deficiency notice).
Attached to this Program are copies of the documents referred to in this section of the
Program:
x Appendix A: Global Third Party Supplier Management Policy
x
Appendix K: GSC Sourcing Procedures
x
Appendix H: Draft Mortgage Legal Supplier Management Policy
x
Appendix I: Draft Mortgage Legal Supplier Management Procedure
F. Consent Order Response to Section 6f
Consent Order Section 6f requires:
f) Processes to ensure that contracts provide for adequate oversight, including
requiring Third-Party Provider adherence to GMAC Mortgage foreclosure
processing standards, measures to enforce Third-Party Provider contractual
obligations, and processes to ensure timely action with respect to Third-Party
Provider performance failures;
As outlined in prior sections of this Program, such as section 6A, the Supplier policies and
applicable procedures that GSC has developed will be implemented by February 2012 and
will contemplate the identification and management of the inherent and residual risk of
Significant Supplier Relationships and detail how GMACM will conduct contracting.
Global Supply Chain, in partnership with the GMACM Supplier Office, developed and
published Ally Global Supplier management policy and procedures on September 30,
2011. GMACM reevaluated their initial draft policy and procedures submitted on 6/13/11
and made a decision to adopt the Global policy and procedures as they covered areas
previously addressed by the draft Mortgage policy and procedures as well as provided
additional governance and standards related to:
a) Responsibility of business owners and global partners
b) Due diligence and monitoring activities
c) Contracting and Sourcing activities
Confidential Treatment Requested
17
The GSC Contracting Procedure (Appendix G) aligns with Legal Requirements, Investor
Requirements, Supervisory Guidance and AFI’s applicable requirements. At a high level,
the contract addresses items such as:
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
Terms and termination;
Representations and warranties;
Indemnification;
Insurance;
Data protection and security;
Access and audit procedures;
Disputes;
Force majeure;
Subcontracts and assignments;
Business continuity and disaster recovery;
Governing law;
Compliance;
Ownership and license;
License agreements; and
Statement of work including:
o Description of services;
o Service level agreement;
o Oversight/scorecard reporting;
o Payment and invoicing / fee schedule;
o Policies and procedures;
o Customer complaint/issue escalation process;
o Change management plan/form;
o Pre-implementation remediation plan;
o Transfer/implementation plan; and
o Off-boarding plan.
The contract will also include details such as the:
x
x
x
x
x
x
x
x
Timeframe covered by the contract;
Frequency, format, and specifications of the service or product to be provided;
Other services to be provided by the Supplier, such as software support and
maintenance;
Training of employees, and customer service;
Requirement that the Supplier must comply with all applicable laws, regulations,
and regulatory guidance;
Authorization for AFI and the appropriate federal and state regulatory agencies to
have access to records of the Supplier as are necessary or appropriate to evaluate
compliance with laws, rules, and regulations;
Identification of which party is responsible for delivering any required customer
disclosures;
Terms related to any use of AFI’s premises, equipment, or employees;
Confidential Treatment Requested
18
x
x
x
x
x
Permissibility/prohibition of the Supplier to subcontract or use another party to
meet its obligations with respect to the contract, and any notice/approval
requirements;
Authorization for GMACM to monitor and periodically review the Supplier for
compliance with its agreement;
Fees structure;
Accuracy of documentation requirements; and
Use of foreign-based Suppliers.
Should supplier gaps and/or performance failures occur, it is expected that GMACM will
work with the Supplier to develop a remediation plan to resolve the issue. In the event that
timely resolution of an issue cannot be reached GMACM will utilize the GSC Supplier Issue
Escalation Procedure (Appendix D).
As mentioned in section 6A of this Program, the Mortgage Supplier Office (with input from
AFI Legal staff for Legal Suppliers) will inform the Mortgage Executive Leadership Team of
Significant Supplier Relationships prior to engaging in or renewing Supplier contracts as a
measure to improve the governance process. An analysis/review of a proposed or existing
Significant Supplier Relationship will accompany such notification to the Mortgage
Executive Leadership Team and, as appropriate, information will be shared with the
appropriate Board(s).
Attached to this Program are copies of the documents referred to in this section of the
Program:
x Appendix A: Global Third Party Supplier Management Policy
x Appendix G: GSC Contracting Procedures
x Appendix D: GSC Supplier Issue Escalation Procedure
x Appendix F: GSC SMO Oversight Procedure
x Appendix H: Draft Mortgage Legal Supplier Management Policy
x Appendix I: Draft Mortgage Legal Supplier Management Procedure
G. Consent Order Response to Section 6g
Consent Order Section 6g requires:
g) Processes to ensure periodic reviews of Third-Party Provider work for timeliness,
competence, completeness, and compliance with all applicable Legal Requirements,
and GMAC Mortgage’s contractual obligations to GSEs and investors, and to ensure
that foreclosures are conducted in a safe and sound manner;
As discussed in previous sections of this Program, such as section 6A, GMACM is
utilizing the GSC Supplier policy and procedures, risk monitoring tools, a quality
assurance function and administrative features to improve the Supplier management
process. The procedures will detail how GMACM will conduct its oversight, due
diligence and contracting, as well as the quality assurance workplan. The GSC Supplier
Management Office Oversight (SMO) Procedure (Appendix F) will further enable an
effective end-to-end Supplier management process. The February 2012 implementation
Confidential Treatment Requested
19
plan includes the policy, procedures and risk monitoring tools. The Supplier quality
assurance process will follow when implemented by May 2012.
GSC’s Supplier management process will evaluate the Program’s effectiveness and
coordinate with quality assurance to execute a quality assurance workplan. Mortgage
Operations will execute the quality assurance workplan against GSC’s Supplier
management process and associated policy and procedures. The GSC Supplier
management process will consider responsibilities such as:
x
x
x
x
x
x
x
x
x
x
Maintaining business continuity and contingency plans to ensure continuing
availability of critical Supplier services and business continuity of GMACM
operations to include both short-term and long-term service disruptions as well as
orderly transition to new service providers;
Confirming that all original records transferred to a Supplier remains within the
custody and control of the Supplier and that all original records are returned to
GMACM or its designated custodians at the conclusion of the performed service;
Ensuring the accuracy of all documents filed or utilized on behalf of GMACM as
related to the servicing portfolio is sufficient to establish ownership of the note and
the right to foreclosure at the time the foreclosure action is commenced and filing
of proof of claim for bankruptcy;
Ensuring appropriate level of due diligence is performed on potential and current
Supplier(s);
Assessing the adequacy of Supplier's staffing levels, training, work quality and
workload balance;
Assessing that Supplier is in compliance with contractual obligations and
supervisory guidance of the Board of Governors;
Assessing processes to confirm that timely action is taken with respect to Supplier
performance failures;
Assessing Supplier’s process for reporting and resolving customer complaints
related to Supplier services;
Maintaining fee structures for Suppliers to ensure that the method of compensation
considers accuracy, completeness, and compliance; and
Ensuring Legal Suppliers maintain the appropriate certifications and
recertification.
Also mentioned in sections 6A and 6E of this Program, AFI’s Legal staff began a process
of developing and documenting a risk assessment framework with respect to Legal
Suppliers in February 2011. They completed the framework on July 1, 2011, which is
currently with AFI Audit staff for review, and by 6/30/12, the Legal staff will complete a
review of all Legal Suppliers. This process serves as an expansion of the Supplier
assessment process and has considered applicable Supervisory Guidance, recent
experience with and issues faced by Legal Suppliers, the current foreclosure environment
and other factors, resulting in AFI Legal staff’s development of:
x
Desktop procedures (pertaining to areas such as file review and Legal Supplier
file removal desktop procedure);
Confidential Treatment Requested
20
x
x
x
Due diligence materials (such as a Legal Supplier questionnaire, engagement
documents, and certification letter);
Oversight materials (such as interview/site visit guide, risk scorecard,
recertification letter and remediation letter); and
Change management materials (such as Legal Supplier file removal desktop
procedure and deficiency notice).
The GSC Supplier Management Office (SMO) Oversight Procedure (Appendix F) defines
the SMO Oversight function that will perform oversight of key stake holders within the
Lines of Business and Global Supply Chain to ensure high risk suppliers are managed to
Global Supply Chain programs, policies and procedures. The SMO Oversight function
will monitor that all stakeholders critical to the risk management of High Risk Suppliers
are acting in accordance with risk management standards and procedures for High Risk
Suppliers. The SMO Oversight will specifically liaison with ORM Quality Assurance,
GSC Operations, GSC Sourcing, Compliance, and Audit Services to support inquiry and
risk management effectiveness programs. The objectives of the Oversight will be to:
x
x
x
Ensure the Operational Effectiveness of the enterprise Supplier Risk Management
Program
Ensure key stakeholders are in compliance with the standards and procedure,
including subsequent changes, for High Risk Suppliers
Support the simplification of the supplier risk management process to help its
adoption, regular use, and sustainability across the global enterprise.
The Mortgage Supplier Office is working with GMACM lines of business to complete
drafting of the quality assurance workplan for Suppliers and will implement the workplan
by May 2012. They will perform ongoing quality assurance reviews of the Supplier
management process and its alignment with required policies and associated procedures.
GSC will also ensure that effective controls are in place to identify, document, and
mitigate the risks arising from sourcing to and ongoing monitoring of Suppliers. The
quality assurance findings will be shared with GMACM and executive management and
will include action plans, as appropriate, to document issues for immediate response. The
Mortgage Supplier Office (and AFI’s Legal staff for Legal Suppliers) will coordinate all
responses to the action plans (inclusive of remediation plans). AFI’s Audit team will
perform an additional level of review as part of its audit responsibilities.
H. Consent Order Response to Section 6h
Consent Order Section 6h requires:
h) Processes to review customer complaints about Third-Party Provider services;
GMACM is utilizing the GSC policy and procedures for Supplier management that will
further detail Supplier complaint management and resolution as part of the due diligence,
contracting, oversight and governance processes. Global Supply Chain, in partnership
with the GMACM Supplier Office, developed and published Ally Global Supplier
management policy and procedures on September 30, 2011. GMACM reevaluated their
initial draft policy and procedures submitted on 6/13/11 and made a decision to adopt the
Confidential Treatment Requested
21
Global policy and procedures as they covered areas previously addressed by the draft
Mortgage policy and procedures as well as provided additional governance and standards
related to:
a) Responsibility of business owners and global partners
b) Due diligence and monitoring activities
c) Contracting and Sourcing activities
The GSC Supplier Issue Escalation Procedure (Appendix D) will be implemented by
February 2012 and include requirements such as having the contract’s statement of work
detail proper management of customer complaint/issue escalation process requirements.
The requirements will address how customer complaints against the Supplier will be
evaluated by GMACM and then escalated up to the AFI organization, when appropriate,
to ensure timely action to remediate the complaint. Not all Suppliers interact with
GMACM’s customers, so customer complaint-related matters will only apply to Suppliers
interacting with GMACM’s customers.
I. Consent Order Response to Section 6i
Consent Order Section 6i requires:
i) A review of fee structures for Third-Party Providers to ensure that the method of
compensation considers the accuracy, completeness, and legal compliance of
foreclosure filings and is not based solely on increased foreclosure volume or
meeting processing timelines;
GMACM is currently drafting policies and procedures related to Supplier management
and they will contemplate Supplier fee structure as part of the contracting and oversight
processes. The policy and procedures associated with the fee management process will be
implemented by February 2012 and will take into account requirements such as ensuring
that the contract addresses a fee structure promoting accuracy, completeness, and meeting
GMACM’s performance expectations, and is not based solely on increased volume of
service and/or meeting processing timelines. The fee structure will consider the quality of
services provided and/or the unusual nature or level of sophistication required in the
product/service provided by the Supplier. The nature of the fee structures will be
contingent upon investor and regulatory/legal requirements.
J. Consent Order Response to Section 6j
Consent Order Section 6j requires:
j) A periodic certification process for Legal Suppliers (and recertification of existing
Legal Supplier providers) that provide residential mortgage foreclosure and
bankruptcy services for the Mortgage Servicing Companies as qualified to serve as
Third-Party Providers to the Mortgage Servicing Companies, including that
attorneys are licensed to practice in the relevant jurisdiction and have the experience
and competence necessary to perform the services requested.
Confidential Treatment Requested
22
The Legal Supplier policy and procedures currently being drafted by the AFI Legal staff
will detail how GMACM will conduct its Legal Supplier certification and recertification
process during due diligence and oversight activities. The initial certification process will
occur after the due diligence process, while the re-certification process will coincide with
oversight responsibilities on an annual basis, or more frequently based on the inherent risk
of the Legal Supplier. The certification and re-certification processes will evaluate results
associated with licensure, competence, completeness, and compliance (such as with
applicable Legal Requirements and AFI’s contractual obligations to Government
Sponsored Entities and investors, and AFI’s performance expectations of its Legal
Suppliers). The Legal Supplier certification and recertification requirements will be
implemented by February 2012 with the rollout of the Legal Supplier policy and
procedures. Copies of the draft Legal Supplier policy and procedure documents are
attached to this Program as Appendix H and I.
Summary / Conclusion
GMACM is performing a Supplier management review and is developing remedial actions to
improve the due diligence, contracting, governance, and oversight of Suppliers throughout
GMACM’s servicing operation. GMACM is utilizing the GSC Supplier policy, procedures, a
quality assurance workplan, and risk monitoring tools and framework, all of which will
further improve internal controls and enhance and standardize the identification and
mitigation of risks specific to GMACM’s Suppliers. GMACM, consistent with practices for
other established policies and procedures, will periodically review and revise its Supplier
management documents as appropriate based upon changes to the operational execution of
certain Supplier-related tasks.
Unless noted otherwise, the timelines expressed throughout this Program relate to new
Supplier relationships. GMACM will need to conduct a review of the existing Supplier
relationships to risk rank each Supplier, identify which Supplier relationships to terminate
and/or consolidate and, with the remaining Supplier relationships, begin actions such as:
x
x
x
Renegotiating the existing contracts to reflect new contractual obligations (which may
require that the Supplier participates in the new due diligence process);
Expanding the oversight and change management capabilities; and
Instituting the newly developed quality assurance process with Significant Supplier
Relationships.
GMACM is in the process of prioritizing its Supplier management actions and timelines to
allow for:
x
x
x
x
x
x
Evaluating the Supplier strategy;
Developing and documenting a Legal Supplier risk assessment and quality control
framework;
Implementing the Mortgage Supplier Office;
Developing an appropriate Supplier management staffing plan;
Developing and implementing Supplier risk assessment tools;
Drafting and implementing Supplier policies, procedures, quality assurance workplan
and business contingency and continuity plan;
Confidential Treatment Requested
23
x
x
x
Completing the evaluation of existing Supplier relationships;
Implementing off-boarding and/or transitioning of non performing/non strategic
Suppliers; and
Negotiating the Supplier contracts existing prior to the roll-out of the new Supplier
strategy.
Given the above prioritization, GMACM will implement its new Supplier management
process by February 2012. GMACM will work with Suppliers to address any gaps required
as part of the policy, procedures and adherence to the risk monitoring tools. As a last resort,
GMACM will initiate the process of re-negotiating the current Supplier contract. Some
Suppliers may be unwilling to negotiate their contracts or accept all of the material changes
we request. In these cases, GMACM either will terminate the relationship or add the new
requirements as these contracts expire or come up for renewal.
Confidential Treatment Requested
24
Appendix I – Project Summaries
Below is a summary of the projects that support the Program:
Action Plans:
1. Implement a risk framework
2. Implement the policies and procedures
3. Complete an Assessment of the Legal Suppliers
4. Complete an Assessment of Non-Legal Suppliers
Supplier Policy, Procedure and Contingency Plan Documents:
Appendix A: Global Third Party Supplier Management Policy
Appendix B: GSC Exception Procedure
Appendix C: GSC Risk Assessment Procedure
Appendix D: GSCSupplier Issue Escalation Procedure
Appendix E: GSC Managing-Monitoring-Reporting Procedure
Appendix F: GSC SMO Oversight Procedure
Appendix G: GSC Contracting Procedures
Appendix H: Draft Mortgage Legal Supplier Management Policy
Appendix I: Draft Mortgage Legal Supplier Management Procedure
Appendix J: GSC Offboarding Procedure
Appendix K: GSC Sourcing Procedures
Global Policy Documents
Appendix L: Global Business Continuity Policy
Appendix M: Global Records Management Policy
Confidential Treatment Requested
25
Appendix II - Board Level Deliverables and Due Dates
NA
Appendix III - First Level Project Details
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
Legal Supplier
Quality
Control
Framework
Mortgage
Supplier Office
Multiple
Fully develop and document a risk
assessment and quality control
framework in respect of Legal Suppliers
Legal
2/01/11
7/01/11
Multiple
Establish the Mortgage Supplier Office
5/01/11
7/15/11
Supplier
Process
Review
Process
Review
Multiple
5/01/11
11/01/11
5/01/11
11/01/11
Mortgage
Operations
Council
Multiple
Review appropriate Supplier
management requirements and
associated staffing
Conduct a review of servicing’s
oversight process and associated staffing
plan
Implement the review of Supplier
relationships with the Mortgage
Executive Leadership Team
7/01/11
1/31/12
Risk
Monitoring
Tools
Multiple
Develop enhanced risk monitoring tools
6/01/11
12/01/11
Training
Multiple
7/01/11
12/01/11
Staffing Plan
Multiple
6/01/11
2/01/12
Risk
Monitoring
Tools
Multiple
Develop Supplier management training
materials
Implement staffing plans for sourcing,
contracting and oversight initiatives
Implement enhanced risk monitoring
tools
12/01/11
2/01/12
Risk Staffing
Plan
Multiple
7/01/11
2/01/12
Training
Multiple
Mortgage
Supplier
Office
Mortgage
Supplier
Office
Mortgage
Supplier
Office
Mortgage
Supplier
Office and
Legal
Mortgage
Supplier
Office,
Legal,
GSC
Training,
GSC
GSC,
Legal
GSC,
Mortgage
Supplier
Office,
Legal
Mortgage
Supplier
Office
GSC
12/01/11
2/01/12
Supplier
Contract
6f
7/01/11
2/01/12
Policy
Multiple
Global
Supply
Chain,
Legal
GSC
4/15/11
2/01/12
Procedures
Multiple
GSC
4/15/11
2/01/12
Multiple
Implement risk-related staffing plan and
associated training for quality assurance
functions
Implement training program associated
with GSC Supplier Management policy
and procedures
Implement the new Supplier contract(s)
for future use
Finish drafting and implement the
Global Third Party Supplier
Management Policy
Finish drafting and implement the GSC
Supplier Management procedures
Confidential Treatment Requested
26
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
Legal Supplier
Policy/
Procedure
Multiple
Legal
5/01/11
2/01/12
Communicate
Policy &
Procedure
Changes
Quality
Assurance
Training
Multiple
Finish drafting and implement the
Mortgage Legal Supplier Management
Policy and related Mortgage Legal
Supplier Management Procedure
Implement the process for
communicating AFI policy and
procedure changes to Suppliers
8/01/11
2/01/12
Multiple
Implement the quality assurance training
program
7/15/11
5/01/12
Quality
Assurance
Workplan
Legal Supplier
Assessment
Existing nonLegal Supplier
Relationships
Multiple
Finish drafting and implement the
quality assurance workplan
5/01/11
5/01/12
Multiple
Complete an assessment of existing
Legal Suppliers
Begin enhanced review of existing nonLegal Supplier relationships to
determine the newly defined risk level,
Supplier relationships to
terminate/consolidate and begin
renegotiating existing contracts and
enacting revised policies, procedures and
plans against these existing Supplier
relationships
Mortgage
Supplier
Office and
Legal
Mortgage
Supplier
Office,
LoB
Mortgage
Supplier
Office
Legal
4/01/11
6/30/12
Mortgage
Supplier
Office and
Legal
8/1/11
12/1/13
Confidential Treatment Requested
27
ALLY FINANCIAL INC.
Ally Financial Enterprise Compliance Program
Prepared for the Board of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
July 13, 2011
1
Confidential Treatment Requested
Table of Contents
Plan Overview for Enterprise Compliance Program……………………………………....3
Background…………………………………………………………………………………...4
Global Compliance & Regulatory Affairs………………………………………………….4
Principles Guiding this Plan………………………………………………………………....6
Evaluation of ECP Oversight Effectiveness………………………………………………...6
Appendix I - Project Summaries…………………………………………………………….8
Appendix II - Board Level Deliverables and Due Dates……………………………….…15
Appendix III - First Level Project Details………….. …………………………………….16
Appendix IV – Detailed Descriptions of CoE and Evaluation Results…………………..23
2
Confidential Treatment Requested
Plan Overview for Enterprise Compliance Program
This Plan for enhancement of the Enterprise Compliance Program (“ECP”) is established in
response to Section 7 of the Consent Order dated April 13, 2011 (the “Order”) among the
Board of Governors of the Federal Reserve System (the “FRB”), the Federal Deposit
Insurance Corporation (the “FDIC”), Ally Bank (the “Bank”), Ally Financial Inc. (“Ally
Financial” or “AFI”), and certain of Ally Financial’s direct and indirect subsidiaries including
Residential Capital, LLC (“ResCap”) and GMAC Mortgage, LLC (“GMACM”) and together
with ResCap, the "Mortgage Servicing Companies".
Accordingly, this Plan sets forth actions and responsibilities necessary for Ally Financial,
specific to the oversight responsibilities and expectations described in the ECP, to comply
fully with its obligations under Section 7 of the Order. The response to Section 8 of the
Order specifically addresses a plan to enhance the Mortgage Compliance Program and
provides more specific details on the plan and timeline to implement that program with
respect to the operations of residential mortgage loan servicing, Loss Mitigation, and
foreclosure.
Section 7 of the Order requires the following:
Within 60 days of this Order, Ally Financial shall submit to the Reserve Bank an acceptable
written plan to enhance its enterprise-wide compliance program (“ECP”) with respect to its
oversight of residential mortgage loan servicing, Loss Mitigation, and foreclosure activities
and operations. The plan shall be based on an evaluation of the effectiveness of Ally
Financial’s current ECP in the areas of residential mortgage loan servicing, Loss Mitigation,
and foreclosure activities and operations, and recommendations to strengthen the ECP in
these areas. The plan shall, at a minimum, be designed to:
(a) ensure that the fundamental elements of the ECP and any enhancements or revisions
thereto, including a comprehensive annual risk assessment, encompass residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities;
(b) ensure compliance with the Legal Requirements and supervisory guidance of the
Board of Governors; and
(c) ensure that policies, procedures, and processes are updated on an ongoing basis as
necessary to incorporate new or changes to the Legal Requirements and supervisory
guidance of the Board of Governors.
While section 7a of the Order refers to the “fundamental elements of the ECP,” Ally
Financial views the program components referred to in sections 7b and 7c as integral factors
of section 7a. As a result, one Plan has been developed to address all components of Section
7 of the Order.
3
Confidential Treatment Requested
Background
Ally Financial became a bank holding company on December 24, 2008. Based on its new
status, throughout 2009 and 2010, Ally Financial took steps to address supervisory
expectations related to compliance risk management, including, but not limited to:
(1) establishing a firm-wide approach to compliance risk management and oversight
that includes a corporate compliance function with a separate reporting line
independent from Lines of Business and global functions; and
(2) designing a firm-wide compliance risk management framework to manage
compliance risk across the organization, both within and across business lines,
support units, legal entities, and jurisdictions of operation.
Ally Financial’s compliance organization, Global Compliance & Regulatory Affairs
(“GCRA”) developed a multi-generational roadmap to achieve a compliance program aligned
to bank holding company compliance standards and to meet supervisory expectations:
Global Compliance & Regulatory Affairs
Global Compliance & Regulatory Affairs, led by the Ally Financial Inc. Chief Compliance
Officer (“CCO”), is a global function responsible for driving Ally Financial’s enterprise-wide
culture of compliance with laws, regulations, compliance policies and the highest ethical
standards while meeting the expectations of regulators and other stakeholders. GCRA is
comprised of two groups of compliance professionals working together to achieve effective
oversight and management of compliance risk across Ally Financial: (1) Enterprise
Compliance Program Management team (“Enterprise Compliance”); and (2) LoB & Global
Function Compliance Officers and their staff (“LoB Compliance”). Both of these groups
within GCRA are independent of the businesses and the functions they support.
4
Confidential Treatment Requested
As the first line of defense, LoB management is accountable for all compliance risks in their
business unit, both existing and emerging. In the second line of defense, LoB Compliance,
acting independently, works with business units to identify, assess and develop solutions to
mitigate or manage risks. Enterprise Compliance established the ECP to provide oversight,
support and guidance for LoB Compliance Programs addressing the following:
(1) Compliance policies and procedures
(2) Independent risk-based compliance assessments
(3) Compliance training programs
(4) Regulatory exam management and issues management
(5) Monitoring, testing and reporting activities
(6) Managing the compliance impacts of applicable new laws and regulations and/or
changes to existing laws and regulations.
To implement the ECP, beginning in 2011, Enterprise Compliance established and staffed six
Centers of Excellence (“CoE”):
A. Enterprise Compliance Programs, Policies and Governance (“Governance CoE”)
B. Compliance Risk Assessments
C. Enterprise Compliance Training
D. Regulatory Exam and Issues Management
E. Enterprise Monitoring Testing & Reporting (“EMTR CoE”)
F. Regulatory Change Management
5
Confidential Treatment Requested
For detailed descriptions for each COE and related areas for improvement, refer to Appendix
IV.
Principles Guiding this Plan
The cornerstone of the ECP and this enhancement Plan is grounded in the supervisory
guidance entitled “Compliance Risk Management Programs and Oversight at Large Banking
Organizations with Complex Compliance Profiles” dated October 16, 2008 (“SR 08-08”).
Specifically, the four key areas included in the guidance are:
(1) Firm-wide approach to compliance risk management/oversight;
(2) Independence of compliance staff;
(3) Sound practices for compliance monitoring and testing; and
(4) Responsibility of Board and senior management for risk management and
oversight.
Ally Financial has taken steps to design its ECP and compliance organization to reflect the
principles of this guidance.
Evaluation of ECP Oversight Effectiveness
In response to the Order, GCRA engaged Ernst & Young LLP (“E & Y”) to support the
evaluation of the effectiveness of Ally Financial’s current ECP oversight role related to the
Mortgage Compliance Program for residential mortgage loan servicing, loss mitigation, and
foreclosure activities and operations. Specifically, the scope of the evaluation included the
following areas: policies, procedures, governance, compliance training, compliance risk
assessments, monitoring, testing, reporting, including senior management and board
reporting, regulatory exam management, regulatory change management, and issues
management. The evaluation included a review of existing regulatory examination findings,
applicable internal audit findings, and twelve interviews with six functions over a period of
three weeks, including those responsible for the Program Management function, the recently
created Centers of Excellence (“CoEs”), and senior compliance executives.
6
Confidential Treatment Requested
7
Confidential Treatment Requested
Twenty one project summaries and detailed actions plans with tasks, responsible parties,
timelines and deliverables
are included in
Appendices I, II and III, respectively.
Appendix I - Project Summaries
Below is a summary of the projects that comprise our plan to strengthen the Enterprise
Compliance Program as it pertains to residential mortgage servicing, loss mitigation and
foreclosure activities and operations.
A. Enterprise Compliance Programs, Policies and Governance Action Plans:
1. Enhancements to ECP documentation
Accordingly, the Governance CoE will update the Global Compliance Policy to
frame the overall mandate of the ECP, specifically to drive a consistent and unified approach
to compliance across Ally Financial’s operations. The ECP will also be formalized in a
program document (“ECP Document”) that will describe the global compliance
organizational structure (CoE and governance), roles and responsibilities and reporting lines.
The ECP Document will also feature Ally Financial’s vision of how to manage the ECP,
including oversight, coordination, issue escalation protocols and reporting. Lastly, each CoE
will have procedural documentation that further defines the responsibilities and functions of
the CoE, including standards and requirements for the escalation of issues. The ECP will
establish a formal process to establish and support effective two-way communication
channels between the Enterprise Compliance, LoB Compliance and LoB management
including formal reporting of results and escalation of issues to senior management and
Board or Board Committees. This tiered documentation will illustrate Ally Financial’s
commitment to a cohesive ECP and to effective compliance reporting. Moreover, the process
of documenting ECP and CoE policies and procedures will ensure the thoughtful design and
execution of all roles and responsibilities within Ally Financial’s compliance structure.
Additionally, this documentation will be used by ECP, LoB Compliance, and other LoB staff
as a reference tool that clearly states the delineated responsibilities of each party. The project
will be led by the Governance CoE process owner. An enhanced ECP Document, an
updated Global Compliance Policy and CoE procedural documentation will be published by
October 1, 2011.
2. Enhancements to Communication Plan
convey ECP requirements
The communication plan will also
8
Confidential Treatment Requested
include guidance on compliance governance structures to support regular communication of
compliance matters. The project will be led by the Governance CoE process owner. The
communication plan will be designed by October 1, 2011.
3. Complete inventory of all LoB compliance policies
The Governance CoE will work with LoB
Compliance to create and maintain a complete inventory of LoB compliance policies.
Specifically, the Governance CoE will finalize its compilation of a comprehensive list of all
LoB compliance policies, particularly those related to residential mortgage loan servicing,
loss mitigation, and foreclosure activities and operations. In addition, roles and
responsibilities between the Governance CoE, LoB Compliance and LoB management
related to the maintenance of the compliance policy inventory will be defined and included in
the ECP Document. The project will be led by the Governance CoE process owner. The
inventory of LoB compliance policies will be compiled by October 1, 2011.
4. Enhancements to Enterprise Compliance oversight of LoB compliance policy
approval, review, communication and reporting processes
Specifically, Ally Financial will define roles and responsibilities
between Enterprise Compliance and LoB Compliance related to these processes and will
formally communicate to all stakeholders. Additionally, the Governance CoE will work with
LoB Compliance to establish reporting requirements so Enterprise Compliance will have
adequate oversight into actions taken such as the review, writing, approval and amendments
to LoB compliance policies. Reporting requirements will, at a minimum, include reporting
frequency, responsible parties, and actions taken. The project will be led by Governance CoE
process owner. Updated compliance policy review processes and reporting templates will be
instituted by October 1, 2011.
5. Enhancements to Board Reporting – Compliance Staffing
Reporting will be developed and reviewed at least annually with the Board(s)/Board9
Confidential Treatment Requested
designated Committee(s) that will include information sufficient to enable the evaluation of
the adequacy of compliance staff qualifications and compliance staffing levels. Board
reporting content and frequency will be defined and included in the ECP Document. This
project, which will be completed in accordance with the requirements in Section 2 of the
Order, will be led by the Governance CoE process owner. The first annual report on staffing
will be provided to the Board(s)/Board-designated Committees by January 1, 2012.
B. Compliance Risk Assessments Action Plans:
6. Use of compliance risk assessment results in identification of areas of critical focus
(e.g. compliance training, compliance testing) and compliance resource allocation
The CoE will develop and formalize a process to identify issues
impacting multiple LoBs, for analysis and consolidation of these issues, and for
dissemination of the results to relevant stakeholders. This will include identification of
appropriate stakeholders and the development of a results report. The project will be led by
the Compliance Risk Assessments CoE process owner. A compliance risk assessment results
report template will be developed by October 1, 2011 and will be effective for the results of
the 2011 annual Compliance Risk Assessment cycle.
7. Identification of trigger events that would result in compliance risk reassessment
The CoE will identify triggers that would lead to reassessment of compliance risks
based on events occurring subsequent to the last annual assessment process and develop a
formalized process outlining timing and incorporation of the compliance risk reassessment
results to compliance training, compliance policies, and EMTR/LoB MTR and compliance
reporting. This will be performed in conjunction with enhancements to the Compliance Risk
Assessment process to ensure the same processes are followed to disseminate compliance
risk assessment results to the appropriate CoE (Enterprise Compliance Training, EMTR,
etc.). The project will be led by the Compliance Risk Assessments CoE process owner.
Updated compliance risk assessment procedures will be published by September 1, 2011 and
will be effective for the launch of the 2011 annual Compliance Risk Assessment cycle.
8. Inclusion of state laws in compliance risk assessments
The CoE will expand the regulatory applicability matrix (RAM) to include
relevant state laws and regulations as identified and risk-rated by Legal which will allow
management to have a complete view of risk, resulting in a more robust assessment process.
10
Confidential Treatment Requested
The RAM update portion of this project will be led by the Compliance Risk Assessments
CoE process owner. The RAM will be updated by September 1, 2011.
C. Enterprise Compliance Training Action Plans:
9. Enhancements to core and line of business curriculum development
Specifically, the CoE will define roles
and responsibilities between the Enterprise Compliance, LoB Compliance, LoB training
resources, Human Resources and Legal in connection with the development of core
Enterprise Compliance and LoB compliance training curriculum and will formally
communicate the agreed upon roles and responsibilities to all applicable stakeholders.
Additionally, the CoE will establish a process by which LoB compliance curriculum is
customized to job families, establish monthly LoB Compliance training reporting
requirements related to training curriculum development, and monitor these reports. The ECP
Document will be updated to include agreed upon roles and responsibilities, process for
compliance curriculum customization, and LoB compliance training reporting requirements,
a list of courses in the LoB Compliance curriculum will be maintained by the CoE and will
be communicated to all stakeholders no less than quarterly. The project will be led by the
Enterprise Compliance Training CoE process owners. Curriculum development processes
and templates will be implemented by January 1, 2012.
10. Enhancements to identification and tracking of training participants
Specifically, the CoE will define and communicate the roles and responsibilities of Enterprise
Compliance and LoB Compliance in connection with identification and tracking of
compliance training participants. Upon establishing roles and responsibilities, Ally Financial
will formalize the process by which compliance training participants will be identified and
tracked. Tracking will be accomplished through the Ally Financial Inc. Learning
Management System tool, through which Enterprise Compliance training will be delivered to
participants. This will also enable effective implementation of Ally Financial’s escalation
process for non-compliance with compliance training requirements. The project will be led
by the Enterprise Compliance Training CoE process owners. Processes to track training
participants will be implemented by January 1, 2012.
11. Development of an escalation process for non-compliance with training
requirements
Ally Financial’s Human Resources will first establish an
Enterprise Training Policy which will set standards for relevant authority, accountability,
approvals, escalations and reporting in connection with enterprise training. This policy will
11
Confidential Treatment Requested
be published in 3Q 2011. Upon establishment of such standards, the Enterprise Compliance
Training CoE will define, clarify and communicate roles and responsibilities in connection
with an escalation process for non-compliance with compliance training, and update the ECP
Document as necessary. The compliance-related aspect of this project will be led by the
Enterprise Compliance Training CoE process owners. Training policies and procedures will
be published by November 1, 2011.
12. Enhancements to enterprise compliance training Needs Assessment
Specifically, the CoE will take steps to
define and communicate the roles and responsibilities between Enterprise Compliance and
LoB Compliance as it relates to the annual compliance training needs assessment process.
The CoE will enhance the current process by formally considering factors such as the latest
risk assessment results, changes in laws and regulations, supervisory guidance, examination
issues, and the latest testing results, including internal audit findings. This process will be
formalized through the use of a template. The project will be led by the Enterprise
Compliance Training CoE process owners. Needs Assessment templates will be developed
and deployed by the CoE by January 1, 2012 for training to be delivered in 2012.
13. Enhancements to enterprise compliance training effectiveness assessment
Specifically, the CoE will define and communicate the
roles and responsibilities between Enterprise Compliance and LoB Compliance as it relates to
compliance training effectiveness assessment process. The CoE will enhance the current
process by incorporating the assessment results to core compliance curriculum and LoB
Compliance curriculum development process. The project will be led by the Enterprise
Compliance Training CoE process owners. Training effectiveness procedures will be
implemented by November 1, 2011.
D. Regulatory Exam and Issues Management Action Plans:
14. Clarification of roles and responsibilities of Enterprise Compliance and LoB
Compliance with respect to Regulatory Exam and Issues Management
The CoE
will define these roles and responsibilities and formally communicate them through
compliance governance routines. This project will be led by the Regulatory Exam and Issues
Management CoE process owner. This project will be completed by August 1, 2011.
12
Confidential Treatment Requested
15. Enhancements to Board Reporting – Compliance Issues Reporting
The CoE will assess current compliance issues reporting and develop a plan
for enhancing the reporting of compliance issues and key metrics including the institution of
a standardized reporting template. This project will be led by the Regulatory Exam and
Issues Management CoE process owner. The assessment and plan will be completed by
October 1, 2011. Enhanced reporting will be provided to the Board(s)/Board-designated
Committee(s) by January 1, 2012.
E. Enterprise Monitoring, Testing and Reporting Action Plans:
16. Development of EMTR policy and procedures to support the EMTR framework
The EMTR CoE will establish and document baseline procedures for testing
processes, including determination of test planning and scoping, EMTR field work, EMTR
reporting, EMTR post-test, and EMTR record retention, which will become the standard for
LoB MTR procedures and processes. The project will be led by the EMTR CoE process
owner. EMTR policy and procedures will be documented by October 1, 2011.
17. Development of consolidated (EMTR and LoB MTR) annual testing schedule
To enhance enterprise oversight of LoB MTR, the EMTR CoE will establish a
process for development of an annual testing schedule. The schedule will include both
enterprise testing to be conducted by the EMTR team and compliance testing to be conducted
by LoB Compliance teams. A combined schedule will address the need for compliance
testing of high risk laws and regulations. The development of the annual schedule will be led
by the EMTR CoE process owner. The consolidated annual testing schedule process will be
implemented by October 1, 2011.
18. Implementation of EMTR monitoring plan and enhancements to reporting of
actionable monitoring metrics
The
CoE and LoB Compliance will define roles and responsibilities related to enterprise and LoB
Compliance monitoring, and will update the ECP Document accordingly. The EMTR CoE
will continue to require consistent completion of standardized monitoring documentation by
LoB Compliance, which will include results of LoB Compliance monitoring activities. This
13
Confidential Treatment Requested
standardized compliance monitoring documentation was implemented in early 2011.
standardized template is included as Appendix V.
This
Additionally, common metrics to monitor and report on compliance matters across the
enterprise are being developed. Once these common metrics have been identified and
standardized reporting on them is instituted, the EMTR CoE will monitor these targeted
compliance metrics across the enterprise. This is a multi-phased project and Ally Financial is
currently in the first phase, which will include residential mortgage loan servicing, loss
mitigation, and foreclosure activities and operations. The project will be led by the EMTR
CoE process owner. Phase 1 monitoring will be implemented by October 1, 2011.
19. Implementation of EMTR testing
The EMTR CoE and LoB
Compliance will further define roles and responsibilities related to enterprise testing and LoB
testing, and update the ECP Document accordingly. The EMTR CoE has selected key laws
and regulations to test across the enterprise including HMDA, UDAP, Regulation B,
Regulation Z and FCRA. The CoE has developed a schedule for comprehensive end-to-end
testing of this selected subset of regulations. The criteria for the initial selection of key laws
and regulations included: LoB Compliance input, regulatory exam findings, potential for
reputational risk, Legal risk ratings, Audit Services input, and emerging legislation. The
EMTR CoE is in the first phase of a multi-phased plan. In later phases, EMTR will expand
the keys laws and regulations upon which enterprise testing will be conducted. The EMTR
CoE will develop testing requirements and begin implementation of testing in June 2011. As
testing is implemented, the EMTR CoE will establish scheduled aggregated reporting,
including test results, copies of which will be sent to LoB management, GCRA, senior
management and others as appropriate. The project will be led by the EMTR CoE process
owner. Initial test results will be available October 1, 2011.
F. Regulatory Change Management Action Plans:
20. Enhancements to regulatory change management oversight of residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities and operations
Currently Mortgage Compliance has established regular meeting
routines to review new laws or updates to existing laws which include representatives from
Mortgage Compliance, Legal and Mortgage LoB. To strengthen the link between these
groups and the Regulatory Change Management CoE, Mortgage LoB Compliance will
expand the attendance for these meetings to include a representative from the Regulatory
Change Management CoE who will be responsible for communicating any issues to relevant
CoE stakeholders, including compliance training, compliance risk assessments and
compliance monitoring and testing. The project will be led by the Regulatory Change
14
Confidential Treatment Requested
Management CoE process owner. These meetings will include CoE participation by July 1,
2011.
G. Customer Complaint Action Plans:
21. Enhance Enterprise Customer Complaint Oversight
Enterprise
Compliance will leverage the Ally Bank Complaint Management Policy (covering, among
others, residential mortgage loan servicing, loss mitigation and foreclosure activities)
scheduled for deployment by June 30, 2011 to develop and implement an enterprise-wide
Global Complaint Management Policy. This policy will establish the framework addressing
enhancements to multiple complaint management program components including
governance, procedures, monitoring, testing, training, and reporting. Systems that support
the capture, aggregation, and reporting of customer complaint data are in the process of being
enhanced. In addition, through the use of appropriate escalation protocols, corrective action
plans will be managed and/or monitored to completion; deeper levels of compliance support
will be engaged to perform targeted monitoring and testing; and root cause analysis will be
performed to identify issues that need to be addressed through corrective action or other
remediation activities. The project will be led by Consumer Practices/Customer Relations
Compliance. The policy and framework will be implemented by January 1, 2012.
Appendix II - Board Level Deliverables and Due Dates
Board Level Deliverable
Enhanced Board/Board Committee Compliance Reporting on Staffing (Task A.5.1 )
Due Date
1/1/2012
Enhanced Board/Board Committee Compliance Issues Reporting (Task D.15.2 )
1/1/2012
Global Compliance Policy (RCC) (Task A.1.2)
9/1/2011
15
Confidential Treatment Requested
Appendix III - First Level Project Details
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
A. Enterprise Compliance Programs, Policies and Governance
1.
Enhancements to ECP Documentation
Updated
Global
Compliance
Policy
Updated ECP
Document
7
A.1.1 Enterprise Compliance Programs,
Policies and Governance CoE
Enhance the Global Compliance Policy to
include ECP CoE and ECP mandate
7
A.1.2 Enterprise Compliance Programs,
Policies and Governance CoE
Enhance ECP Document to include the ECP’s
organizational structure (including CoE), and
reporting lines. Include Ally Financial’s vision of
how to manage the ECP including oversight,
coordination, reporting.
7
Updated ECP
A.1.3 Enterprise Compliance Programs,
Document
Policies and Governance COE
Update ECP Document to reflect program
enhancements finalized after 9/30.
2. Enhancements to Communication Plan
Formal
communicatio
n plan with an
implementatio
n roadmap
3.
7
A.2.1 Enterprise Compliance Programs,
Policies and Governance CoE
Develop a formal communication plan at the
enterprise level to outline the delivery of the
overall ECP requirements to LoB Compliance
and LoB management and for receiving
information from LoB Compliance and LoB
management.
Complete inventory of all global compliance and LoB compliance policies
Updated ECP
Document
7
Inventory of
LoB
compliance
policies
7
A.3.1 Enterprise Compliance Programs,
Policies and Governance CoE
Define roles and responsibilities between
Enterprise Compliance and LoB Compliance
related to maintenance of inventory of LoB
compliance policies.
A.3.2 Enterprise Compliance Programs,
Policies and Governance CoE
Compile all LoB compliance policies into a
complete inventory.
5/15/11
9/01/11
5/15/11
10/01/11
9/01/11
1/01/12
7/15/11
10/01/11
5/15/11
10/01/11
5/15/11
10/01/11
16
Confidential Treatment Requested
Deliverable
CO
Section
Task
Board
Reporting on
Compliance
staff
adequacy/quali
fications
7
A.5.1 Enterprise Compliance Programs,
Policies and Governance CoE
At least annually provide reporting to
Board(s)/Board-designated Committee(s) on
adequacy of compliance staff qualifications and
compliance staffing levels.
Owner
Projected
Projected
Start
Finish
Date
Date
4. Enhancements to Enterprise Compliance oversight of LoB compliance policy approval, review,
communication and reporting processes
7/15/11
Updated Policy 7
10/01/11
A.4.1 Enterprise Compliance Programs,
on Policies
Policies and Governance CoE
document
Enhance Policy on Policies document to
include requirements for LoB compliance
policies
7
7/15/11
Process flow
10/01/11
A.4.2 Enterprise Compliance Programs,
for LoB
Policies and Governance CoE
compliance
Define roles and responsibilities, leveraging the
policy review
Policy on Policies document, between
Enterprise Compliance, LoB Compliance, and
LoB management related to the approval,
review, communication and reporting for LoB
compliance policies. Communicate the agreed
upon roles and responsibilities.
7
7/15/11
LoB monthly
10/01/11
A.4.3 Enterprise Compliance Programs,
reporting
Policies and Governance CoE
template
Establish LoB Compliance reporting routines
so that review and publishing of compliance
policies can be monitored at the enterprise
level.
7
7/15/11
Updated ECP
10/01/11
A.4.4 Enterprise Compliance Programs,
Document
Policies and Governance CoE
Update ECP Document to include roles and
responsibilities related to LoB Compliance
policies and established processes.
5. Enhancements to Board Reporting – Compliance Staffing
7/15/11
1/01/12
17
Confidential Treatment Requested
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
B. Compliance Risk Assessments
6. Use of compliance risk assessment results in identification of areas of critical focus (e.g. compliance
training, compliance testing) and compliance resource allocation
5/15/11
7
6/15/11
List of
B.6.1 Compliance Risk Assessments CoE
Identify stakeholders of compliance risk
stakeholders
assessment results, for example Compliance
Training and EMTR.
7/01/11
10/01/11
7
Results
B.6.2 Compliance Risk Assessments CoE
Establish a process to disseminate compliance
report/template
risk assessment results to stakeholders.
7/01/11
7
Revised
B.6.3 Compliance Risk Assessments CoE
compliance
Update compliance risk assessment
risk assessment
framework/procedures.
framework/pro
cedures
7. Identification of trigger events that would result in compliance risk reassessment
Identified
triggers that
would
potentially lead
to
reassessment
of compliance
risk
Updated
compliance
risk assessment
framework/
procedures
7
Updated RAM
9/01/11
B.7.1 Compliance Risk Assessments CoE
Identify triggers that would potentially lead to
the reassessment of compliance risk based on
events occurring subsequent to the last annual
revision process.
7/01/11
9/01/11
7
B.7.2 Compliance Risk Assessments CoE
Update compliance risk assessment
framework/procedures to include triggers and
the process for incorporating compliance risk
reassessment results to training, policies and
testing.
8. Utilization of state laws in compliance risk assessments
7/01/11
9/01/11
7
7/15/11
9/01/11
5/01/11
8/01/11
B.8.1 Compliance Risk Assessments CoE
Update RAM with applicable state laws.
C. Enterprise Compliance Training
9. Enhancements to core and line of business curriculum development
7
C.9.1 Enterprise Compliance Training CoE
Define roles and responsibilities between
Enterprise, LoB Compliance, LoB
management, HR and Legal in connection with
the development of core and LoB compliance
training curriculum. Communicate the agreed
upon roles and responsibilities.
18
Confidential Treatment Requested
Deliverable
CO
Section
Task
Process for
training
curriculum
customization
to job families
Monthly LoB
reporting
template for
training
curriculum
7
C.9.2 Enterprise Compliance Training CoE
Establish a process by which LoB compliance
curriculum is customized to job families.
7
C.9.3 Enterprise Compliance Training CoE
Establish and monitor monthly LoB reports
related to compliance training curriculum
development.
7
Owner
C.9.4 Enterprise Compliance Training CoE
Establish agreed upon roles and
responsibilities, customization of compliance
training curriculum and LoB compliance
training curriculum reporting requirements.
10. Enhancements to identification and tracking of training participants
7
Curriculum,
ECP oversight
process map,
identification
process map,
mapping of job
analysis to
curriculum
7
C.10.1 Enterprise Compliance Training CoE
Define roles and responsibilities between
Enterprise and LoB Compliance with respect to
identification and tracking of training
participants. Communicate the identified roles
and responsibilities.
C.10.2 Enterprise Compliance Training CoE
Enhance the current process where all
mortgage LoB employees can be accurately
identified if it is decided that Enterprise
Compliance Training CoE will continue to
identify the training participants.
Projected
Start
Date
5/01/11
Projected
Finish
Date
10/01/11
10/01/11
1/01/12
7/01/11
11/01/11
7/01/11
10/01/11
9/01/11
1/01/12
7
7/01/11
C.10.3 Enterprise Compliance Training CoE
Develop reporting requirements with respect to
the identification and tracking of training
participants.
11. Development of an escalation process for non-compliance with training requirements
Enterprise
Training
Policy
Updated
Training
Policy and
Updated ECP
10/01/11
7
C.11.1 Enterprise Compliance Training CoE
Develop Enterprise Training Policy
4/15/11
9/01/11
7
C.11.2 Enterprise Compliance Training CoE
Define roles and responsibilities between
Enterprise Compliance HR, LoB Compliance
and LoB management related to escalation of
non-compliance with training.
Communicate the agreed upon roles and
responsibilities.
7/01/11
8/01/11
19
Confidential Treatment Requested
Deliverable
CO
Section
Task
Standards for
noncompliance
with core
curriculum and
LoB training
participation
Updated LoB
compliance
Training
Policy
documents
7
C.11.3 Enterprise Compliance Training CoE
Establish consequences for non-compliance
with core curriculum training as well as LoB
compliance training.
7
C.11.4 Enterprise Compliance Training CoE
Update relevant LoB compliance Training
policy/procedure to include the new process.
Owner
7
C.11.5 Enterprise Compliance Training CoE
Implement the escalation process for noncompliance with compliance training
12. Enhancements to enterprise compliance training Needs Assessment
7
C.12.1 Enterprise Compliance Training CoE
Define roles and responsibilities between
Enterprise Compliance and LoB Compliance
related to annual training Needs Assessment
process. Communicate the agreed upon roles
and responsibilities.
C12.2 Enterprise Compliance Training CoE
Enhance the current Needs Assessment process
to include factors such as latest risk assessment
results, any changes in laws and regulations,
and latest testing results.
7
Process for
enhanced
annual training
Needs
Assessment
and a template
7
C.12.3 Enterprise Compliance Training CoE
Updated LoB
Update relevant LoB compliance Training
compliance
policy to include the enhanced annual Needs
Training
Assessment process.
Policy
13. Enhancements to enterprise compliance training effectiveness assessment
7
Process to
incorporate
survey results
into curriculum
development
7
C.13.1 Enterprise Compliance Training CoE
Define roles and responsibilities between
Enterprise Compliance and LoB Compliance
related to training assessment effectiveness.
Communicate the agreed upon roles and
responsibilities.
C.13.2 Enterprise Compliance Training CoE
Enhance training effectiveness process by
incorporating survey results into the
improvement of core and LoB curriculum
development.
Projected
Start
Date
7/01/11
Projected
Finish
Date
10/01/11
7/01/11
11/01/11
7/01/11
11/01/11
5/01/11
10/01/11
5/15/11
10/01/11
7/01/11
1/01/12
7/01/11
11/01/11
7/01/11
1/01/12
20
Confidential Treatment Requested
Deliverable
CO
Section
Task
Owner
7
C.13.3 Enterprise Compliance Training CoE
Update relevant LoB compliance Training
policy to include training effectiveness
assessment requirements.
D. Regulatory Exam and Issues Management
Updated
Training policy
Projected
Start
Date
7/01/11
Projected
Finish
Date
11/01/11
14. Clarification of roles and responsibilities of Enterprise Compliance and LoB Compliance with respect to
Regulatory Exam and Issues Management
7
7/01/11
Updated
8/01/11
D.14.1 Regulatory Exam and Issues
Regulatory
Management CoE
Exam
Clarify roles and responsibilities of Enterprise
Management
Compliance and LoB Compliance related to
procedures
exam management. Communicate the agreed
upon roles and responsibilities.
15. Enhance Board Reporting – Compliance Issues Reporting
Current State
Assessment
7
D.15.1 Regulatory Exam and Issues
Management CoE
Perform assessment of current state of issues
management across Enterprise and LoB
Compliance
7
Enhanced
D.15.2 Regulatory Exam and Issues
Compliance
Management CoE
Board
Enhance reporting to Board(s)/BoardReporting
designated Committee(s) to include compliance
issues and key metrics
E. Enterprise Monitoring, Testing and Reporting
6/15/11
10/01/11
10/01/11
1/01/12
16. Development of EMTR policies and procedures to support the EMTR framework
Procedure
documents
7
E.16.1 Enterprise Monitoring, Testing and
Reporting CoE
Establish and document testing procedures in
support of testing processes, including sample
selection process, information gathering and
preparation process, issue identification and
action plan development, work paper retention
process.
17. Development of consolidated (EMTR and LoB MTR) annual testing schedule
5/01/11
10/01/11
5/01/11
7
Procedure
10/01/11
E.17.1 Enterprise Monitoring, Testing and
documents and
Reporting CoE
schedule
Establish and document consolidated annual
template
testing schedule process
18. Implementation of EMTR monitoring plan and enhancements to reporting of actionable monitoring
metrics
5/01/11
Global EMTR 7
10/01/11
E.18.1 Enterprise Monitoring, Testing and
Policy
Reporting CoE
Define and document roles and responsibilities
between Enterprise Compliance and LoB
Compliance related to EMTR and MTR
monitoring
21
Confidential Treatment Requested
Deliverable
CO
Section
Implement
standardized
monitoring
documentation
7
Task
E.18.2 Enterprise Monitoring, Testing and
Reporting CoE
Require completion of standardized monitoring
documentation for residential mortgage loan
servicing, Loss Mitigation, and foreclosure
activities and operations
7
E.18.3 Enterprise Monitoring, Testing and
Reporting CoE
Implement EMTR project plan for phase 1
monitoring based on determination of
appropriate metrics across the enterprise.
19. Implementation of EMTR testing
Owner
Projected
Start
Date
5/01/11
Projected
Finish
Date
6/15/11
10/01/11
1/01/12
5/01/11
10/01/11
E.19.1 Enterprise Monitoring, Testing and
Reporting CoE
Define and document roles and responsibilities
between Enterprise Compliance and LoB
Compliance related to EMTR and MTR testing
2/01/11
7
List of key
7/01/11
E.19.2 Enterprise Monitoring, Testing and
laws and
Reporting CoE
regulations
Identify key laws and regulations for testing
4/01/11
7
7/01/11
Test scripts
E.19.3 Enterprise Monitoring, Testing and
Reporting CoE
Develop testing scripts and requirements
8/01/11
7
10/01/11
Test results
E.19.4 Enterprise Monitoring, Testing and
Reporting CoE
Initial report of testing results
20. Enhancements to regulatory change management oversight of residential mortgage loan servicing, Loss
Mitigation, and foreclosure activities and operations
7
5/15/11
9/01/11
Document
F.20.1 Regulatory Change Management CoE
Define roles and responsibilities between
roles and
Enterprise Compliance and LoB Compliance
responsibilities
related to monitoring of new or changes to legal
requirements and supervisory guidance and
incorporation of such additions or changes into
policies, procedures, and processes.
7
5/01/11
Meeting
7/01/11
F.20.2 Regulatory Change Management CoE
Expand LoB Compliance led meeting routines
calendar
to include CoE who will provide oversight and
communicate any relevant changes to
appropriate CoE stakeholders.
Global EMTR
Policy
7
22
Confidential Treatment Requested
Deliverable
CO Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
6/01/11
10/01/11
7/01/11
12/15/11
G. Customer Complaint Oversight
21. Enhancements to Customer Compliant Oversight
Global
Customer
Complaint
Management
Policy
7
Implement
Customer
Complaint
Management
plan
7
21.1 Enterprise Customer Complaints
Develop Ally Financial Inc. Global
Customer Complaint Management Policy;
secure approval (CRC and RCC);
communicate. Scope: Ally Financial
Customer-facing units including non-Bank
entities and non-U.S. jurisdictions.
21.2 Enterprise Customer Complaints
Develop implementation plan and fully
execute on the approved framework, which
will be applicable to customer-facing LoBs.
Execution will be staged according to
primary businesses in the U.S.; e.g.,
Deposits, Mortgage, and Automotive,
followed by primary businesses in Canada
and other non-U.S. jurisdictions, followed
by secondary business units in the U.S. and
globally.
Appendix IV – Detailed descriptions of CoE and evaluation results
Given the particular focus of the Order, LoB will refer to residential mortgage loan servicing,
loss mitigation, and foreclosure activities and operations in the project summaries and action
plans.
A. Enterprise Compliance Programs, Policies and Governance Center of Excellence
The Enterprise Compliance Programs, Policies and Governance Center of Excellence was
established in April 2011 to support the development, maintenance and communication of
compliance program documentation, global compliance policies and LoB-specific
compliance policies as necessary to drive compliance with applicable laws and regulations.
This CoE is staffed with two senior policy writers who report directly to the ECP Manager.
This CoE is an integral component of the ECP as it supports the overall compliance risk
governance structure.
A number of areas have been identified as requiring improvement to strengthen the
Enterprise Compliance Programs, Policies and Governance CoE oversight role, specifically
in relation to residential mortgage loan servicing, Loss Mitigation, and foreclosure activities
and operations:
a. ECP documentation
b. Communication plan
23
Confidential Treatment Requested
c. Enterprise oversight of LoB compliance policy approval, review, communication
and reporting
d. Inventory of LoB compliance policies
e. Board reporting on compliance staffing
B. Compliance Risk Assessments Center of Excellence
The Compliance Risk Assessments Center of Excellence was established in January, 2011 to
provide a framework for identification of compliance risks, controls, processes, and
procedures designed to promote compliance with laws, regulations and evolving regulatory
expectations. The CoE supports the development of an effective monitoring and testing
program, as well as the allocation of compliance resources, and identification of areas of
critical focus. The CoE consists of a senior compliance risk assessment expert and an
assistant who report to the ECP Manager. LoBs also have their own compliance staff to
conduct risk assessments and monitor action plans.
Ally Financial’s Compliance Risk Assessment process is designed to provide accurate and
timely information regarding Ally Financial’s compliance risks to senior management and the
board of directors. The completion of Compliance Risk Assessments is a dynamic process
and updated periodically. The frequency with which LoB Compliance chooses to update a
Compliance Risk Assessment and schedule follow-up risk reviews may depend on the nature
of the business, changes to the profile or activities conducted and / or significant regulatory
changes. An annual Compliance Risk Assessment is considered a minimum requirement of
the ECP to confirm that business units are adequately operating in the current environment,
and that senior management has developed a compliance program consistent with the risk
profile for the business unit / legal entity from a compliance risk perspective.
A number of areas have been identified as requiring improvement to strengthen the
Compliance Risk Assessments CoE oversight role, specifically in relation to residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations:
a. Use of compliance risk assessment results in identification of critical focus areas
(e.g. compliance training, compliance testing) and allocation of compliance
resources
b. Identification of trigger events resulting in the reassessment of compliance risk
c. Utilization of state laws in compliance risk assessments
C. Enterprise Compliance Training Center of Excellence
The Enterprise Compliance Training Center of Excellence, established in January 2010,
consists of a manager and assistant who report to the ECP Manager. The purpose of the CoE
is to guide and monitor the development of compliance training programs in line with
applicable regulations for Ally Financial at the enterprise and LoB Compliance level.
Currently, the CoE also analyzes training metrics assessing program effectiveness and
determining required enhancements. The goals of the enterprise compliance training program
are to perform the following:
24
Confidential Treatment Requested
a. Educate on applicable laws and regulatory requirements to promote compliance
therewith and prevent violations thereof;
b. Promote compliance with internal policies and procedures;
c. Reduce risk of Ally Financial being subject to adverse actions by regulators or
other stakeholders; and
d. Protect the employees, assets, capital and reputation of Ally Financial.
A number of areas have been identified as requiring improvement to strengthen the
Enterprise Compliance Training CoE oversight role, specifically in relation to residential
mortgage loan servicing, loss mitigation, foreclosure activities and operations:
a. Development of core compliance curriculum and providing guidance on the
development of LoB compliance curriculum and framework, including training
frequency.
b. Identification and tracking of training recipients.
c. Escalation process for non-compliance with training requirements.
d. Assessment of training needs, to formally include compliance risk assessments
results, changes in laws and regulations, and testing results.
e. Assessment of training effectiveness.
D. Regulatory Exam and Issues Management Center of Excellence
The Regulatory Exam and Issues Management Center of Excellence, established in January
2010, consists of two managers who are accountable to the ECP Manager. The purpose of
the CoE is to manage and report regulatory exam issues to Ally Financial senior management
and the Board(s). Additionally, responsibilities of this CoE include the management of
regulatory inquiries, exams, response tracking and reporting.
The CoE manages regulatory exams, tracks remediation efforts against regulatory exam
findings, and provides appropriate reporting to senior management and the board of directors
on the status of the remediation of regulatory issues. The CoE is responsible for working
with LoB Compliance to coordinate with LoB contacts ultimately responsible for analyzing,
designing, building, testing, and eventually deploying solutions to identified regulatory
issues. After the solution for each issue is implemented and management asserts that the
issue is closed, Audit Services in coordination with regulators will determine the appropriate
method to validate that the issue has been closed. The CoE conducts monthly meetings with
Audit Services to identify those issues that require validation and to update the issue tracking
documentation. If Audit Services validation work is required, Audit assigns resources to
conduct the post-implementation validation testing. At the completion of the validation
testing, Audit will issue a memorandum indicating its findings. Once Audit has validated
that an issue is closed, regulators may utilize that validation work and/or conduct their own
validation work to determine issue closure. The issue is tracked until the regulator has
formally indicated the issue is closed.
25
Confidential Treatment Requested
Several areas have been identified as requiring improvement to strengthen the Regulatory
Exam and Issues Management CoE oversight role, specifically in relation to residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations:
a. Roles and responsibilities of Enterprise Compliance and LoB Compliance with
respect to exam management
b. Current state of compliance issues management
c. Board reporting of compliance issues
E. Enterprise Monitoring, Testing, and Reporting Center of Excellence
The EMTR Center of Excellence was established in January, 2011 to provide a consistent
approach to compliance monitoring, testing, and reporting within and across Ally Financial’s
LoB/Global Functions. Providing oversight on a global level, it is responsible for the
development of standardized monitoring and testing frameworks, processes and procedures
for LoB Compliance Programs. In addition to LoB Compliance Monitoring and Testing
Programs, EMTR will perform risk-based independent end to end monitoring and testing of
certain laws and regulations across LoBs. The CoE is led by a senior compliance
monitoring, testing and reporting expert who reports to the ECP Manager. The CoE also
consists of a team of four Testers and a Testing Manager. In addition, the LoBs have their
own staff to test and monitor key regulations and metrics.
With this purpose in mind, the EMTR CoE has established a framework to:
a. Develop a top-down, compliance monitoring, testing and reporting program that
addresses roles and responsibilities, risk based compliance monitoring and testing,
monitoring routines, issue management, and escalation and reporting / results /
dashboards
b. Support Ally Financial’s Enterprise Compliance Program
c. Be flexible to adapt to Ally Financial’s business mix, product set, and geographic
footprint
d. Meet the Federal Reserve’s expectations as expressed in “Supervisory Guidance:
Compliance Risk Management Programs and Oversight at Large Banking
Organizations with Complex Compliance Profiles” (SR 08-08)
Currently, the EMTR team is in the process of developing and executing end-to-end
regulatory testing of targeted, high-risk laws and regulations focused on Mortgage, Auto and
Deposits as well as building out monitoring and reporting of key compliance metrics
common across those areas based upon the aforementioned EMTR framework. This effort is
in its initial stages of phase 1 implementation based on a controlled subset of regulations and
has a three-phased project plan. Ally Financial is tracking this project plan and has provided
the project timeline to the Chicago Fed, with regular updates anticipated.
A number of areas have been identified as requiring improvement to strengthen the EMTR
CoE oversight role, specifically in relation to residential mortgage loan servicing, loss
mitigation, and foreclosure activities and operations:
26
Confidential Treatment Requested
a. Development of an EMTR Policy and procedures to support EMTR framework
b. Development of consolidated (EMTR and LoB MTR) annual testing schedule and
implementation of an EMTR testing plan
c. Implementation of an EMTR monitoring plan, including reporting of actionable
monitoring metrics
F. Regulatory Change Management Center of Excellence
The Regulatory Change Management Center of Excellence was established in January 2011
to support the development of an enterprise approach to manage and monitor legislative
changes applicable to Ally Financial LoB/Global Functions utilizing the following
components: Identification, Analysis, Implementation, and Integration. This CoE is led by a
senior regulatory change management expert who reports directly to the ECP Manager.
Regulatory change management processes currently exist within the Mortgage LoB
Compliance Program, which includes residential mortgage loan servicing, Loss Mitigation,
and foreclosure activities and operations. While the LoB and its legal and compliance
support partners have been engaged in this process and best understand the laws, rules and
regulations most relevant to its business, Ally Financial recognizes that an enterprise
regulatory change management function is needed to provide a broader level of support to the
efforts of each LoB and ensure consistency across the entire organization. To centralize and
standardize efforts to monitor changes in laws, rules and regulations, Ally Financial has
created the Regulatory Change Management CoE.
Mortgage LoB Compliance team has a long history of conducting its own sourcing and
analysis of new or updated laws, rules and regulations. It currently uses a proprietary
Regulatory Compliance database (
which allows the LoB to keep an inventory of
applicable laws, rules and regulations, and determines necessary corrective actions in
response to any regulatory changes.
The Regulatory Change Management CoE has an in-flight initiative to expand the use of
to serve the entire enterprise in the future. This enhancement will also drive the
maintenance of an updated inventory of laws, rules and regulations, which will feed into the
operations of Compliance Risk Assessments, Compliance Training, and Compliance
Monitoring and Testing. The enhancement project will include the development of broader
regular meeting routines to include additional impacted parties and formalize communication
across the enterprise.
While the regulatory change management process within residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and operations is functioning well, a number of
areas have been identified as requiring improvement to strengthen the Regulatory Change
Management CoE oversight role in the near-term:
a. Monitoring of changes in laws, rules and regulations applicable to residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and
operations as identified by the legal department through participation in
established Mortgage LoB Compliance routines
27
Confidential Treatment Requested
b. Incorporation of any such changes in laws and regulations into impacted CoE
including Compliance Risk Assessments, Compliance Training and EMTR
28
Confidential Treatment Requested
ALLY FINANCIAL INC.
GMAC Mortgage, LLC and Residential Capital, LLC
Mortgage Compliance Program
Prepared for the Board of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
Revised on December 8, 2011
1
Confidential Treatment Requested
Table of Contents
Plan to Enhance the Mortgage Compliance Program ................................................. 3
Background Information .............................................................................................. 5
Mortgage Compliance Program (“MCP”) ................................................................... 6
Consent Order Response .............................................................................................. 8
Appendix I – Program Deliverables by Consent Order Section................................ 17
Appendix II – Mortgage Compliance Program Description ..................................... 20
2
Confidential Treatment Requested
Plan to Enhance the Mortgage Compliance Program
The plan to enhance the Mortgage Compliance Program (the “MCP”) is established in response
to the Consent Order dated April 13, 2011 (the “Order”) among the Board of Governors of the
Federal Reserve System (the “FRB”), the Federal Deposit Insurance Corporation (the “FDIC”),
Ally Bank (the “Bank”), Ally Financial Inc. (“Ally Financial” or “AFI”), and certain of Ally
Financial’s direct and indirect subsidiaries including Residential Capital, LLC (“ResCap”) and
GMAC Mortgage, LLC (“GMACM” and together with ResCap, the "Mortgage Servicing
Companies"). Capitalized terms not defined in the Program shall have the meanings assigned to
them in the Order.
Within 60 days of this Order, GMAC Mortgage shall submit to the Reserve Bank an acceptable
compliance program and timeline for implementation to ensure that the operations of the
Mortgage Servicing Companies, including, but not limited to, residential mortgage loan
servicing, Loss Mitigation, and foreclosure, comply with the Legal Requirements, as well as the
Mortgage Servicing Companies’ internal policies, procedures, and processes and are conducted
in a safe and sound manner. The Program shall, at a minimum, address, consider, and include:
(a) The duties and responsibilities of line of business staff, other staff, and Third Party Providers
regarding compliance;
(b) policies for developing and communicating compliance-related roles and responsibilities
across the Mortgage Servicing Companies’ organization and to Third Party Providers;
(c) policies, procedures, and processes to ensure that the Mortgage Servicing Companies have
the ability to locate and secure all documents, including original promissory notes,
necessary to perform mortgage servicing, Loss Mitigation, and foreclosure functions and to
comply with contractual obligations;
(d) compliance with supervisory guidance of the Board of Governors, including, but not limited
to, the guidance entitled, “Compliance Risk Management Programs and Oversight at Large
Banking Organizations with Complex Compliance Profiles,” dated October 16, 2008 (SR
08-08/CA 08-11);
(e) compliance with Legal Requirements, including:
(i) processes to ensure that all factual assertions made in pleadings, declarations,
affidavits, or other sworn statements filed by or on behalf of the Mortgage Servicing
Companies are accurate, complete, and reliable; and that affidavits and declarations
are based on personal knowledge or a review of the Mortgage Servicing Companies’
books and records when the affidavit or declaration so states;
(ii) processes to ensure that affidavits filed in foreclosure proceedings and other
foreclosure-related documents are executed and notarized in accordance with
applicable State legal requirements, including jurat requirements;
3
Confidential Treatment Requested
(iii) processes to ensure that the Mortgage Servicing Companies have properly
documented ownership of the promissory note and mortgage (or deed of trust) under
applicable State law, or are otherwise a proper party to the action (as a result of
agency or other similar status) at all stages of foreclosure and bankruptcy litigation;
and
(iv) processes to ensure that a clear and auditable trail exists for all factual information
contained in each affidavit or declaration, in support of each of the charges that are
listed, including whether the amount is chargeable to the borrower or claimable by
the investor.
(f)
policies and procedures to ensure that payments are credited in a prompt and timely
manner that payments, including partial payments to the extent permissible under the terms
of applicable legal instruments, are applied to scheduled principal, interest, and escrow
before fees, and that any misapplication of borrower funds is corrected in a prompt and
timely manner.
(g) compliance with contractual obligations to the owners of the mortgages in the Servicing
Portfolio.
(h) compliance with the contractual limitations in the underlying mortgage note, mortgage, or
other customer authorization with respect to the imposition of fees, charges and expenses,
and compliance with Legal Requirements concerning the imposition of fees, charges, and
expenses.
(i) processes to ensure that foreclosure sales (including the calculation of the default period,
the amounts due, and compliance with notice requirements) and post-sale confirmation are
in accordance with the terms of the mortgage loan and applicable State and Federal law
requirements.
(j) procedures to ensure compliance with bankruptcy law requirements, including a prohibition
on collection of fees in violation of bankruptcy’s automatic stay (11 U.S.C. § 362), the
discharge injunction (11 U.S.C. § 524), or any applicable court order.
(k) the scope and frequency of independent testing for compliance with the Legal Requirements,
supervisory guidance of the Board of Governors, and the requirements of the Mortgage
Servicing Companies’ internal policies, procedures, and processes by qualified parties with
requisite knowledge and ability (which may include internal audit) who are independent of
the Mortgage Servicing Companies’ business lines and compliance function.
(l) measures to ensure that policies, procedures, and processes are updated on an ongoing
basis as necessary to incorporate new or changes to Legal Requirements and supervisory
guidance of the Board of Governors; and
(m) the findings and conclusions of the independent consultant(s) engaged by GMAC Mortgage
under paragraph 3 to review the Mortgage Servicing Companies’ foreclosure processes.
4
Confidential Treatment Requested
Background Information
Global Compliance & Regulatory Affairs (“GCRA”), led by Ally Financial Inc.’s (“AFI’s”)
Chief Compliance Officer (“CCO”), is a global function responsible for driving AFI’s
enterprise-wide culture of compliance with laws, regulations, and compliance policies. GCRA is
comprised of two groups of compliance professionals working together to achieve effective
oversight and management of compliance risk across AFI: (1) Enterprise Compliance Program
Management (“Enterprise Compliance” or “ECP”); and (2) Line-of-Business (“LoB”) & Global
Function Compliance Officers and their staff (“LoB Compliance”).
Under AFI’s current compliance risk management structure, LoB Senior Management is
accountable for all compliance risks in the LoB, including both existing and emerging
compliance risks (First Line of Defense). The LoB/Global Function Compliance Officers, in
partnership with Enterprise Compliance Program Management manage and oversee compliance
risk within AFI’s LoB and Global Functions (Second Line of Defense).
The cornerstone of the ECP is grounded in the supervisory guidance entitled “Compliance Risk
Management Programs and Oversight at Large Banking Organizations with Complex
Compliance Profiles” dated October 16, 2008 (SR 08-08). Specifically, the four key areas
included in the guidance are as follows:
x
x
x
x
Firm-wide approach to compliance risk management/oversight
Independence of compliance staff
Sound practices for compliance monitoring and testing
Responsibility of Board and senior management for risk management and oversight
5
Confidential Treatment Requested
As part of the ECP framework, the following Compliance Centers of Excellence (“CoEs”)
provide oversight, direction and guidance with respect to the LoB Compliance Programs:
x
x
x
x
x
x
Enterprise Compliance Programs, Policies and Governance
Enterprise Compliance Training
Regulatory Exam and Issues Management
Compliance Risk Assessments
Enterprise Monitoring Testing & Reporting (“EMTR”)
Regulatory Change Management
Mortgage Compliance Program (“MCP”)
Prior to AFI becoming a bank holding company on December 24, 2008, GCRA’s Mortgage
Compliance Officer (“Mortgage Compliance”) had a relatively mature MCP for its Mortgage
Origination Businesses. Effective January 1, 2010, GCRA announced its organizational
structure for LoB/Global Functions. Shortly afterwards, GCRA’s Mortgage Compliance Officer
and staff began to expand its MCP to include the Mortgage Servicing Companies (“Mortgage
Servicing”). The MCP Description was published on November 15, 2010, and revised on May
30, 2011 to update some of the department names and descriptions. (For a copy of the existing
MCP, see the attached Appendix 2).
The MCP aligns with the ECP and includes a description of each of the following ECP
principles.
x
Commitment and Culture: Processes to describe the Mortgage LoB’s Compliance
Commitment, including how compliance impacts/risks are considered at planning/strategy
meetings, resources, compliance issue and risk reporting, employee accountability, and
processes to identify compliance gaps and potential risks early in the new/product business
development cycle.
x
Controls: the MCP describes the following compliance control processes;
o Controls and Supervision: Processes to determine if appropriate controls are in place
when enhancements are required, and how risks and issues are tracked and escalated
within the Mortgage LoB
o Policies and Procedures: A description of the inventory, development, maintenance,
approval and communication of Mortgage Compliance policies and procedures
o Monitoring, Testing, and Reporting (“MTR”): Processes for mapping the laws, rules
and regulations (“LRRs”) to MTR controls, evaluating the effectiveness of
monitoring activities, determining the effectiveness of the Mortgage LoBs adherence
to LRRs, maintaining plans for activities to be monitored, and reporting monitoring
and testing results to Management
6
Confidential Treatment Requested
The MTR Plan is described in section C(4) of the MCP attached as Appendix 2. In general, the
MTR Plan utilizes a risk based approach to determine the scope, frequency and testing strategy
to oversee the Mortgage LoB’s compliance with LRR’s and compliance policies. Monitoring is
conducted via surveillance and exception reports. Testing for completeness, accuracy and
validity of compliance documentation, processes, controls and data accuracy may be conducted
using standard periodic statistical and stratified reviews or targeted reviews. Compliance
Assessments includes operational reviews of Mortgage policies, procedures and controls.
The MTR Plan requires the Mortgage LoB to develop and implement action plans to strengthen
its control environment to ensure compliance. More specifically, as process or systemic issues
are identified, remediation plans must be created to resolve current findings and/or prevent future
findings through process or systems improvements.
x
Training: Processes for how compliance competencies are integrated in the Mortgage
processes, how training is tracked and measured, identifying new compliance training, and
determining when employees have sufficient awareness of LRRs
x
Management Reporting and Analysis: Inventory of Management reports that address
compliance, processes to determine accuracy of Management reports, and how compliance
risks and issues are reported
x
Regulatory Oversight: Processes for maintaining and updating Federal, State, and Local
LRRs, and processes for Management to respond to requests from Regulators
Throughout 2010, Mortgage Compliance took the following actions to enhance the MCP for
Mortgage Servicing:
x
x
x
x
x
x
x
x
x
1
Implemented a legislative reporting 1 and regulatory change management process
Established compliance implementation strategy meetings with Mortgage Servicing
business units and Legal to develop and review Mortgage Servicing’s action plans in
response to new or revised LRRs or compliance policies
Performed AML, OFAC and Compliance risk assessments
Established preventative control processes to review all new and revised Mortgage
Servicing policies, procedures and training materials
Reviewed and approved the Mortgage Servicing training materials regarding
foreclosures, bankruptcy, document execution and notary requirements
Expanded the Mortgage Compliance MTR Plan to incorporate Mortgage Servicing
controls
Developed and implemented compliance monitoring and testing controls for several
Mortgage Servicing Legal Requirements
Tracked and monitored compliance action plans developed in response to regulatory
exams, new laws, MTR findings and internal audit findings
Commenced the Mortgage Servicing compliance risk assessment
The legislative reporting function was transitioned to Legal effective July 1, 2011.
7
Confidential Treatment Requested
In 2011, Mortgage Compliance;
x
x
Completed the Mortgage Servicing compliance risk assessment in March, 2011; and
Continues to expand its Mortgage Compliance MTR plan for Mortgage Servicing to add
monitoring and testing controls for Federal and State laws and regulations, internal
compliance policies and procedures, court orders, and contractual requirements.
In addition to the above actions, Mortgage Compliance continues to actively partner with
Mortgage Servicing to strengthen its control environment. For example, Mortgage Compliance
will oversee and track the action plans created in response to the Mortgage Servicing compliance
risk assessment.
Consent Order Response
This Consent Order Response (“Response”) uses the existing MCP as the baseline compliance
program and introduces program changes to strengthen the MCP with respect to this Order.
Detailed responses to each section of Article 8 of the Order are listed below:
Note: MCP deliverables are listed in Appendix 1 which lists all deliverables with their end dates
and have been prioritized based on several factors, including the inherent risk and strength of
existing controls within Mortgage Servicing.
a.
Duties and Responsibilities – Article 8(a)
The Program shall, at a minimum, address, consider, and include: the duties and
responsibilities of line of business staff, other staff, and Third Party Providers regarding
compliance.
The existing MCP follows the Global Compliance Program Statement about Lines of
Defense. As the first line of defense, Mortgage Servicing is responsible for identifying,
assessing, taking and mitigating risks associated with their business. Responsibilities include
the following:
x
Ensuring that unit specific policies, processes procedures and staff are in place to manage
compliance risk for all products, activities and processes; and
x
Ensuring that compliance controls and practices within the business are functioning and
consistent with Companywide policies and procedures.
As a second line of defense, Mortgage Compliance partners with Mortgage Servicing to
identify, assess and mitigate all risks. Responsibilities include:
x
Conducting appropriate compliance risk based monitoring, testing, reporting, process
reviews and surveillance activities regarding business activities; and
8
Confidential Treatment Requested
x
Conducting risk based compliance or other assessments and reviews and providing
independent reports and opinions to Management.
In response to this Order, the MCP will be enhanced to incorporate the compliance-related
duties and responsibilities of Third Party providers. More specifically, Mortgage
Compliance will partner with the Mortgage Supplier Office team to implement contractual
and other controls to monitor third party compliance activities.
In addition to the above, Mortgage Compliance will enhance the MCP to reference the
following changes in duties and responsibilities:
x
Mortgage Compliance will develop a complaint oversight role to monitor Mortgage
Servicing’s escalated complaint process, the Voice of the Customer (“VOC”), to ensure
that regulatory compliance issues are identified and remediated in a timely manner; and
that VOC is monitoring negative trends, performing root cause analysis, and
implementing action plans to mitigate compliance risk issues.
x
Legal will assume responsibility for the legislative tracking and reporting function for the
Mortgage LoB by July 1, 2011.
x
In 2010, Legal updated its inventory of Federal laws applicable to Mortgage Servicing
and is in the process of building an inventory of State laws applicable to Mortgage
Servicing. Legal will communicate and maintain the Inventory of Federal and State laws
applicable to Mortgage Servicing, which Mortgage Compliance will leverage to enhance
its compliance risk assessments and MTR plan.
b.
Developing and Communicating Roles and Responsibilities – Article 8(b)
The Program shall, at a minimum, address, consider, and include: policies for developing
and communicating compliance-related roles and responsibilities across the Mortgage
Servicing Companies’ organization and to Third Party Providers.
The current MCP describes policies for developing and communicating compliance related
roles and responsibilities across the Mortgage LoB, which includes the Mortgage Servicing.
Section III of the MCP describes the Four Principles of Compliance, including Commitment
and Culture. More specifically, this section of the MCP describes how compliance roles and
responsibilities are developed and communicated through job descriptions, goals and
objectives, policies, procedures, training and meetings. The Policies and Procedures section
of the MCP also describes Mortgage Compliance’s process for developing and
communicating compliance-related roles and responsibilities with respect to new and revised
LRRs and compliance policies. New laws are tracked using a variety of third party resources
including Houselaw Counselor, AllRegs and through alerts and notices from several law
firms.
To enhance the MCP, Mortgage Compliance and Legal will communicate and publish the
new legislative tracking and reporting procedures in connection with the transfer of this
responsibility from Mortgage Compliance to Legal on/or before July 1, 2011.
9
Confidential Treatment Requested
Additionally, Mortgage Compliance will work with the Mortgage Supplier Office team to
create a process to develop and communicate compliance related roles and responsibilities to
non-attorney Third Party Providers and embed these responsibilities in our contractual
agreements with Third Party Providers. (For more details regarding the Third Party
Management, refer to the response to Section 6 of the Order: Third Party Management).
c.
Policies and Procedures to Locate and Secure All Documents to Perform
Mortgage Servicing Functions and Comply with Contractual Obligations –
Article 8 (c)
The Program shall, at a minimum, address, consider, and include: policies, procedures, and
processes to ensure that the Mortgage Servicing Companies have the ability to locate and
secure all documents, including original promissory notes, necessary to perform mortgage
servicing, Loss Mitigation, and foreclosure functions and to comply with contractual
obligations.
Currently, AFI has a Global Records Management Policy, also known as Company Records
and Information Management (“CRIM”). CRIM, administered by Legal, establishes an
Enterprise-wide framework for managing AFI’s records from creation/acquisition to disposal
and conforms to the Federal and State law record keeping requirements.
Furthermore, Mortgage Servicing has existing policies and procedures that govern the
records management process with respect to Mortgage Servicing functions, including
policies and procedures to comply with the contractual record retention obligations defined
by the investor entities including the Government Sponsored Enterprises (“GSEs”) and other
clients and sub-servicing contracts.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to include testing of
Mortgage Servicing’s ability to locate and secure documents necessary to perform mortgage
servicing, loss mitigation and foreclosure functions and to comply with contractual
obligations. Mortgage Compliance will work with Legal and Mortgage Servicing to define
monitoring and testing roles and responsibilities with respect to the receipt and/or retention
of legal files and mortgage servicing documentation prepared by outside counsel.
d.
Supervisory Guidance of the Board of Governors – Article 8(d)
The Program shall, at a minimum, address, consider, and include: compliance with
supervisory guidance of the Board of Governors, including, but not limited to, the guidance
entitled, “Compliance Risk Management Programs and Oversight at Large Banking
Organizations with Complex Compliance Profiles,” dated October 16, 2008 (SR 08-08/CA
08-11).
As previously noted in the Background section of this Response, SR 08-08 is the foundation
for AFI’s ECP and MCP.
10
Confidential Treatment Requested
To enhance its MCP, Mortgage Compliance will incorporate the six ECP CoEs in the MCP,
since the CoEs were designed to comply with the Supervisory Guidance of the Board of
Governors.
e.
Factual Assertions are Accurate, Complete, and Reliable – Article 8(e)
i. Article 8(e)(i)
The Program shall, at a minimum, address, consider, and include: processes to ensure that
all factual assertions made in pleadings, declarations, affidavits, or other sworn statements
filed by or on behalf of the Mortgage Servicing Companies are accurate, complete, and
reliable; and that affidavits and declarations are based on personal knowledge or a review
of the Mortgage Servicing Companies’ books and records when the affidavit or declaration
so states.
Mortgage Servicing and Compliance worked with Legal and outside counsel to enhance its
Foreclosure procedures in December, 2010 and its Bankruptcy procedures in February, 2011
to reference specific legal and compliance requirements and to explain how to confirm that
the factual assertions made in pleadings, declarations affidavits or other sworn statements are
accurate and complete and that the affidavits and declarations are based on personal
knowledge or a review of the Mortgage Servicing Companies’ books and records when the
affidavit or declaration so states.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to include testing to
confirm that the factual assertions made in foreclosure and bankruptcy pleadings,
declarations, affidavits or other sworn statements are accurate and complete and that the
affidavits and declarations were based on personal knowledge or a review of the Mortgage
Servicing Companies’ books and records when the affidavit or declaration so states. To
effectively test for this requirement, Mortgage Compliance will conduct process assessments,
visual observations and volume/capacity reviews.
i.
Article 8(e)(ii)
The Program shall, at a minimum, address, consider, and include: processes to ensure that
affidavits filed in foreclosure proceedings and other foreclosure-related documents are
executed and notarized in accordance with applicable State legal requirements, including
jurat requirements
In December, 2010, Mortgage Servicing and Compliance worked with Legal and outside
counsel to enhance document execution and notarization processes as defined in the
Mortgage Servicing Companies’ Foreclosure Policies and Procedures. The Foreclosure
Policies and Procedures are outlined according to State documentation requirements for
foreclosure proceedings. Existing notarization procedures are based on having complete and
accurate documents, verifying the identity of signers, complying with the notarial certificate,
and assuring the notary seal contains the appropriate information.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to test Mortgage
Servicing’s compliance with its procedures guiding the review of affidavits filed in
foreclosure proceedings to confirm that affidavits were executed and notarized in accordance
11
Confidential Treatment Requested
with applicable State legal requirements, including jurat requirements. To effectively test for
these requirements, Mortgage Compliance staff will conduct process assessments, visual
observations and volume/capacity reviews.
ii.
Article 8(e)(iii)
Consent Order section 8eiii states: The Program shall, at a minimum, address, consider, and
include: processes to ensure that the Mortgage Servicing Companies have properly
documented ownership of the promissory note and mortgage (or deed of trust) under
applicable State law, or are otherwise a proper party to the action (as a result of agency or
other similar status) at all stages of foreclosure and bankruptcy litigation
Currently, Mortgage Servicing’s Foreclosure and Bankruptcy departments have a database
called the
that summarizes on whose behalf Mortgage Servicing may file
a claim or action. The
information is obtained from the applicable
Servicing Agreement and updated as necessary. Information from the
is
used to populate the plaintiff field in the affidavit, proof of claim and/or any subsequent legal
documentation generated as part of a legal proceeding.
Similarly, Mortgage Servicing’s Master Servicing department utilizes a Default Management
System to record the proper party to file a claim or action based on information in the
applicable Pooling and Servicing Agreement.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to test for compliance
to the effective reporting of the proper party to the action in connection with all stages of
foreclosure and bankruptcy. Additionally, Mortgage Compliance will expand its MTR to
include the review of chain of title transactions to ensure that ownership of the promissory
note and mortgage (or deed of trust) is properly documented based on the inventory of State
laws provided by Legal.
4.5.4 Article 8(e)(iv)
The Program shall, at a minimum, address, consider, and include: processes to ensure that
a clear and auditable trail exists for all factual information contained in each affidavit or
declaration, in support of each of the charges that are listed, including whether the amount is
chargeable to the borrower or claimable by the investor
All factual information contained in affidavits or declarations is dependent on the original
documents, internal data and data from Third Party Providers, including foreclosure and
bankruptcy attorneys.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to test and document
the affidavit review process by tracing the information contained in the affidavits or
declarations and summaries of motion to information obtained from the original documents,
internal data or data obtained from Third Party Providers. As part of its affidavit review
process, Mortgage Compliance will also determine if fees are chargeable to the borrower or
claimable by the investor.
12
Confidential Treatment Requested
f.
Crediting of Payments – Article 8(f)
The Program shall, at a minimum, address, consider, and include: policies and procedures
to ensure that payments are credited in a prompt and timely manner; that payments,
including partial payments to the extent permissible under the terms of applicable legal
instruments, are applied to scheduled principal, interest, and escrow before fees, and that
any misapplication of borrower funds is corrected in a prompt and timely manner.
Currently, Mortgage Servicing has procedures guiding the accurate, prompt and timely
crediting of payments as well as the steps required to detect and rectify any misapplication of
borrower funds in a timely manner. As the system of record,
contains logic to
monitor proper adherence to payment hierarchy requirements, including application of
payments to interest, principal and escrows before fees. Internal controls in
help
ensure the accuracy of calculations around the application of payments based on the loan
unpaid principal balance, note rate, contractual payments and last paid installment status.
To enhance its MCP, Mortgage Compliance will expand its MTR plan to test loans to
determine if payments were credited in a prompt and timely manner; that payments,
including partial payments to the extent permissible under the terms of applicable legal
instruments, are applied to scheduled principal, interest, and escrows before fees, and that
any misapplication of borrower funds is corrected in a prompt and timely manner. To
effectively test for this requirement, Mortgage Compliance will review Mortgage Servicing
suspense accounts as well as payment histories.
g.
Compliance with Contractual Obligations – Article 8(g)
The Program shall, at a minimum, address, consider, and include: compliance with
contractual obligations to the owners of the mortgages in the Servicing Portfolio.
Currently, Mortgage Servicing is responsible, and will continue to be responsible and
accountable, for ensuring compliance with contractual obligations to the owners of the
mortgages in the Servicing portfolio.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to test for compliance
with contractual obligations to the owners of mortgages in GMACM’s Servicing portfolio.
h.
Compliance with Contractual and Legal Fee limits – Article 8(h)
The Program shall, at a minimum, address, consider, and include: compliance with the
contractual limitations in the underlying mortgage note, mortgage, or other customer
authorization with respect to the imposition of fees, charges and expenses, and compliance
with Legal Requirements concerning the imposition of fees, charges, and expenses
Currently, compliance with the contractual limitations in the underlying note, mortgage, and
customer authorizations and compliance with Legal Requirements with respect to the
imposition of fees, charges and expenses is initially managed through system controls in the
servicing system,
Mortgage Servicing’s Transfer Management and Cash
Management teams also monitor fees, charges, and expenses to review for accuracy
13
Confidential Treatment Requested
throughout the loan boarding process and through exception reporting generated from
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to include testing the
design and operating effectiveness of the existing controls in the servicing system, as well as
the output of any examination performed by the Transfer Management and Cash
Management teams throughout the boarding process and through
exception
reporting. Mortgage Compliance will also test for compliance with Federal and State LRRs
concerning the imposition of fees, charges, and expenses.
i.
Foreclosure Sales and Post-Sale Confirmation Compliance – Article 8(i)
The Program shall, at a minimum, address, consider, and include: processes to ensure that
foreclosure sales (including the calculation of the default period, the amounts due, and
compliance with notice requirements) and post-sale confirmation are in accordance with the
terms of the mortgage loan and applicable State and Federal law requirements.
Currently, Mortgage Servicing has processes to govern foreclosure sale and post-sale
procedures in judicial and non-judicial States, including the requirements concerning the
calculation of the default period, the amounts due, compliance with notice requirements and
post-sale confirmations. In addition, Mortgage Servicing has implemented foreclosure
quality control reviews prior to foreclosure referral and prior to foreclosure sale.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to include testing of
foreclosure sales (including the calculation of the default period, amounts due, and
compliance with notice requirements) and post-sale confirmations for compliance with the
terms of the mortgage loan and applicable State and Federal law requirements. As
mentioned previously, the MTR Plan is described in more detail in Section C(4) of the MCP,
which is attached as Appendix 2.
j.
Compliance with Bankruptcy Law Requirements – Article 8(j)
The Program shall, at a minimum, address, consider, and include: procedures to ensure
compliance with bankruptcy law requirements, including a prohibition on collection of fees
in violation of bankruptcy’s automatic stay (11 U.S.C. § 362), the discharge injunction (11
U.S.C. § 524), or any applicable court order.
To enhance its MCP, Mortgage Compliance will expand its MTR Plan to include testing to
ensure compliance with bankruptcy law requirements, including the prohibition on collection
of fees in violation of bankruptcy’s automatic stay (11 U.S.C. § 362), the discharge
injunction (11 U.S.C. § 524), or any applicable court order.
k.
Scope and Frequency of Independent Compliance Testing – Article 8(k)
The Program shall, at a minimum, address, consider, and include: the scope and frequency
of independent testing for compliance with the Legal Requirements, supervisory guidance of
the Board of Governors, and the requirements of the Mortgage Servicing Companies’
internal policies, procedures, and processes by qualified parties with requisite knowledge
14
Confidential Treatment Requested
and ability (which may include internal audit) who are independent of the Mortgage
Servicing Companies’ business lines and compliance function.
Currently, the MCP incorporates the independent compliance testing being performed by
Mortgage Compliance in connection with its MTR Plan. The MTR Plan is described at a
high level in Section III(C)(2) of the MCP. The MTR Plan leverages the EMTR testing
framework as guidance and will incorporate related EMTR results provided by ECP
management as an overlay or reasonableness check.
Mortgage Compliance will expand the scope of the MTR Plan in response to the Order, upon
receipt of the inventory of State laws from Legal2 and pursuant to new and/or updated Legal
Requirements or risk issues.
Additionally, Mortgage Compliance will enhance its MCP and MTR Plan to:
x
Include a quarterly reassessment of the current MCP staffing model to: (i) determine
the need for additional personnel to manage and execute the testing, given the
increased MTR scope discussed in this response and the potential for increased
regulatory scrutiny; and (ii) confirm that existing staff have the requisite knowledge
and abilities to perform their job duties. In May 2011, Mortgage Compliance
obtained approval to add six additional positions to the MTR team. Mortgage
Compliance will explore the level of effort required to address each of the
enhancements discussed in this Response as well as the capabilities and bandwidth of
existing personnel before headcount can be finalized. The MCP staffing and
resource needs will be reported and escalated to GCRA and Mortgage Management
and to the ResCap or Ally Board Committees as appropriate (and as required under
plans to respond to Section 2 – Board Oversight).
x
Partner with Global Technology Operations to deploy
(a sampling, testing
and reporting tool) or another application to support Mortgage Compliance’s MTR
Plan for Mortgage Servicing.
l.
New or Changes to Legal Requirements / Supervisory Guidance – Article 8(l)
The Program shall, at a minimum, address, consider, and include: measures to ensure that
policies, procedures, and processes are updated on an ongoing basis as necessary to
incorporate new or changes to Legal Requirements and supervisory guidance of the Board of
Governors
As mentioned earlier in this response, Mortgage Compliance has an established Legislative
Tracking and Regulatory Change Management process to ensure that Mortgage Servicing
policies, procedures and processes are updated to reflect new or revised Legal Requirements
and supervisory guidance.
Legal assumed responsibility for the Mortgage legislative reporting process on July 1, 2011,
2
Legal owns maintaining and communicating to Mortgage Compliance the inventory of Federal and State
LRRs effective 7/15/11.
15
Confidential Treatment Requested
and will communicate new or revised Legal Requirements to Mortgage Compliance.
Additionally, in 2010, Legal updated its inventory of Federal laws applicable to Mortgage
Servicing and is in the process of purchasing an inventory of State laws applicable to
Mortgage Servicing. Upon receipt of the communication of new or revised Legal
Requirements or the inventory of State laws, Mortgage Compliance will follow its existing
Regulatory Change Management process to; 1) communicate the Legal Requirements and
supervisory guidance to Mortgage Servicing; and 2) monitor whether modifications were
made to existing Mortgage Servicing policies, procedures, documents or compliance controls
in a timely manner.
m.
Findings / Conclusions from Review of Foreclosure Processes – Article 8(m)
The Program shall, at a minimum, address, consider, and include: the findings and
conclusions of the independent consultant(s) engaged by GMAC Mortgage under paragraph
3 to review the Mortgage Servicing Companies’ foreclosure processes.
The existing MCP and the program enhancements described in this response are subject to
modification to address any compliance matters brought to AFI’s attention by independent
parties, including independent reviews commissioned under the Order and other regulatory
and supervisory guidance.
16
Confidential Treatment Requested
Appendix I – Program Deliverables by Consent Order Section
Program Deliverable
CO
Section
Task
Improved Governance
Structure – Roles and
Responsibilities
8(a)
Develop and implement complaint
oversight role and process within
Mortgage Compliance
Improved Regulatory
Oversight – Inventory
of Laws
8(i)
Improved Governance
Structure – Roles and
Responsibilities
8(b)
Regulatory Change
Management
8(a)
8(b)
Expanded MTR Plan
8(c)
Projected
Start
Date
6/01/11
Projected
Finish
Date
12/01/11
Legal will provide Mortgage
Compliance with a summary of the
State laws applicable to Mortgage
Servicing
1/31/11
7/15/11
Enhance the MCP to include
policies to communicate and
monitor compliance related duties
and responsibilities of Third Party
providers.
Clarify and communicate roles and
responsibilities between Legal and
Mortgage Compliance in
connection with the transition of
the Legislative Reporting function
from Mortgage Compliance to
Legal
Develop and implement a plan to
ensure that Mortgage Servicing
was able to locate and secure all
documents necessary to perform
the following activities:
7/15/11
12/01/11
1/31/11
7/01/11
7/15/11
11/01/11
Foreclosures
Loss Mitigation
Other Mortgage Servicing
Activities
Owner
2/01/12
6/01/12
17
Confidential Treatment Requested
Program Deliverable
CO
Section
Task
Governance
8(d)
Revise the MCP to incorporate
the CoEs.
Expanded MTR Plan
8(e)(i)
Develop and implement plan to
ensure factual assertions in
foreclosure and bankruptcy
pleadings, declarations and
affidavits are accurate
Owner
Projected
Start
Date
7/15/11
Projected
Finish
Date
12/01/11
1/31/11
11/01/11
6/01/12
Assess if there are any other
pleadings, affidavits utilized in
Mortgage Servicing that should
be tested and if so, implement
testing plans
Expanded MTR Plan
8(e)(ii)
Develop and implement a plan to
ensure foreclosure affidavits were
signed and notarized in
accordance with LRRs
1/31/11
7/01/11
Expanded MTR Plan
8(e)(iii)
Develop and implement a plan to
test for the proper party to the
foreclosure and/or bankruptcy
actions
1/31/11
11/01/11
Expanded MTR Plan
8(e)(iii)
Develop and implement a plan to
include chain-of-title reviews for
loans in bankruptcy and
foreclosure
1/31/11
11/01/11
Expanded MTR Plan
8(e)(iv)
Develop and implement a testing
plan to review affidavits against
internal and external source data.
1/31/11
11/01/11
Expanded MTR Plan
8(f)
Develop and implement testing
plans to ensure that borrower
payments and borrower refunds
were credited in a prompt and
timely manner
7/15/11
12/01/11
18
Confidential Treatment Requested
Program Deliverable
CO
Section
Task
Expanded MTR Plan
8(g)
Expanded MTR Plan
8(h)
Owner
Projected
Start
Date
Projected
Finish
Date
Develop and implement a plan to
test for compliance with
contractual obligations of the
owner of the loan (investor
requirements)
7/15/11
6/01/12
Develop and implement a plan to
test fees based on the contractual
limitations in the loan documents
and to ensure compliance with
LRRs.
5/01/11
6/01/12
1/31/11
11/01/11
*Note: Some fee tests have
already been implemented and
will continue to be implemented
over the next 12 months.
Expanded MTR Plan
8(i)
Develop and implement
compliance testing for
foreclosure sales requirements
2/01/12
Develop and implement
compliance testing for post-sale
confirmations
Expanded MTR Plan
8(j)
Develop and implement a plan to
test loans for compliance with
Bankruptcy Legal Requirements
1/31/11
11/01/11
Expanded MTR Plan
8(k)
Deploy
or another tool to
support the MTR Plan for
Mortgage Servicing
7/15/11
6/01/12
Enhanced
Resource/Staffing Model
8(k)
Define required additional
resources and job functions
commensurate with the increase
in Compliance
plans/responsibilities described in
this response
4/01/11
07/11/11
Note: applies to all
deliverables
12/30/11
19
Confidential Treatment Requested
Appendix II – Mortgage Compliance Program Description
Ally Financial Inc.
Mortgage Line of Business
(“Mortgage”)
Compliance Program Description
May 30, 2011
Confidential – for Internal Use Only
Table of Contents
Page #
Section I: Overview and Scope………………………………………………………………………23
Section II: Governance………………………………………………………………………………..23
20
Confidential Treatment Requested
Section III: Four Compliance Principles……………………………………………………………..25
1. Compliance Commitment and Culture……………………………………………………………25
2. Controls …………………...………………………………….…………………………………….27
A. Controls and Supervision
B. Policies and Procedures
C. Monitoring and Testing
D. Training
3. Management Reporting and Analysis…………………………………………………………..35
4. Regulatory Oversight……………………………………………………………………………..36
21
Confidential Treatment Requested
Revision History
Section(s)
Updated
No.
Date
By
Reason for Update
1
September
2010
Compliance
Program Mgmt.
Template first published.
2
November 15,
2010
Mortgage Global
Compliance
Compliance program
revised to follow new
template.
All
Mortgage
Compliance
Revised to remove
imbedded documents,
which were no longer
current, and to update
various committee and
department names.
All
3
May 30, 2011
_________
22
Confidential Treatment Requested
Section I – OVERVIEW AND SCOPE
REQUIREMENT
1.
Description of how the Line of
Business (“LoB”) fits into the Ally
organizational structure.
DESCRIPTION
Mortgage (for the purposes of this Program) includes
the mortgage activities conducted by the following
entities:
Residential Capital, LLC and its direct and indirect
subsidiaries that are actively engaged in mortgage
business in the domestic U.S., including GMAC
Mortgage, LLC, Ditech, LLC, Executive Trustee
Services, LLC, ETS of Virginia, LLC, and Residential
Funding Company, LLC.
2.
High-level description of the LOB,
including products, services,
functions, processes, locations,
markets, client types and other
information helpful to an
understanding of the LoB.
Mortgage activities include the brokering, origination,
purchase, servicing, funding, sale and securitization of
residential mortgage loans secured by property in the
U.S.
3.
High-level description of the LoB
Compliance Department and
compliance risk management
infrastructure (e.g., policies and
procedures, monitoring & testing,
and training).
Ally’s Global Compliance and Regulatory Affairs
(Global Compliance) department is responsible for
developing and managing compliance policies and
procedures for mortgage loan origination and servicing
compliance activities, state licensing and regulatory
examination management, compliance training, and
compliance monitoring, testing and reporting.
Section II - GOVERNANCE
REQUIREMENT
1.
LoB governance committees or
oversight processes where
compliance risks are considered.
DESCRIPTION
Compliance risk issues are reported to Mortgage
senior leaders, business unit sales, operations and risk
leaders, and Legal. In addition, compliance risk issues
are reported to the Mortgage Operational Risk and
Compliance Committee, the ResCap Board or ResCap
Audit Committee, the Ally Compliance Risk Committee
or Risk Compliance Committee, Ally Bank’s CCO and
Ally’s CCO.
23
Confidential Treatment Requested
2.
Description of compliance roles and
responsibilities within the LoB.
Mortgage follows the Global Compliance Program
Statement about Lines of Defense. More specifically,
Mortgage is responsible to manage all compliance
risks applicable to its business. With respect to new
laws and compliance policies, Mortgage is responsible
to implement compliance policies and controls in a
timely and quality manner.
3.
Description of the overall planning
process specifically describing how
compliance risks and issues are
incorporated into business and
performance plans.
Global Compliance leaders participate in Mortgage
business planning and new product and program
development meetings to ensure that compliance risks
and issues are incorporated into business controls and
performance plans. Global Compliance leaders also
participate in Mortgage leadership meetings and
incentive compensation program meetings to ensure
that compliance risk issues are incorporate in the
performance plans.
4.
Description of how overall risk
appetite is determined and
specifically how compliance risk
appetite is factored into the
determination of overall risk
tolerance.
Mortgage considers its risk appetite and tolerance with
respect to new and existing products, programs, laws,
and compliance policies. More specifically, Mortgage
will work with Global Compliance to assess the risk
environment, severity, probability, and to monitor and
test risk controls.
5.
Description of the way in which
compliance risks are reported to
appropriate levels of management.
Compliance risks are reported verbally and in writing to
Mortgage leaders at weekly and monthly leadership,
operations, and compliance and risk meetings. In
addition, some compliance risk issues are reported to
the Mortgage Operational Risk and Compliance
Committee, ResCap Board, ResCap Audit Committee,
the Ally Compliance Risk Committee and the Ally
Board Risk Compliance Risk Committee.
6.
Description of how compliance
performance is measured.
Compliance performance is measured against Ally’s
Global Compliance Program Principles: 1)
Commitment and Culture; 2) Controls; 3) Management
Reporting and Analysis; and 4) Regulatory Oversight.
In addition, compliance performance is monitored and
tested through compliance assessments, practice
reviews, loan file reviews, and exception reporting.
24
Confidential Treatment Requested
Section III – FOUR PRINCIPLES
1. Commitment and Culture
REQUIREMENT
1.
Compliance Commitment
Description of how senior
management communicates their
compliance commitment to
employees, including whether this
occurs on a regular basis.
2.
Executive/Senior Management
Consideration of Compliance
Risks
DESCRIPTION
Senior management regularly communicates their
commitment to compliance by promoting a compliance
culture, training, self-testing, and ensuring that Global
Compliance has a prominent status in the company,
appropriate authority, and independent access to
resources.
Mortgage executives and senior leaders consider
compliance risks during leadership, operations,
strategy, and planning meetings.
Description of how compliance
impacts/risks are considered at
executive or senior management
strategy or planning meetings.
3.
Resources
Description of staffing levels,
qualifications and roles and
responsibilities in place to support
compliance-related functions within
the LoB. Description of the level of
technology resources dedicated to
supporting compliance and the
processes for obtaining funding for
projects/initiatives to manage current
and emerging risks.
4.
Reporting Compliance Issues and
Risks
Description of how compliance
issues and risks are incorporated
into risk reviews and LoB selfassessment processes and are
otherwise reported to management.
5.
Business Planning
Description of how compliance risks
Global Compliance staffing levels are determined by
Ally’s CCO and senior leadership team in consultation
with Mortgage leaders. Global Compliance leaders
must meet the job qualifications established by Ally’s
Global Compliance Program and have sufficient
compliance knowledge and experience to perform the
job responsibilities.
Global Compliance and Mortgage leaders work
together to dedicate technology resources to support
the Mortgage Compliance Program and to obtain
funding for projects and initiatives to manage and
control compliance risks.
Global Compliance publishes Regulatory Compliance
Bulletins, Compliance Policies, Compliance Manual
Updates, Compliance Alerts, Compliance Monitoring,
Testing and Reporting (“MTR”) results, and federal
and state regulatory guidance and examination
findings. Mortgage leaders utilize this information and
its own risk identification processes to build and
strengthen its risk controls, including risk reviews and
self-assessments.
Compliance risks and topics are considered during the
Mortgage business planning process and regular
weekly and monthly Mortgage senior leadership
25
Confidential Treatment Requested
6.
and topics are considered in
business planning.
meetings. Reports describing new regulatory risks
and Mortgage performance against existing
compliance requirements are considered in the
business planning process.
Employee Accountability
Mortgage leaders hold employees accountable for
compliance by establishing goals and objectives and
by monitoring performance through periodic
assessments and performance reviews.
Description of how employees are
held accountable for compliance
performance, including how they are
held accountable for violations of
company standards.
7.
Employee Performance
Description of how compliance roles,
accountabilities, and performance
expectations and results are
documented. Description of whether
they are included in job descriptions
and performance evaluations.
(Including how compliance roles,
accountabilities, and performance
expectations are communicated to
employees.)
8.
Identification and Mitigation
Process
Processes in place to identify and
address compliance gaps.
Description of how the LoB
evaluates new processes to
determine if compliance
requirements exist, identifies
changes in legal or regulatory
requirements relevant to the LoB,
identifies current and emerging risks,
and periodically reviews the
compliance program. (Including the
processes in place to address
compliance gaps and risks that are
identified.)
9.
Compliance Program Updates
Description of the process in place
to update the LoB compliance
program.
10.
New Products
Compliance roles, accountabilities, and performance
expectations are documented in job descriptions,
goals and objectives and incentive compensation
plans. Performance results are communicated to
employees through periodic assessments and during
performance reviews. Compliance roles and
responsibilities are also communicated to employees
through policies and procedures, training and
meetings.
Global Compliance works with Mortgage to evaluate
new products, programs, strategies and laws for
compliance issues and risks. Global Compliance has
established a process to identify compliance risk
issues and gaps through its compliance monitoring
and testing plans. Compliance gaps and risk issues
are reported to Mortgage leaders to perform root
cause analysis and corrective action. Corrective
action is monitored by Global Compliance and
reported to Mortgage leaders and Operations Risk for
tracking and reporting on the ResCap Open Matters
Control Report.
Global Compliance has established a process to
update the Compliance Program as needed and to
conduct a comprehensive compliance program review
each year.
New Products and Programs within Mortgage are
reviewed and approved by the Mortgage Credit Risk
Processes and activities that help
26
Confidential Treatment Requested
the LoB to validate that key
compliance risks are considered
early in new product and process
development. Including:
A description of how
compliance risks are
identified.
A description of how
appropriate stakeholders are
identified.
The role of LoB compliance
in the development process.
Committee.
Global Compliance representatives participate in new
product and program development and
implementation meetings to identify compliance risk
issues in an effort to establish controls to mitigate
compliance risks.
2. Controls
A. Controls and Supervision
REQUIREMENT
1.
Control Processes
Processes used to determine
whether appropriate controls are in
place to mitigate compliance risks.
(Including processes that determine
compliance program adequacy and
where controls are needed.)
2.
Develop/Enhance Controls
Processes to ensure that controls
are developed or enhanced when
weaknesses are identified.
(Including information on how action
plans are developed and the followup process for ensuring that
corrective action occurs as needed.)
DESCRIPTION
Working groups that consist of Global Compliance,
Legal and Mortgage representatives meet on a regular
basis to determine if appropriate controls are in place
to mitigate compliance risk in connection with new
products, programs, and laws and in connection with
the review of surveillance, monitoring and testing
results.
Controls are developed or enhanced when
compliance performance results indicate a control
weakness. Monitoring and testing results are shared
with Mortgage staff on a regular basis throughout the
testing cycle. Global Compliance provides
constructive guidance and advice related to
compliance risks and corrective actions necessary to
resolve regulatory violations; however, it is the
responsibility of Mortgage leaders to take immediate
corrective action to address any out-of-compliance
conditions.
The compliance monitoring and testing plan requires
Mortgage to perform root cause analysis and to
provide Global Compliance with its remediation plans
in response to compliance risk issues. The
compliance risk issues and remediation plans are
27
Confidential Treatment Requested
reported to senior leadership and follow up occurs on
a monthly basis. As needed, Mortgage will consult
with the Legal Department and Global Compliance to
discuss root cause analysis; possibilities of process or
systemic issues; remediation plans; and resolution of
current findings. Remediation plans are monitored
and specific reviews executed after corrective action
implementation to ensure the action effectiveness.
Transactional remediation plans are monitored
monthly by Global Compliance and resolved issues
are retested monthly for compliance. Significant
compliance risk issues and the corresponding action
plans are reported to Mortgage and Global
Compliance leaders and the appropriate councils and
governance committees.
3.
Governance
Description of any additional LoB
business unit governance
processes, not included in Section III
above.
4.
Supervisory Processes
Description of the supervisory
processes that are established to
oversee high-risk activities.
5.
Management Processes
Description of the supervisory and
management processes to oversee
employee actions.
6.
External Risks
Processes used to determine
whether controls are in place to
mitigate compliance risks arising
from the external environment and
events. Also, processes to ensure
that controls are developed or
enhanced whenever weaknesses
are identified.
7.
Tracking and Escalation
Description of how compliance risks
and issues are escalated in the LoB.
(Including information on whether
there are clear lines of authority, and
Within Mortgage, there are informal governance
processes and/or networks, working groups, councils
and project teams that meet on a regular basis to
discuss compliance risk issues and to develop or
enhance existing compliance controls.
Global Compliance performs targeted risk
assessments, monitoring, and testing for high-risk
activities. In addition, Internal Audit will serve as a
third line of defense and perform routine audits of
high-risk activities.
Managers and supervisors oversee employee actions
through the normal course of business. With respect
to compliance findings, Mortgage tracks some
compliance findings at the employee level and
provides employees with performance feedback and
counseling as appropriate.
Processes and controls are in place to identify and
mitigate compliance risks arising from the external
environment. External risk issues will follow the same
process as internal risk issues. More specifically, with
the identification of an external risk issue, a
compliance assessment or gap analysis will be
performed, which may result in the implementation of
new or enhanced compliance policies, surveillance,
and/or controls.
Compliance risks and issues are tracked using various
risk reports and databases, including the new law log,
new law past due implementation reports, risk issues
reports, exam finding summaries and MTR
summaries. Significant compliance risk issues are
escalated to the Global Compliance CCO, Legal, and
28
Confidential Treatment Requested
how escalation paths are established
and communicated to employees.)
Description of how issues are
followed through to ensure that
corrective action is completed as
required.
Mortgage leaders for decision and resolution.
Compliance risk issues are tracked through resolution
and include remediation, corrective action, and post
implementation testing.
B. Policies and Procedures
REQUIREMENT
1.
Policies and Procedures
Inventory
Indicate whether the LoB
maintains an inventory of policies,
procedures and guidelines with
which the LoB must comply and
provide a list of policies and
procedures manuals (or a
hyperlink when possible). Also,
describe how policies and
procedures are accessed by
employees and describe the
retention history and records
management processes that are in
place.
2.
Compliance Policies and
Procedures
Description of LoB’s compliance
policies and procedures.
(Including whether they are set
forth in a manual or integrated into
the LoB’s operating procedures.)
3.
Integration of Compliance in
Policies and Procedures
Description of how LoB-specific
policies and procedures are
documented, including a
description of how compliance
requirements are embedded into
policies, procedures and
processes.
DESCRIPTION
Global Compliance maintains Global Compliance
Policies and a Mortgage Compliance Policy Manual.
Some Mortgage business units also maintain policies
and procedures manuals that reference or summarize
compliance policies, procedures and controls. The
Global Compliance Policies and Mortgage Compliance
Policy Manual is available to all Associates and can be
accessed through the internal share point sites. The
business unit specific policies, procedures and
compliance alerts can be accessed through share point
sites, shared folders and team room sites on
The Global Compliance Policies and Mortgage
Compliance Policy Manual have version controls and
history tracking for changes.
Compliance policies are set forth in Global Compliance
Policies or the Mortgage Compliance Policy Manual.
However, business unit specific compliance policies (that
are more restrictive than the Global or Mortgage
Compliance Policies) are set forth in business unit
specific policies and procedural manuals.
Mortgage Compliance Policies are published in the
Mortgage Compliance Policy Manual and are
communicated to Associates in the form of Compliance
Manual Updates. Federal or state laws that are
currently summarized in the Mortgage Compliance
Manual are documented and communicated using
Regulatory Compliance Bulletins.
29
Confidential Treatment Requested
4.
Update and Approval Process
Processes in place for updating
and approving policies and
procedures. (Including information
on how Compliance is involved in
the process to ensure that
regulatory requirements are met.)
5.
Communication of New/Revised
Policies and Procedures
Description of how employees are
made aware of global and LoBspecific policies and procedures
and the process in place to
communicate new or updated
policies and procedures.
Compliance Policy updates and revisions to the
Mortgage Compliance Policy Manual are reviewed and
approved by Global Compliance Associates and a
regulatory attorney. New Compliance policies are
tracked in the Regulatory Compliance Database to
ensure that regulatory requirements are met in a timely
manner.
Employees are made aware of Global
Compliance and Mortgage Compliance policies through
regular meetings, training and the following
communications:
x
x
x
x
Compliance Manual Updates and Regulatory
Compliance Bulletins
Correspondent Funding Client Guide Bulletins
and Compliance Alerts
Consumer Services Memos and policy and
procedural updates
Servicing policies and procedures
C. Monitoring and Testing
REQUIREMENT
1.
Mapping Process
Processes for mapping laws,
regulations, and compliance risks to
appropriate policies, procedures,
controls, and monitoring activities.
DESCRIPTION
Global Compliance is responsible for mapping laws,
regulations, compliance risks to corresponding policies,
procedures, controls and monitoring activities and
works with Legal to inventory the laws and regulations
applicable to Mortgage and compliance risk
assessments.
Global Compliance tracks and identifies
changes to federal and state laws and
regulations affecting Mortgage. Sources used by the
Legislative Reporting unit include but are not limited to
AllRegs, HouseLaw, CompliSource, iComply and
various federal and state agency websites. All
applicable law changes are entered into an internal
Regulatory Compliance database ("the database").
The following information is captured related to each
entry: jurisdiction, bill number, effective date, reference
source, status, bill classification, brief description, and
web link to the text of the law. An alert is autogenerated from the database for each entry and is
sent to representatives for each of the impacted
Business Units within Mortgage and Global
Compliance’s MTR group. In addition to the alert,
30
Confidential Treatment Requested
each entry is also discussed in the weekly Compliance
Network Group forum, which includes representatives
from Global Compliance, Legal and Mortgage.
For significant law changes, Global Compliance will
prepare Compliance Manual Updates, which are
reviewed by Legal prior to distribution. These updates
include required actions to be taken by impacted
business units. Mortgage business units are
responsible for documenting the status of compliance
with each law change for their applicable business
units in the database and providing links to the
documentation supporting actions taken.
Implementation progress and concerns, as well as best
practices and other operational compliance issues are
discussed during regular Compliance Operations
meetings with Mortgage business units.
2.
Evaluation of Monitoring
Activities
Processes to identify and
periodically evaluate activities to be
monitored.
3.
Monitoring/Testing Process
Processes in place to identify
compliance issues and risks and to
ascertain the effectiveness of
adhering to applicable laws,
regulations, policies and
procedures. (Including how global
compliance issues such as AML,
Privacy, Information Security,
Conflicts, Ethics, Regulation W,
Regulation K, etc. are integrated
into these processes.)
New monitoring and testing activities are developed as
part of the implementation strategy for new laws,
products, programs, business process changes and
initiatives, examination reports and internal audits.
Risk Assessment Matrices have been prepared to
identify the compliance risk ratings and periodic risk
assessments will be conducted to evaluate the
activities being monitored. New laws and the overall
regulatory environment may also dictate the need to
evaluate the activities being monitored in order to
prioritize monitoring activities.
The Monitoring, Testing and Reporting (MTR)
Framework is conducted via multiple processes across
a variety of stages including, but not limited to:
x
x
x
x
x
Early, proactive involvement with Mortgage and
Global Functional areas during product and service
planning and scoping (to ensure compliance and to
build Mortgage compliance strategies from
inception);
Monitoring, testing and exception reporting
activities to evaluate compliance performance;
Engagement with the legislative change
management process (state and federal) with
aspirations to expand to non-United States laws
and regulations to ensure Mortgage Compliance
MTR Framework testing is conducted with the
latest laws and regulations;
Review and compliance oversight of marketing
initiatives, including engagement with new product
and new business development processes,
advertising and marketing collateral review and
approval and model build processes;
Transactional and targeted compliance reviews;
31
Confidential Treatment Requested
x
x
Sales, origination and servicing reporting and
analysis; and
Origination and servicing compliance risk
assessments.
The Mortgage Compliance MTR Framework approach
is dynamic and is re-evaluated no less frequent than
annually based on identified risks and changes to Ally
and Mortgage strategies and Products.
4.
Monitoring and Testing Plan
Processes to maintain a current
monitoring and testing plan for
activities to be monitored.
(Including a high-level description of
monitoring/testing processes,
including scope, frequencies and
accountabilities.)
The Monitoring, Testing and Reporting Team within
Global Compliance monitors Mortgage business units
for compliance through performing a variety of
monitoring and testing strategies.
Monitoring
The Monitoring approach evaluates compliance
performance with federal and state laws and
regulations and is primarily targeted at specific
operational areas or business processes established
as preventative and detective controls. Monitoring is
conducted via two (2) primary ways:
x
x
Surveillance – Reports are comprised of
information that looks for patterns, issues, identified
gaps or areas needing further analysis; and
Exception Reports - Reports are comprised of
information, which produces results that indicate
non-compliance with applicable laws or regulations.
Testing
Product Transactional Reviews include testing for
completeness, accuracy, and validity of compliance
documentation, processes, controls, and data accuracy
relied upon throughout the Product transaction. Part of
this process will conduct standard periodic statistical
and stratified reviews and risk-based/targeted
compliance reviews that include both risk-focused and
process-oriented approaches to assess the quality of
risk controls.
Product Transactional Targeted Reviews can either be
recurring on a periodic/rotating timeline or through a
one-time evaluation. In addition to testing Products
post funding (originated or acquired), the MTR Team
tests non-funded actions to ensure compliance with
applicable federal and state laws and regulations.
32
Confidential Treatment Requested
Compliance Assessments:
The compliance assessment approach is to assess and
measure risk by identifying issues and patterns,
evaluating the completeness, accuracy and validity of
compliance documentation, processes, control, and data
accuracy relied upon throughout the Product lifecycle.
The MTR Team reviews Mortgage policies, procedures
and operating systems; systemic controls (e.g., required
fields in system of record); training on policies, procedures
and services; and, process designs that incorporate and
comply with applicable laws and regulations.
Corrective Action:
Global Compliance collaborates with Mortgage business
unit staff to determine root cause and to provide
constructive guidance and advice related to compliance
risk and corrective actions necessary to resolve identified
issues. Mortgage business unit’s staff are required to
review MTR Framework re quality issues and required
changes to ensure compliance. As process or systemic
issues are identified, remediation plans are created to
resolve current findings and/or prevent future findings
through process or system improvements. It is the
responsibility of Mortgage leaders to take prompt
corrective action to address any out-of-compliance
conditions. Subsequent reviews performed by MTR Team
will be conducted as needed to ensure that corrective
action by Mortgage is lasting and effective.
5.
Monitoring and Testing Results
Processes for reporting monitoring
and testing results to management.
(Including information on frequency,
distribution and trending.)
6.
Customer Complaints
Description of how customer
complaints are investigated,
analyzed and reported to
management.
Reports are prepared by the MTR Team within Global
Compliance. Working with other risk partners, as needed,
the preliminary reports are distributed in draft format to
Mortgage. Mortgage is provided one business week with
the opportunity to respond to, dispute and/or clear any
factual inaccuracies prior to the issuance of the final
report. Global Compliance evaluates Mortgage
Operation’s responses, modifies the preliminary draft
report, as appropriate, and issues the final report.
Following response review, the final report is provided to
Mortgage leaders and various governance
Customer complaints are investigated and resolved by
Mortgage business units in the normal course of
business. Escalated customer complaints are referred
to the Voice of Customer department within Mortgage
for investigation, root cause analysis, tracking,
reporting and response preparation, tracking and
reporting. Escalated complaints include, but are not
limited to complaints from regulators, attorneys,
customer advocacy groups and borrower complaints
directed to Mortgage leaders. Some escalated
33
Confidential Treatment Requested
customer complaints are referred to Legal or Global
Compliance for investigation and/or review and
approval of the response and corrective action.
D. Training
REQUIREMENT
1.
Annual Learning Goals and
Curriculum
Description of how Compliance is
integrated in this process for
determining annual employee
learning goals and curriculum.
2.
Compliance Competencies
Description of how compliance
competencies are integrated into
LoB processes.
3.
Communication
Description of the communication
process (es) in place to enhance
employees’ awareness of
compliance-related topics.
DESCRIPTION
Global Compliance will determine the minimal
compliance training requirements for new hires and
existing compliance associates. Compliance training is
monitored and performance reports are provided to
Global Compliance and Mortgage leaders on a regular
basis.
Compliance competencies are integrated into Mortgage
processes through training and education, policies and
procedures.
Employees are made aware of Global Compliance
policies through regular meetings, training and the
following communications.
x
x
x
x
4.
Metrics
Description of how training is
tracked and measured.
Global Compliance Manual Updates and
Regulatory Compliance Bulletins
Correspondent Funding’s Client Guide Bulletins
and Compliance Alerts
Consumer Services memos and policy and
procedural updates
Servicing Compliance Advisories and updates to
Servicing’s online policies and procedures.
Compliance training is tracked and measured using
Ally’s learning management system. The following
training metrics are utilized by Global Compliance and
Mortgage to track compliance training: 90% completion
rate and 80% pass rate.
34
Confidential Treatment Requested
5.
Needs Assessment
Processes in place for identifying
compliance training and
communication needs (e.g.,
monitoring results, new
regulations, audit or examination
findings, litigation).
6.
Employee Awareness
Processes for determining
whether employees have an
adequate awareness of laws and
regulations and apply it in the
course of performing their job
function and responsibilities.
7.
Training Adequacy
Global Compliance conducts periodic needs
assessments for compliance training for Mortgage
requirements. Global Compliance personnel also
meeting with Mortgage leaders to develop the
compliance training framework and calendar.
Employee awareness is determined through training and
self-testing results and through performance
assessments and performance appraisals.
Compliance training is developed and/or reviewed and
approved by Global Compliance and Legal.
Processes for determining
whether adequate training exists
on the application of compliance
policies and procedures.
(Including information on how
training programs and materials
are developed, reviewed and
approved.)
3. Management Reporting and Analysis
REQUIREMENT
1.
Management reports
Inventory/list of management
reports that address compliance
(e.g., summarize monitoring and
testing results, key risks, risk
assessments, emerging risks,
compliance violations,
resolution activities, exam and
audit issues and significant
business initiatives).
DESCRIPTION
The following is a current list of some of the management
reports that address compliance.
x
x
x
x
x
x
New Law log
Compliance MTR transaction, summary,
surveillance and rolling calendar reports
Month End Regulatory Compliance Past Due
Implementation Report
Federal and State Regulatory Examination Findings
Reports
Risk Issues Reports
Risk Assessments
35
Confidential Treatment Requested
2.
Reporting
Description of how compliance
issues and risks are reported.
(Including information regarding
the distribution and the
frequency of the reports and
how both are determined.)
3.
Regulatory Reports
Description of the process to
determine whether regulatory
reports contain accurate and
complete information, and are
filed as required.
4.
Metrics
Description of the metrics that
are in place to measure
compliance performance.
(Including information on the
frequency of the metrics and
how results are reported to
management.)
5.
Risk Level and Direction
Processes used to analyze
compliance risk results
(including risk assessments) in
order to report level and
direction of compliance risk into
the integrated planning process.
The general framework of the Mortgage Compliance
Program is to provide compliance risk guidance, assess
compliance risk controls, communicate results, and
generally, monitor business-based programs. See also the
MTR program.
Reports and information requested by regulators is
collected and tracked by Global Compliance. For state
licensing and examination reports, Global Compliance has
implemented a quality control process to review regulatory
reports for completeness and accuracy.
Global Compliance provides compliance risk guidance,
assesses compliance risk controls, communicate results,
and generally, monitor business-based programs. When a
violation of a federal regulation, state law, investor
requirement and/or internal policy is confirmed and
reported, the error is reported as a compliance finding .
Global Compliance subscribes to several industry
publications and utilizes those publications and feedback
from peers, investors, regulators and clients to assess and
monitor the external environment in order to integrate risk
controls into Mortgage planning processes.
4. Regulatory Oversight
REQUIREMENT
1.
Inventory
Process for maintaining and
updating an inventory of
applicable federal, state and
country laws, regulations and
guidelines, including risk ratings.
(Including a description of
processes for maintaining a
DESCRIPTION
An Inventory of Laws and MTR Compass is maintained
with respect to federal state regulations and guidelines.
In addition, the Legislative Reporting Unit within Global
Compliance is responsible for tracking and identifying all
changes to federal and state laws and
regulations affecting Mortgage. Sources used by the
Legislative Reporting unit include but are not limited to
AllRegs, HouseLaw, CompliSource, iComply and various
federal and state agency websites. All applicable law
36
Confidential Treatment Requested
2.
business specific inventory and
whether global compliance issues
[AML, Privacy, Information
Security, Conflicts, Ethics,
Regulation W, Regulation K, etc.]
are appropriately considered.)
changes are entered into an internal Regulatory
Compliance database.
Emerging Risks
Emerging compliance risks and issues may be identified
through formal risk assessments, regulatory examination
guidance and findings, MTR results and through
information received from internal partners (Audit, Legal)
and external sources (clients, investors, regulators,
peers, etc…).
Processes that are in place to
forecast emerging compliance
issues and risks. (Considering
sources of information and
partners [Audit, Legal, etc.] who
assist in determining potential
risks.)
3.
Regulatory Changes
Description of how regulatory
changes are identified and the
process for providing feedback on
proposed regulatory changes and
final rules. (Considering who
reviews the changes and
determines potential impact and
processes for addressing
changes that impact the
organization.)
4.
Stakeholders
Processes used to ensure that all
impacted stakeholders participate
in analyzing business impacts
resulting from changes to laws
and regulations.
The Legislative Reporting Unit within Global Compliance
is responsible for tracking and identifying all
changes to federal and state laws and
regulations affecting the organization. Sources used by
the Legislative Reporting unit include but are not limited
to AllRegs, HouseLaw, CompliSource, iComply and
various federal and state agency websites. All
applicable law changes are entered into an internal
Regulatory Compliance database. Updates include
required actions to be taken by impacted business units.
Mortgage business unit representatives are responsible
for documenting the status of compliance with each law
change for their applicable business units in the database
and providing links to the documentation supporting
actions taken. Implementation progress and concerns,
as well as best practices and other operational
compliance issues are discussed in the bi-weekly
Compliance Operations meeting.
Global Compliance enters applicable changes to existing
laws and/or new laws into the internal Regulatory
Compliance database. An alert is auto-generated from
the database for each entry and is sent to the designees
for the Business Units impacted by the change and to the
MTR unit to determine the impact to its testing
methodology and procedures. In addition to the alert,
each entry is discussed in the weekly Compliance
Network Group forum, which includes representatives
from Global Compliance, Legal and Mortgage.
For significant law changes, Global Compliance drafts
Compliance Manual Updates, which are reviewed by
Legal prior to distribution. These updates include
required actions to be taken by impacted business units.
Mortgage business units are responsible for documenting
the status of compliance with each law change for their
37
Confidential Treatment Requested
applicable business units in the database and providing
links to the documentation supporting actions taken. If
actions are not taken within an allotted timeframe an
escalation report is generated and distributed monthly.
Implementation progress and concerns, as well as best
practices and other operational compliance issues are
discussed in the bi-weekly Compliance Operations
meeting.
5.
Communicating Regulatory
Changes
Processes in place for
communicating regulatory
changes and new business
requirements to employees within
the LoB.
6.
Ongoing Meetings with
Regulators
Description of how LoB
management meets with the
regulators on a regular basis and
appropriately reacts to the level of
regulatory scrutiny.
7.
Examinations
Description of the process for LoB
management to respond to
requests from the regulators as
part of regulatory examinations or
investigations. (Including how
examinations or investigations
are managed by the LoB.)
8.
Examination Findings
Process for responding to
regulatory findings resulting from
examinations or investigations.
(Including processes to ensure
that corrective action is taken on
regulatory findings as required.)
Regulatory changes and new business requirements are
communicated in the weekly Compliance Network Group
and bi-weekly Compliance Operations meetings and by
distributing and publishing Compliance Policies,
Compliance Manual Updates, Regulatory Compliance
Bulletins and Business unit Compliance policies and
procedures.
Global Compliance will facilitate meetings and
communications with the federal and state regulators that
oversee Mortgage in an effort to build processes to
assess and understand the regulatory environment, to
influence that environment and to build good faith and
constructive relationships with regulators that are
essential to the Mortgage Compliance Program.
Global Compliance will work with Mortgage and Legal to
coordinate the response to any inquiries, questions
and/or information and document requests from the
regulator as part of regulatory examinations and
investigations. Global Compliance will work with
Mortgage to establish processes to ensure that
documents and information provided to regulators is
accurate and provided in a timely manner.
The process for responding to regulatory findings
resulting from examinations or investigations usually
involves the creation of a working group or project team
with business representatives from Global Compliance,
Legal, and Mortgage. The team will meet to discuss
response and corrective action strategies. In many
instances, additional information may be required to
respond to an examination or investigation findings, so
the working group will continue to meet until the
examination has been closed and the corrective action is
complete.
38
Confidential Treatment Requested
GMAC Mortgage, LLC
Mortgage Electronic Registration System
Prepared for the Board of Governors of the Federal Reserve System & the Federal Deposit
Insurance Corporation
Revised December 2, 2011
Confidential Treatment Requested
1
Table of Contents
Plan Overview for Mortgage Electronic Registration System ............................................ 3
Description and Use of MERS ............................................................................................... 4
Principles Guiding the Program ............................................................................................ 5
Consent Order Response…….................................................................................................6
Summary / Conclusion...........................................................................................................16
Appendix I - Project Summaries.......................................................................................... 17
Appendix II - Board Level Deliverables and Due Dates .................................................... 18
Appendix III - First Level Project Details .......................................................................... 18
Confidential Treatment Requested
2
Plan Overview for Mortgage Electronic Registration System
This Program for the Mortgage Electronic Registration System action plan (the “Program”) is
established in response to the Consent Order dated April 13, 2011 (the “Order”) among the
Board of Governors of the Federal Reserve System ( the “FRB”), the Federal Deposit
Insurance Corporation (the “FDIC”), Ally Bank (the “Bank”), Ally Financial Inc. (“Ally
Financial” or “AFI”), and certain of Ally Financial’s direct and indirect subsidiaries including
Residential Capital, LLC (“ResCap”) and GMAC Mortgage, LLC (“GMACM” and together
with Rescap, the "Mortgage Servicing Companies"). Capitalized terms not defined in the
Program shall have the meanings assigned to them in the Order.
The purpose of this Program is to set forth the actions and responsibilities necessary
for GMACM to comply fully with its obligations under Section 9 of the Order (see the
Principles Guiding the Proposal section of this Program). Section 9 of the Order requires
that GMACM take the following actions:
Within 60 days of this Order, the GMAC Mortgage shall submit an acceptable plan to ensure
appropriate controls and oversight of the Mortgage Servicing Companies’ activities with
respect to MERS and compliance with MERS’ membership rules, terms, and conditions
(“MERS Requirements”) (“MERS Plan”). The MERS Plan shall include, at a minimum:
(a) Processes to ensure that all mortgage assignments and endorsements with respect
to mortgage loans serviced or owned by the Mortgage Servicing Companies out
of MERS’ name are executed only by a certifying officer authorized by MERS
and approved by the Mortgage Servicing Companies;
(b) Processes to ensure that all other actions that may be taken by MERS certifying
officers (with respect to mortgage loans serviced or owned by the Mortgage
Servicing Companies) are executed by a certifying officer authorized by MERS
and approved by the Mortgage Servicing Companies;
(c) Processes to ensure that the Mortgage Servicing Companies maintain up-to-date
corporate resolutions from MERS for all Mortgage Servicing Companies
employees and third-parties who are certifying officers authorized by MERS, and
up-to-date lists of MERS certifying officers;
(d) Processes to ensure compliance with all MERS Requirements and with the
requirements of the MERS Corporate Resolution Management System;
(e) Processes to ensure the accuracy and reliability of data reported to MERS,
including monthly system-to-system reconciliations for all MERS mandatory
reporting fields, and daily capture of all rejects/warnings reports associated with
registrations, transfers, and status updates on open-item aging reports.
Unresolved items must be maintained on open-item aging reports and tracked
until resolution. The Mortgage Servicing Companies shall determine and report
whether the foreclosures for loans serviced by the Mortgage Servicing
Companies that are currently pending in MERS’ name are accurate and how
Confidential Treatment Requested
3
many are listed in error, and describe how and by when the data on the MERS
system will be corrected;
(f) An appropriate MERS quality assurance workplan, which clearly describes all
tests, test frequency, sampling methods, responsible parties, and the expected
process for open-item follow-up, and includes an annual independent test of the
control structure of the system-to-system reconciliation process, the
reject/warning error correction process, and adherence to the MERS Plan; and
(g) Inclusion of MERS in the Mortgage Servicing Companies’ third-party vendor
management process, which shall include a detailed analysis of potential
vulnerabilities, including information security, business continuity, and vendor
viability assessments.
In response to the Order, GMACM has prepared on behalf of the Mortgage Servicing
Companies this Program for the Mortgage Servicing Companies relating to Item 9 of the
Order and the requirements therein.
Description and Use of MERS
The mortgage banking industry created Mortgage Electronic Registration Systems, Inc. to
streamline the mortgage process by using electronic commerce to eliminate paper and better
enable mortgage asset trading. Mortgage Electronic Registration Systems Inc. ("MERS") is a
bankruptcy-remote subsidiary of MERSCORP, Inc. whose sole purpose is to serve as
mortgagee in the land records for loans registered on the MERS System and governed by the
membership rules of MERSCORP, Inc. and MERS, Inc. In many cases, MERS is named as
nominee in the county land records for the lender and servicer via specific language in the
original security instrument. When MERS is named as the original mortgagee/beneficiary, it
is by means of specific language in that original document (otherwise known as “MOM”
language). Lenders or servicers may also assign security instruments to MERS as nominee if
MOM language was not included at the time of origination (“Non-MOM” loans).
The use of MOM language in security instruments has been approved by Fannie Mae,
Freddie Mac, Ginnie Mae, FHA and VA, the California and Utah Housing Finance Agencies,
as well as all of the major Wall Street rating agencies. Fannie Mae and Freddie Mac adopted
standard MERS security instrument language for use in their uniform documents for each
state.
The MERS System, a proprietary electronic registry operated by MERS, although not the
legal system of record, was designed to electronically track those security instruments
incorporating MOM language at origination ("MOM Loans"), of non-MOM loans and, if
applicable, future transfers of beneficial rights in the loans and those security instruments to
subsequent investors. Because MERS remains the mortgagee or beneficiary in the land
records, transfers do not require additional assignments unless transferring servicing to a nonMERS member.
Parties who benefit from the existence of MERS and its operation of the MERS System
include mortgage originators, servicers, warehouse lenders, wholesale lenders, retail lenders,
document custodians, settlement agents, title companies, insurers, investors, county recorders
Confidential Treatment Requested
4
and consumers. These benefits are derived from an increase in efficiency in the residential
mortgage transfer process as loans remaining registered on the MERS System avoid the need
to file assignments in the county land records (except in circumstances where a MERS rule
requires such an assignment). This lowers costs for lenders and consumers while better
enabling transfer of beneficial ownership interest and mortgage servicing rights.
Additionally, the MERS System provides benefits by serving as a central source of
information and tracking for mortgage loans registered.
The Mortgage Servicing Companies utilize the MERS System when acting in a servicing,
subservicing, investor, interim funder, custodial, or other MERS-associated capacity for
residential mortgage loans.
Principles Guiding the Program
The cornerstone of the Program is the comprehensive review of compliance with the terms of
the membership rules of MERS throughout the Mortgage Servicing Companies. This review
was initiated and remains underway in order to facilitate the development of the Program. As
a result of this review, the Mortgage Servicing Companies are planning, and in some cases
implemented, the following actions relating to their ongoing use of MERS:
(1) Establishing a MERS Relationship Manager (completed)
(2) Establishing a MERS Council (completed)
(3) Developing and implementing the Mortgage Servicing Companies’ MERS Policy and
Procedures by October 1, 2011
(a) MERS Policy
(b) MERS Certifying Officer Procedure
(c) MERS Governance Change Management Procedure
(d) MERS Servicing Transfer Procedure
(e) MERS Beneficial Interest Transfer Procedure
(f) MERS Foreclosure Activity Procedure
(g) MERS Bankruptcy Activity Procedure
(h) MERS Recovery Procedure
(i) MERS Check Endorsement Procedure
(j) MERS Lien Release Procedure
(k) MERS Servicing Change Management Procedure
(l) MERS Data Reconciliation Procedure
(m) MERS Warehouse Lending Procedure
(n) MERS Registration Procedure
(o) Pledge Activity Procedure
(p) MERS eNote Transaction Procedure
Confidential Treatment Requested
5
(4) Developing and implementing a MERS Quality Assurance Workplan by February 1,
2012
(5) Enhancing and implementing a MERS data validation model which identifies data
discrepancies (between the MERS and servicing systems) by November 2011
(6) Including MERS in the Mortgage Servicing Companies’ enhanced third party vendor
management process by February 1, 2012
The Mortgage Servicing Companies are the process of performing reviews of remedial
actions and Appendix III provides a summary of the nature of the reviews and details on the
remedial actions.
Consent Order Response
A. Consent Order Response to Section 9a
Consent Order section 9a requires:
(a) Processes to ensure that all mortgage assignments and endorsements with respect
to mortgage loans serviced or owned by the Mortgage Servicing Companies out
of MERS’ name are executed only by a certifying officer authorized by MERS
and approved by the Mortgage Servicing Companies;
GMACM initiated a review of the Mortgage Servicing Companies’ certifying officer process
in March 2011 and concluded its first round assessment in May. GMACM is currently in the
process of completing its certifying officer assessment and will bring this review to closure
by the beginning of September 2011. As a result of this review, GMACM plans to take at
least the remedial actions noted in Appendix III and described below.
GMACM is performing a review of document signers to evaluate each individual’s status as
an employee and officer of the relevant Mortgage Servicing Company, MERS function and
certified officer status with MERS. MERS requires that a certifying officer is an officer of
the Member or has signing authority. Revised corporate resolutions have been developed as
a result of this initial document signer review, and MERS ratified the initial of these
corporate resolution submissions on May 17, 2011.
Although not formally codified by MERS, the Mortgage Servicing Companies are also
currently evaluating pending MERS rule changes, which could potentially require additional
assignment or endorsement activity. The pending foreclosure/bankruptcy rule change is
fairly consistent with the current policies of the Mortgage Servicing Companies, which
require the execution of an assignment out of MERS' name before executing the first legal
action related to a foreclosure proceeding or issuing a proof of claim in a bankruptcy
proceeding. MERS is continuing to evaluate its pending assignment rule change and
clarifying its intentions. As such, the Mortgage Servicing Companies will further augment its
policy and procedures once MERS fully communicates its rule change details.
Confidential Treatment Requested
6
The Mortgage Servicing Companies began drafting the proposed MERS policy and
procedures in April 2011 and will implement them in October 2011. These documents
include appropriate processes and reviews to ensure that the execution of mortgage
assignments and endorsements out of MERS' name are performed by a certifying officer
approved by MERS and authorized by the Mortgage Servicing Companies. The documents
detail processes such as how to add certifying officers to corporate resolutions, remove
certifying officers from corporate resolutions and change information relating to certifying
officers. They also address quarterly corporate resolution reconciliation and annual corporate
resolution recertification requirements.
The Mortgage Servicing Companies are also evaluating ways to improve the tracking of its
assignment activities from preparation through execution, notarization, and subsequent
recordation. In the interim, non-automated solutions have been designed as reflected within
the proposed policy and procedures; however, potential long-term solutions are under
evaluation with consideration of an enhancement to existing management information
systems and/or entering into a third-party relationship with a company offering document
tracking and reporting solutions. The Mortgage Servicing Companies started evaluating
these solutions in June 2011 and will institute an implementation plan upon completion of
their review in October 2011. The timing to implement the long-term solution will be March
2012.
Attached to this Program are copies of the following draft documents referred to in this
section:
x Appendix A: Draft MERS Policy
x Appendix B: Draft MERS Certifying Officer Procedure
x Appendix C: Draft MERS Governance Change Management Procedure
x Appendix D: Draft MERS Servicing Transfer Procedure
x Appendix E: Draft MERS Beneficial Interest Transfer Procedure
x Appendix F: Draft MERS Foreclosure Activity Procedure
x Appendix G: Draft MERS Bankruptcy Activity Procedure
x Appendix H: Draft MERS Recovery Procedure
x Appendix I: Draft MERS Check Endorsement Procedure
B. Consent Order Response to Section 9b
Consent Order section 9b requires:
(b) Processes to ensure that all other actions that may be taken by MERS certifying
officers (with respect to mortgage loans serviced or owned by the Mortgage
Servicing Companies) are executed by a certifying officer authorized by MERS
and approved by the Mortgage Servicing Companies;
As documented in section 9A of this Program, GMACM initiated a review of the Mortgage
Servicing Companies’ certifying officer process in March 2011 and concluded its first round
assessment in May. GMACM is currently in the process of completing its certifying officer
assessment and will bring this review to closure by the beginning of September 2011. As a
Confidential Treatment Requested
7
result of this review, GMACM plans to take at least the remedial actions noted in Appendix
III and summarized below.
GMACM is performing a review of document signers to evaluate each individual’s status as
an employee and officer of the relevant Mortgage Servicing Company, MERS function and
certified officer status with MERS. MERS requires that a certifying officer is an officer of
the Member or has signing authority. Revised corporate resolutions have been developed as
a result of the initial document signer review, and MERS ratified the initial of these corporate
resolution submissions on May 17, 2011.
The Mortgage Servicing Companies also began drafting the proposed MERS policy and
procedures, as mentioned previously in section 9A of this Program, and they include the
appropriate processes and reviews to ensure that the execution of mortgage assignments and
endorsements out of MERS' name are performed by a certifying officer approved by MERS
and authorized by the Mortgage Servicing Companies. These policy and procedure
document will be implemented by October 2011.
The Mortgage Servicing Companies are also considering reducing reliance on third-parties
for document execution including the cessation of an outsourcing relationship for MERSrelated lien release execution. An implementation plan was developed in May 2011 and fully
executed resulting in all MERS-related lien release execution activities being administered by
employees of GMACM.
Attached to this Program are copies of the following draft documents referred to in this
section:
x Appendix A: Draft MERS Policy
x Appendix B: Draft MERS Certifying Officer Procedure
x Appendix C: Draft MERS Governance Change Management Procedure
x Appendix J: Draft MERS Lien Release Procedure
x Appendix K: Draft MERS Servicing Change Management Procedure
C. Consent Order Response to Section 9c
Consent Order section 9c requires:
(c) Processes to ensure that the Mortgage Servicing Companies maintain up-to-date
corporate resolutions from MERS for all Mortgage Servicing Companies
employees and third-parties who are certifying officers authorized by MERS, and
up-to-date lists of MERS certifying officers;
GMACM is performing a review of the Mortgage Servicing Companies’ certifying officer
process and corporate resolution processes as documented in section 9A of this Program. The
review began in March 2011 and the first round assessment was completed in May.
GMACM is currently in the process of completing its certifying officer assessment and will
bring this review to closure by the beginning of September 2011. As a result of this review,
GMACM plans to at least take the remedial actions noted in Appendix III and summarized
below.
Confidential Treatment Requested
8
GMACM is performing a review of document signers to evaluate each individual’s status as
an employee and officer of the relevant Mortgage Servicing Company, MERS function and
certified officer status with MERS. MERS requires that a certifying officer is an officer of
the Member or has signing authority. Revised corporate resolutions have been developed as
a result of the document signer review and MERS ratified the initial of these corporate
resolution submissions on May 17, 2011.
As an action under the Program, the Mortgage Servicing Companies began a process in April
2011 to resign certain Organization Identification Numbers ("Org ID") and associated
corporate resolutions that are no longer necessary for the Mortgage Servicing Companies and
are in the process of evaluating additional resignation opportunities. The review will
conclude by September 2011 with the Mortgage Servicing Companies ultimately retaining a
small number of Org ID numbers and associated corporate resolutions.
GMACM has proposed an enhanced corporate resolution process whereby the associates
responsible for many MERS-related activities ("MERS Team") would perform quarterly
reconciliations and annual recertifications of certifying officers listed on the Mortgage
Servicing Companies’ outstanding corporate resolutions. Additionally, the MERS Team
would perform an annual OrgID certification as outlined in the MERS policy and procedure
documents the Mortgage Servicing Companies began drafting in April 2011 and will
implement by October 2011. These activities will be subject to oversight from the MERS
quality assurance function proposed in the MERS Quality Assurance Workplan which the
Mortgage Servicing Companies began drafting in May 2011 and will implement by February
2012.
Attached to this Program are copies of the following draft documents referred to in this
section:
x Appendix A: Draft MERS Policy
x Appendix B: Draft MERS Certifying Officer Procedure
x Appendix C: Draft MERS Governance Change Management Procedure
x Appendix Q: Draft MERS Quality Assurance Workplan
D. Consent Order Response to Section 9d
Consent Order section 9d requires:
(d)
Processes to ensure compliance with all MERS Requirements and with the
requirements of the MERS Corporate Resolution Management System;
GMACM is performing a review of the Mortgage Servicing Companies’ use of MERS to
ensure compliance with MERS Requirements and with requirements of the MERS Corporate
Resolution Management System. As a result of this review, GMACM plans to take at least
the remedial actions noted in Appendix III.
GMACM is in the process of executing a campaign to educate its outside default counsel on
the Mortgage Servicing Companies’ pre-foreclosure and pre-bankruptcy assignment policy,
which requires an assignment of the security interest out of MERS’ name to be executed prior
to performing first legal action (foreclosure) or issuing a proof of claim (bankruptcy) and a
Confidential Treatment Requested
9
prompt submission for recording of the executed assignments. This campaign includes
announcements to and conference calls with the outside default counsel network and the
implementation of enhanced oversight of the policy and communication of remediation
efforts. GMACM initiated a pre-first legal action assignment policy in October 2010 and
further coordinated the change in February 2011 by holding a mandatory conference call to
discuss the policy change with its outside default counsel. After MERS sent its proposed
foreclosure and bankruptcy assignment rule change, GMACM further updated its assignment
policy and held a mandatory conference call with its outside default counsel in April 2011 to
review the pre-first legal action assignment policy changes and address questions posed by its
outside default counsel.
A quality control oversight process focusing on a review of at least 10% of the assignments
required to be executed before the filing of first legal action for compliance with the outside
default counsel policy was initiated in January 2011.
GMACM is continuing to work with the Mortgage Servicing Companies’ default
counsel network on the policy adherence. GMACM also cautioned the default counsel
network in April 2011 that non-compliance with the policy may result in strong punitive
actions up to, and including, the dismissal of services and/or a pass-through of MERS’
proposed $10,000 fine per non-compliant foreclosure action. GMACM is also formalizing
plans to address foreclosures where assignments were not completed in compliance with
MERS’ proposed rule change. This evaluation started in February 2011 and is in addition to
the aforementioned review conducted prior to foreclosure sale.
The Mortgage Servicing Companies view the process of maintaining compliance with the
assignment preparation and execution policy over such a large default counsel network as
having a potential elevated inherent risk to their operations. With this in mind, the Mortgage
Servicing Companies began evaluating the possibility of insourcing and/or outsourcing to a
vendor (with the Mortgage Servicing Companies continuing to execute the assignments) the
preparation and recording of these assignments so that the associated risks may be better
controlled. The Mortgage Servicing Companies began this evaluation in May 2011 and
anticipate the outcome of this analysis, which will be available by July 2011, will
demonstrate if the potential elevated level of inherent risk may support the new approach.
Contingent upon this conclusion, the Mortgage Servicing Companies may develop an
assignment insourcing and/or vendor solution implementation plan. The Mortgage Servicing
Companies would anticipate a phased-in implementation, which would start by redirecting
the assignments currently prepared by non-compliant default counsel networks. While the
Mortgage Servicing Companies may implement new measures in September 2011, it is
recognized that there may be significant levels of investment required to hire and properly
train the appropriate assignment staff which would result in a full implementation target date
of November 2011; if applicable.
The Mortgage Servicing Companies are also evaluating ways to improve the tracking of its
assignment activities from preparation through execution, notarization, and subsequent
recordation. In the interim, manual solutions have been designed as reflected within the
proposed policy and procedures; however, potential long term solutions are under evaluation
with consideration of an enhancement to existing management information systems and/or
entering into a third-party relationship with a company offering document tracking and
reporting solutions. The Mortgage Servicing Companies began evaluating these solutions in
Confidential Treatment Requested
10
June 2011 and will institute an implementation plan upon completion of their review in
October 2011.
The Mortgage Servicing Companies will also implement enhancements to the frequency and
formality of reporting for certain transactions that require MERS System updates. An
example of these enhancement activities will be the establishment of minimum required
information inclusions and reporting frequencies for relevant transactions requiring
communication to the MERS Team for pledging and recovery transactions. A review of this
reporting began in May 2011 and will conclude by August 2011. The results of these
anticipated enhancements are contemplated within the draft MERS policy and procedure
documentation which the Mortgage Servicing Companies began drafting in April 2011 and
will implement in October 2011.
In April 2011, the Mortgage Servicing Companies dedicated a specific employee resource
with an organizational title of "MERS Relationship Manager" who is responsible for
compliance with all MERS membership rules and announcements including, without
limitation, monitoring for changes in MERS Requirements and compliance with the
requirements of the MERS Corporate Resolution Management System. The establishment of
the MERS Relationship Manager role will increase the frequency and quality of
communication with MERS representatives and the employee resource is responsible for
strengthening the Mortgage Servicing Companies’ relationship with MERS. This employee
resource also maintains authorization to attend MERS membership meetings, conferences,
and other events to represent the Mortgage Servicing Companies and is responsible for
coordinating the comment process for MERS proposed rules. The MERS Relationship
Manager position was designed to focus on MERS risk assessment, oversight of the MERS
process and to provide periodic reporting to executive management and the Board.
The Mortgage Servicing Companies also established a "MERS Council" which consists of
the MERS Relationship Manager and management representatives from business units
associated with or affected by MERS Requirements. This Council meets quarterly, or more
frequently if necessary, to discuss proposed revisions to the MERS Requirements and other
topics of interest with relevance to the MERS Requirements. The initial MERS Council
meeting took place in April 2011 and the Mortgage Servicing Companies further expanded
the audience in June 2011.
The Mortgage Servicing Companies are drafting a MERS quality assurance workplan to
more effectively oversee key MERS transaction processing activities. The drafting process
started in May 2011 and the Mortgage Servicing Companies will implement the MERS
quality assurance workplan by February 2012. Included within the proposed responsibilities
of the MERS quality assurance function will be, amongst other items, to test for adherence to
MERS Requirements and with the requirements of the MERS Corporate Resolution
Management System. Reporting will be delivered to Executive and Middle Management,
Operational Risk Management, Legal, Compliance and other related parties as appropriate to
ensure exceptions and planned remedial actions related to MERS Requirements and the
MERS Corporate Resolution Management System are broadly communicated via the MERS
Council. Further, the proposed MERS quality assurance workplan will grant the quality
assurance function authority to launch action plans, as appropriate, based upon repeated or
elevated levels of non-compliance.
Confidential Treatment Requested
11
GMACM is drafting a redesign of its data validation process to align with MERS' current and
revised reporting model. This redesign process began in May 2011 and includes the potential
development of new fields on the Mortgage Servicing Companies’ primary servicing
information system and re-development of the data feed from this information system to the
MERS System. The Mortgage Servicing Companies are awaiting MERS' launch of new data
reporting functionality and resolution of dialogue regarding the necessity of certain data
fields to continue their redesign drafting efforts. The Mortgage Servicing Companies will
implement this enhanced reporting model by September 2011 and will then engage in the
process of updating the MERS information/data to align with the MERS rules. The model
will expand as MERS releases more details regarding their final data formats and
requirements.
MERS is also working on a proposed rule change, MERS Policy Bulletin – Number 2011-3,
where Members may be under an obligation to appoint a legal point person who will be
responsible for notifying MERS of certain litigation events. This rule change is still under
evaluation and is being worked on by MERS. We will further evaluate the impact of this
proposed rule change once MERS releases additional details and, if appropriate, further
adjust the MERS policy and procedures.
Attached to this Program are copies of the following draft documents referred to in this
paragraph:
x Appendix A: Draft MERS Policy
x Appendix B: Draft MERS Certifying Officer Procedure
x Appendix C: Draft MERS Governance Change Management Procedure
x Appendix D: Draft MERS Servicing Transfer Procedure
x Appendix E: Draft MERS Beneficial Interest Transfer Procedure
x Appendix F: Draft MERS Foreclosure Activity Procedure
x Appendix G: Draft MERS Bankruptcy Activity Procedure
x Appendix H: Draft MERS Recovery Procedure
x Appendix I: Draft MERS Check Endorsement Procedure
x Appendix J: Draft MERS Lien Release Procedure
x Appendix K: Draft MERS Servicing Change Management Procedure
x Appendix M: Draft MERS Warehouse Lending Procedure
x Appendix N: Draft MERS Registration Procedure
x Appendix O: Draft MERS Pledge Activity Procedure
x Appendix P: Draft MERS eNote Transaction Procedure
x Appendix Q: Draft MERS Quality Assurance Workplan
Confidential Treatment Requested
12
E. Consent Order Response to Section 9e
Consent Order section 9e requires:
(e) Processes to ensure the accuracy and reliability of data reported to MERS,
including monthly system-to-system reconciliations for all MERS mandatory
reporting fields, and daily capture of all rejects/warnings reports associated with
registrations, transfers, and status updates on open-item aging reports.
Unresolved items must be maintained on open-item aging reports and tracked
until resolution. The Mortgage Servicing Companies shall determine and report
whether the foreclosures for loans serviced by the Mortgage Servicing
Companies that are currently pending in MERS’ name are accurate and how
many are listed in error, and describe how and by when the data on the MERS
system will be corrected;
GMACM is performing a review of the Mortgage Servicing Companies MERS data integrity
process. As a result of this review, GMACM plans to take at least the remedial actions noted
in Appendix III.
As previously referenced, GMACM is drafting a redesign of its data validation process to
align with MERS' current and revised reporting model. The redesign will expand to include
the data fields MERS requires for validation and will identify variances requiring validation
and subsequent MERS updates. This redesign project began in May 2011 and includes the
potential development of new fields on the Mortgage Servicing Companies’ primary
servicing information system and re-development of the data feed from this information
system to the MERS System. The Mortgage Servicing Companies are awaiting MERS'
launch of new data reporting functionality and resolution of dialogue with MERS regarding
the necessity of certain data fields to continue their redesign drafting efforts. The Mortgage
Servicing Companies will implement this enhanced reporting model by September 2011 and
will then engage in the process of updating the MERS information/data to align with the
MERS rules. The model will expand as MERS releases more details regarding their final
data formats and requirements.
GMACM is also working with its Investor Reporting department to develop a solution for
validating the investors and associated Org IDs. They began this project in May 2011 and
anticipate completing the validation process by October 2011 and, based on the findings, will
work with MERS to incorporate the appropriate changes.
Additionally, GMACM is in the process of evaluating the additional data fields which may
require reconciliation prospectively related to MERS Announcement Bulletin 2011-02,
Changes to MERS Procedures, in preparation for transition of the current draft revisions to
final and authoritative MERS Quality Assurance Procedures. The Mortgage Servicing
Companies began its evaluation in April 2011 and are awaiting MERS' launch of new data
reporting functionality and data files from MERS to finalize their redesign efforts. Provided
MERS finalizes its requirements shortly, the Mortgage Servicing Companies will implement
its reconciliation solution by October 2012. AFI recognizes that during this data validation
process certain data fields were and will be identified as requiring update due to either
changes in allowable MERS practices or the existence of previously inaccurate data. The
revised system-to-system reconciliation process will allow for the identification of these
Confidential Treatment Requested
13
items which will be corrected within the MERS System. This revised reconciliation solution
is an expansion of an existing database that we are in the process of enhancing to include
additional data fields and enhance the data variance analysis. GMACM anticipates working
directly with MERS to execute these system updates in a manner that would prevent
inaccurate or unnecessary generation of communication to underlying borrowers.
In March 2011, GMACM also began reviewing the use of the daily capture MERS
reject/warnings reports associated with registrations, transfers, and status updates. After this
review began, it was discovered that these reports were created significantly through manual
interaction. Automated solutions are required to enhance the audit trail and operational
effectiveness of the exception reporting. GMACM has undertaken a project to begin
evaluating automation solutions to the day-to-day processing activities; however, in the
interim, it will continue to evaluate exception reporting in the current state environment.
GMACM will complete its evaluation in October 2011.
GMACM initiated a detailed review of its foreclosure reporting process and the interaction of
the Mortgage Servicing Companies' MERS Team and Foreclosure department. This process
began in the spring resulting in proposing certain enhancements and incorporating them in
the draft MERS foreclosure procedures. These procedures will be fully implemented by
October 2011. GMACM is also reviewing and streamlining the reporting process from the
Foreclosure department related to assignment execution and recordation. The foreclosure
status field on the MERS System has historically been based upon the corresponding loan
foreclosure status on the Mortgage Servicing Companies management information systems.
MERS recently informed its Members that they are removing the use of this foreclosure
status field on the MERS System.
Also, as a result of the new reporting between the MERS Team and Foreclosure department,
the MERS Team began updating the MERS System to deactivate loans that were in
foreclosure and had an executed assignment. During this process, which began in April and
concluded in June, the MERS Team updated the MERS System with the required assignment
details.
Attached to this Program are copies of the following draft documents referred to in this
section:
x Appendix A: Draft MERS Policy
x Appendix F: Draft MERS Foreclosure Activity Procedure
x Appendix L: Draft MERS Data Reconciliation Procedure
F. Consent Order Response to Section 9f
Consent Order section 9f requires:
(f) An appropriate MERS quality assurance workplan, which clearly describes all
tests, test frequency, sampling methods, responsible parties, and the expected
process for open-item follow-up, and includes an annual independent test of the
control structure of the system-to-system reconciliation process, the
reject/warning error correction process, and adherence to the MERS Plan; and
Confidential Treatment Requested
14
GMACM is performing a review of MERS' Quality Assurance Procedure Manual. As a
result of this review, GMACM plans to take at least the remedial actions noted in Appendix
III.
GMACM is performing a review of the existing control procedures in place and intends to
provide oversight over its MERS activities performed by the Mortgage Servicing Companies.
As a result of the review, an appropriate MERS quality assurance workplan was drafted in
May 2011 to enhance the Mortgage Servicing Companies' existing coverage over key MERS
transaction processing activities and to meet the requirements of the MERS Quality
Assurance Procedures Manual. This workplan will be implemented by February 2012.
This draft workplan is proposed to formalize certain key considerations of quality control
including, but not limited to:
x
x
x
x
x
x
Department objective;
Sampling methodology;
Loan review procedures and testing templates;
Reporting;
Action plans; and
Training
The draft quality assurance workplan includes items such as an annual independent test of the
control structure of the system-to-system reconciliation, the reject / warning error correction
process, and adherence to the policies and procedures produced through the development of
the Program. This workplan will effectively meet the terms of the membership rules of
MERS and the Mortgage Servicing Companies’ risk-based objectives.
The proposed development of a more robust quality assurance function will also require
significant resource investment by the Mortgage Servicing Companies. A staffing model is
currently being developed to estimate the required resource commitment necessary to meet
the periodic testing requirements. It is anticipated that the Mortgage Servicing Companies
would need to increase the staffing of the quality assurance function and identify resources
with sufficient understanding of the MERS process to execute the MERS quality assurance
workplan. As mentioned previously, the quality assurance workplan remains under
development and the Mortgage Servicing Companies will implement the MERS quality
assurance workplan by February 2012.
Attached to this Program are copies of the following draft documents referred to in this
section:
x Appendix A: Draft MERS Policy
x Appendix Q: Draft MERS Quality Assurance Workplan
G. Consent Order Response to Section 9g
Consent Order section 9g requires:
(g) Inclusion of MERS in the Mortgage Servicing Companies’ third-party vendor
management process, which shall include a detailed analysis of potential
Confidential Treatment Requested
15
vulnerabilities, including information security, business continuity, and vendor
viability assessments.
GMACM is performing a review of the Mortgage Servicing Companies’ third-party vendor
management process and will begin adopting its new Supplier policies and procedures by
February 2012. As a result of this review, GMACM plans to at least take the remedial
actions noted in Appendix III.
GMACM was required to submit proposed policies and procedures in relation to Order Item
6: Third Party Management. MERS, as a third-party provider, is included within the scope
of revised Third Party Management policies and procedures, which includes performance of
detailed analyses of potential vulnerabilities, including information security and vendor
viability assessments.
Due to the unique nature and related complexities of the MERS relationship and the
industry’s reliance on MERS, the Mortgage Servicing Companies previously evaluated and
in May re-evaluated, but did not identify, an adequate 3rd party replacement for MERS as a
business continuity/contingency measure. If required, a prospective cessation of the
Mortgage Servicing Companies’ use of MERS would likely result in significant operational
and financial burdens. Operational changes such as adjusting origination documents,
origination workflow, lending and servicing platforms, post-closing assignment workflow
and servicing sale/transfer workflow would likely result. And, if the Mortgage Servicing
Companies initiated efforts to assign existing MERS loans/servicing out of MERS’ name,
they would likely do so based on a priority queue considering characteristics such as default
curves/roll-forward forecasts and projected local recording office recordation timeframes.
Such measures would not only impact the Mortgage Servicing Companies, but would also
negatively impact:
x Consumer pricing;
x The timeliness of recordation in local recording offices which could extend the
recording timeline by more than a year; and
x Foreclosure and bankruptcy proceedings which could realize unforeseen implications.
Summary / Conclusion
GMACM is performing a MERS review and produced this Program to improve the use of
MERS throughout the Mortgage Servicing Companies. The implementation of MERS
policies and procedures, a MERS Quality Assurance Workplan, a strengthened MERS data
validation tool, MERS in the Third Party Management Program and the addition of some
administrative measures will provide for additional control and will help to mitigate the
Mortgage Servicing Companies’ risk profile related to the use of MERS. The Mortgage
Servicing Companies, consistent with practices for other established policies and procedures,
will periodically review and revise its MERS policy, procedure and quality workplan
documents as appropriate, but no less frequently than annually, based upon changes to the
operational execution of certain MERS-related tasks or to the MERS Requirements.
Furthermore, we anticipate MERS will issue additional rule changes, further refinements to
Confidential Treatment Requested
16
proposed rule changes in the queue and potential changes to MERS’ business model based on
its consent order responses.
The timelines expressed throughout this Program are subject to refinement based on MERS’
proposed rule changes, new changes proposed by MERS, the outcome of the enterprise-wide
compliance program approval (Order section 7), risk assessment program recommendation
and subsequent approval (Order section 12) and enterprise risk management program
approval (Order section 14).
Appendix I - Project Summaries
Below is a summary of the projects that support the Program:
Action Plans:
1. Implement a risk framework
2. Implement the policies and procedures
Draft Policies, Procedures and Quality Assurance Workplan Documents:
Appendix A: Draft MERS Policy
Appendix B: Draft MERS Certifying Officer Procedure
Appendix C: Draft MERS Governance Change Management Procedure
Appendix D: Draft MERS Servicing Transfer Procedure
Appendix E: Draft MERS Beneficial Interest Transfer Procedure
Appendix F: Draft MERS Foreclosure Activity Procedure
Appendix G: Draft MERS Bankruptcy Activity Procedure
Appendix H: Draft MERS Recovery Procedure
Appendix I: Draft MERS Check Endorsement Procedure
Appendix J: Draft MERS Lien Release Procedure
Appendix K: Draft MERS Servicing Change Management Procedure
Appendix L: Draft MERS Data Reconciliation Procedure
Appendix M: Draft MERS Warehouse Lending Procedure
Appendix N: Draft MERS Registration Procedure
Appendix O: Draft MERS Pledge Activity Procedure
Confidential Treatment Requested
17
Appendix P: Draft MERS eNote Transaction Procedure
Appendix Q: Draft MERS Quality Assurance Workplan
Appendix II - Board Level Deliverables and Due Dates
NA
Appendix III - First Level Project Details
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
MERS
Document
Execution
MERS
Relationship
Manager
MERS’
proposed
foreclosure and
bankruptcy
policy
adherence
MERS QC
Multiple
Conduct an initial review of document
signers
MERS
Relat Mgr.
3/31/11
5/01/11
9(d)
Establish MERS Relationship Manager
Executive
Mgmt
3/01/11
4/01/11
9(d)
Implement punitive action plans against
default counsel that are
with assignment foreclosure and
bankruptcy policy
Legal /
Operations
4/01/11
4/21/11
Multiple
QC
1/15/11
5/30/11
Cease MERSrelated Lien
Release
Execution
Outsourcing
Activity
MERS Council
9(b)
Implement a quality control oversight
process on a review of 10% of the
assignments required to be executed
before the filing of first legal foreclosure
activities and alignment with the pre-first
legal foreclosure assignment policy
Develop and execute plan to bring
MERS-related lien release execution
process in-house
MERS
Relat Mgr.,
Servicing
4/01/11
5/18/11
9(d)
Establish MERS Council
MERS
Relat Mgr.
4/16/11
6/30/11
MERS’
proposed
foreclosure and
bankruptcy
policy
adherence
MERS’
proposed
foreclosure and
bankruptcy
policy
adherence
9(d)
Continue working with default counsel
network on assignment foreclosure and
bankruptcy policy adherence
Legal /
Operations
11/01/10
12/31/11
9(d)
Formalize plans to address preforeclosure sale loans
MERS’ policy
Servicing
2/15/11
12/31/11
Confidential Treatment Requested
18
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
Validate and
re-issue
Corporate
Resolutions
Multiple
MERS
Relat Mgr.
4/01/11
9/1/11
MERS
Document
Execution
Review Org ID
Multiple
Perform review to validate that certifying
officers meet minimum MERS
requirements and all employees
performing applicable duties have been
approved as a MERS Certifying Officer
Complete the review of document signers
MERS
Relat Mgr.
4/15/11
9/01/11
9/01/11
9(d)
MERS
Relat Mgr.
Legal,
MERS
Relat Mgr.
4/01/11
Assignment
Insourcing
5/01/11
7/31/11
Enhance data
validation
process
Develop new
transaction
reporting
Reconciliation
9(e)
MERS
Relat Mgr.
5/01/11
10/01/11
MERS
Relat Mgr.
5/15/11
8/31/11
10/01/11
9(a)
MERS
Relat Mgr.
MERS
Relat Mgr.,
IT
3/01/11
Assignment
Tracking Tool
Review organizational IDs and associated
Corporate Resolutions
Evaluate insourcing and/or other
centralized vendor solution of default
counsel network assignment preparation
and recording
Work with Investor Reporting department
to develop a solution for validating the
investors and associated Org IDs.
Enhance existing reporting of pledging
activities and recovery sales to ensure
timely update of the MERS System
Conduct review of daily capture report
output
Implement interim assignment tracking
tool and develop preferred long-term
organization solution
Short Term
Solution:
4/15/11
Short Term
Solution:
6/30/11
Long Term
Solution
Evaluation:
6/01/11
Long Term
Solution
Evaluation:
10/01/11
Long Term
Solution
Implementati
on:
10/01/11
4/01/11
Long Term
Solution
Implementat
ion:
3/31/12
10/01/11
4/01/11
10/01/11
4/15/11
9/23/11
4/15/11
10/01/12
9(c)
9(d)
Multiple
MERS Policy
Multiple
MERS
Procedures
Enhance data
validation
model
Reconciliation
Multiple
Multiple
Multiple
Finish drafting and implement the MERS
policy
Finish drafting and implement the MERS
procedures
Introduction of an enhanced MERS data
validation model
MERS
Relat Mgr.
MERS
Relat Mgr.
MERS
Relat Mgr.
Evaluate additional data fields required
by MERS for reconciliation process and
implement the enhanced MERS data
validation solution
MERS
Relat Mgr.
Confidential Treatment Requested
19
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
Finish
Date
Assignment
Insourcing
9(d)
Legal
Not
Applicable
Not
Applicable
3rd Party
Vendor
Management
Implement
quality
assurance
workplan
9(g)
If applicable, implement insourcing
and/or other centralized vendor solution
of default counsel network assignment
preparation and recording
Inclusion of MERS in the Mortgage
Servicing Companies’ third-party vendor
management process
Finish drafting and implement the MERS
Quality Assurance working plan and
associated staffing and the initiation of
testing cycles.
MERS
Relat Mgr.
10/31/11
2/01/12
Risk
5/01/11
2/01/12
Multiple
Confidential Treatment Requested
20
ALLY FINANCIAL INC.
GMAC Mortgage, LLC and Residential Capital, LLC
Management Information Systems
Prepared for the Board of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
December 1, 2011
1
Confidential Treatment Requested
Table of Contents
Plan Overview for Management Information Systems……………………………………3
Principles Guiding this Plan…………………………………………………………………4
Consent Order ……………………………………………………………………………….5
Summary / Conclusion……………………………………………………………………...12
Appendix I - Steps for the Review Plan…………………………………………………...13
Appendix II - Board Level Deliverables and Due Dates………………………………….13
Appendix III - First Level Plan Details……………………………………………………14
2
Confidential Treatment Requested
Plan Overview for Management Information Systems
This Action Plan (“Plan”) is established in response to the Consent Order dated April 13,
2011 (the "Order") among the Board of Governors of the Federal Reserve Bank (the "FRB"),
the Federal Deposit Insurance Corporation (the "FDIC"), Ally Bank (the "Bank"), Ally
Financial Inc. ("Ally Financial" or "AFI"), and certain of Ally Financial's direct or indirect
subsidiaries including Residential Capital, LLC ("ResCap") and GMAC Mortgage, LLC
("GMACM") and together with ResCap, the "Mortgage Servicing Companies". Capitalized
terms not defined in the Plan shall have the meaning assigned to them in the Order.
The purpose of this Plan is to set forth the actions taken and responsibilities necessary for the
Mortgage Servicing Companies to comply fully with their obligations under Section 10 of the
Order (see Appendix I). Section 10 of the Order requires:
Within 60 days of this Order, GMAC Mortgage shall submit to the Reserve Bank an
acceptable plan and timeline for the review and remediation, as necessary, of the
Mortgage Servicing Companies’ management information systems (“MIS”) for their
residential mortgage loan servicing, loss mitigation, and foreclosure activities to ensure
the timely delivery of complete and accurate information to permit effective decisionmaking. The plan shall, at a minimum, provide for:
(a) A description of the various MIS used or to be used by the Mortgage Servicing
Companies;
(b) a timetable for completion of the review;
(c) a timetable for the remediation of any identified deficiencies; and
(d) new systems or enhancements to the MIS to:
(i)
(ii)
(iii)
(iv)
monitor compliance with the Legal Requirements, supervisory guidance of
the Board of Governors, and the requirements of this Order;
ensure the ongoing accuracy of records for all serviced mortgages,
including, but not limited to, records necessary to establish ownership and
the right to foreclose by the appropriate party for all serviced mortgages,
outstanding balances, and fees assessed to the borrower;
ensure that the Loss Mitigation and foreclosure staffs have sufficient and
timely access to information provided by the borrower regarding Loss
Mitigation and foreclosure activities; and
ensure that the single point of contact has sufficient and timely access to
information provided by the borrower regarding Loss Mitigation and
foreclosure activities; and
(e) Testing the integrity and accuracy of the new or enhanced MIS to ensure that
reports generated by the system provide necessary information for adequate
monitoring and quality controls.
3
Confidential Treatment Requested
The Mortgage Servicing Companies have prepared this Plan as a response to Section 10 of
the Order and the requirements therein.
Principles Guiding this Plan
The Mortgage Servicing Companies define MIS as a system or process that provides the
information necessary to manage their operations effectively. MIS includes vendor-managed
and in-house developed applications, databases and end-user tools that are sources of
management information and reports utilized by the business to make effective decisions
regarding strategic goals and objectives.
This MIS plan focuses on the MIS review and remediation action plans outlined to
specifically address the items in Section 10 of the Order.
The foundation of the Plan is the identification and inventory of all MIS used by the
Mortgage Servicing Companies to deliver information that permits effective decisionmaking. The MIS inventory enables the Mortgage Servicing Companies to take the
following actions:
x Develop a comprehensive MIS review plan
x Develop a remediation plan
x Evaluate potential enhancements or new MIS
The inventory was built following interviews and information gathering sessions with the
following business units who provided the information required to define and update the
inventory of applications, databases, and end-user developed tools (also referred to as MIS)
used or to be used throughout the organization. The business units identified below include
all units contained in the servicing operations.
Business Units Interviewed:
x Customer Care and Collections
x Portfolio Management & Servicing
Strategies: Servicing Analytics and
Reporting
x Investor Operations
x Special Servicing
x Quality Assurance & Operational Control
x Bankruptcy
x Compliance / Legal
x
x
x
x
x
x
x
x
Loss Mitigation - Liquidations
Loss Mitigation Fulfilment
REO
Foreclosure
EOTS (Servicing IT)
Quality Control/Quality Assurance
Training
Internal Audit
A centralized IT function, Enterprise Operations Technology Solutions (“EOTS”), maintains
and supports the primary residential mortgage loan servicing, data warehouse and record
management systems, that are both internally and vendor supported. These systems are the
primary source and system of record for management reporting, monitoring and document
storage.
4
Confidential Treatment Requested
In addition to the centrally-managed EOTS applications, the Mortgage Servicing Companies
identified and documented the applications, databases and end-user developed tools within
the Business Units, that also support daily operations. These MIS include end-user
developed databases and tools used by the business to track and analyze data, monitor and
report results that are used in decision-making.
The Mortgage Servicing Companies also use a number of third-party vendors, which support
a range of business functions. Each business unit has designated resources to interact with
their vendors. Some of the outsourced service providers maintain systems outside of the
Mortgage Servicing Companies. This includes vendors providing back office support.
The following functions depend on MIS for reporting and decision making: Board Oversight,
Compliance Program, Single Point of Contact, Training, Mortgage Electronic Registration
System, Third Party Management, Foreclosure Review and Servicing Management and
Oversight. The Mortgage Servicing Companies have worked and will continue to work in
conjunction with all teams responding to the Consent Order. As these programs and plans
are completed and are approved, the Mortgage Servicing Companies will review new
systems, enhancements or changes to the MIS. This review will refine the inventory and
remediation timelines to appropriately address all MIS related matters proposed by the Board
Oversight Plan (Order Section #2), Single Point of Contact Plan (Order section #5),
Compliance Program (Order Section #8), Mortgage Electronic Registration System Plan
(Order Section #9), and the outcomes of the Foreclosure Review (Order Section #3).
Consent Order Response
A. Consent Order Response to Section 10a
Consent Order Section 10a requires:
(a) A description of the various MIS used or to be used by the Mortgage Servicing
Companies
The MIS inventory includes:
x MIS Name - Name of the application or system
x Description - Description of the purpose and use of the MIS
x Type - Defines MIS category e.g. application, database, tool, spreadsheet
x Area - Defines primary business group(s) using the MIS
x Supported by - Defines group or user(s) responsible for supporting the management /
ongoing operations of the MIS (e.g. development, maintenance)
In creating the inventory, the Mortgage Servicing Companies performed the following
procedures:
x Conducted interviews and information gathering sessions to inventory and catalogue
the MIS used throughout the organization
5
Confidential Treatment Requested
x
x
x
Inquired about the access to information and timeliness and accuracy of information
needed to perform job functions
Developed and documented our understanding of the MIS' purpose and use
Reviewed results of prior year SAS 70, internal and external audits, regulatory reports
and examinations for MIS deficiencies that could impact the timeliness, completeness
and accuracy of information used in decision-making
The Mortgage Servicing Companies catalogued approximately 300 MIS, of which 34%
are vendor-managed (includes business and centrally managed IT supported by the
Enterprise Operations Technology Solutions (EOTS team), 43% business-managed, and
23% central IT-managed.
Of the approximately 300 MIS identified, the following five core MIS support
residential mortgage loan servicing, loss mitigation and foreclosure activities, each of
these are centrally supported by EOTS.
x
- The
loan servicing system ("
maintained and supported
by
Lending Solutions, a third party information management systems and data
processing service provider.
is the primary system of record for the
Mortgage Servicing Companies’ loan servicing operations.
is a
comprehensive mortgage servicing system encompassing key loan stages from loan
boarding through payoff and default management.
consists of both
online/real-time and batch processing and interactive access and updating of all
records, includes loan boarding, cash/payment processing, investor reporting, escrow
administration, online collection, customer service, payoff, adjustable rate mortgage
processing, and default management.
x
–
is a communication system
utilized by the Mortgage Servicing Companies for all Foreclosure attorneys and
includes electronic referrals, critical data from
and all necessary
documents for referral. Process Management allows timeline management including
customization of steps, referral holds and issues. The Foreclosure, Loss Mitigation
and Bankruptcy business units are the users of the system. The
system is maintained and supported by EOTS.
x
–The Mortgage Servicing Companies utilize the
data warehouse and a
reporting tool to consolidate and
report upon data primarily from
and
. The data
from
is fed to the
data warehouse on a daily basis through an
automated batch process. The data warehouse is also maintained and supported by
the vendor,
x
is a web-based tool used to access
reports, letters and forms.
is used by all Servicing business units. The application is supported by EOTS.
6
Confidential Treatment Requested
x
/
–
is a document repository for imaged documents.
houses loan documents and
is the tool used to view the
documents.
and
are used by all Servicing business units.
is a vendor application that is supported internally by the Global Imaging
Team.
is an internally developed tool and is also supported by the
Global Imaging Team.
A complete list of identified MIS can be found in Appendix IV.
B & C. Consent Order Response to Section 10b and 10c
Consent Order Section 10b and 10c requires:
(b) A timetable for completion of the review;
(c) A timetable for the remediation of any identified deficiencies;
(b) A timetable for completion of the review;
The Mortgage Servicing Companies will complete the MIS review ("Review Plan") by
the end of first quarter 2012. The Review Plan will include an evaluation of the
approximately 300 systems and associated processes established to ensure timely
delivery of complete and accurate information. The review will be prioritized to ensure
the most significant MIS, those used in default related processing are reviewed first.
The Review Plan includes the following procedures:
x Gain an understanding of what level, granularity and frequency of information is
required to manage the business risk at the various levels of the organization
including Line Management, Senior Management, Board level as well as by Audit,
Risk, Compliance and Control functions.
x
Understand MIS gaps/needs identified in the other action plans being submitted in
accordance with the Consent Order including the Board Oversight Plan (Order
Section #2), Single Point of Contact Plan (Order section #5), Compliance Program
(Order Section #8), Mortgage Electronic Registration System Plan (Order Section
#9), and the outcomes of the Foreclosure Review (Order Section #3).
x
Perform MIS study to identify gaps and deficiencies. This will include the
following:
o Conduct walkthroughs and working sessions with key stakeholders within the
Business Unit and EOTS to understand the end-to-end process (data and system)
flow and understand whether management performs QA/QC checks to ensure
completeness and accuracy of data used in management reporting.
o Identify and analyze the accuracy of reports used by management for decisionmaking.
7
Confidential Treatment Requested
o Review management's and system's quality control checks and/or trace data
utilized within the report back to the source system(s) to determine whether
appropriate data integrity checks are established and effective.
o Conduct interviews with key stakeholders within the Business Unit and IT to
determine whether IT controls are established and being followed to ensure MIS
meets business needs (e.g. security, change management, data validation, disaster
recovery/contingency, etc)
x
Perform MIS requirements analysis to assess whether systems continue to produce
reports used in decision- making and whether system functionality can or should be
migrated to the core loan servicing platform or EOTS. Consideration will be given
to the following:
o What are the business / regulatory requirements and are they being met?
o What are Business Unit risks?
o What is the level of technical sophistication required to support the system?
o What is the volume of transactions?
o How many users access the system?
o How many locations are accessing the system?
o What system security (physical and logical) risks exist?
o What system infrastructure risks exist?
o Develop plan with Business Units to categorize (i.e. remain in Business Unit,
retire the system or move system to EOTS) MIS to ensure company's
compliance, operational, and financial objectives are met. Short-term and longterm solutions will be identified along with priority and resource needs.
8
Confidential Treatment Requested
(c) Timetable for the remediation of any identified deficiencies;
Upon completion of the Review Plan, the Mortgage Servicing Companies plan to
analyze all deficiencies identified, score and categorize each deficiency based on the
complexity of MIS and associated risks/impact to the completeness and accuracy of the
information utilized for decision-making. Based on the categorization, remediation
action plans will be developed and implemented. The timeframes and prioritization are
based on the risk associated with the deficiency and level of effort required to remediate
the root cause. High-risk and short-term remediation efforts including consideration of
mitigating controls, will be addressed immediately and longer-term actions will be
implemented as noted in the matrix following.
Prioritization of Remediation Plans
and Associated Timeframes
Catego
rization
of
D fi i
High Risk- Deficiencies that
significantly impact completeness
and accuracy of information used
for decision-making.
Medium Risk- Deficiencies that
will have some impact to
completeness and accuracy of
information used for decisionmaking.
Low Risk - Deficiencies that will
have limited or no impact on the
completeness and accuracy of
information used for decisionmaking.
Remediation Level of Effort
Minimum Moderate Significant requires
requires some
requires major MIS
enhancements to
minor MIS
enhancements / new
policy, procedures
enhancements
systems along with
and/or controls and
along with updates
updates to policy,
training.
to policy,
procedures and/or
procedures and/or
controls and training.
controls and
training.
6 months
9 months*
up to 24 months*
9 months
9 months
up to 24 months
Remediate after 24
months**
Remediate after 24
months**
Remediate after 24
months**
* Note: The first priority will be High-Risk deficiencies. This may include shortterm remediation efforts such as implementing mitigating controls while longerterm solutions are being developed.
**Formal plans to remediate low risk items will not be developed until after all
high and medium risk deficiencies are addressed.
Refer to Appendix I and III for work to be performed to complete the review and
remediate deficiencies and Appendix V for review and remediation timelines.
D. Consent Order Response to Section 10d
Consent Order Section 10d requires:
9
Confidential Treatment Requested
(c) New systems or enhancements to the MIS to:
a. Monitor compliance with the Legal Requirements, supervisory guidance of
the Board of Governors, and the requirements of this Order
b. Ensure the ongoing accuracy of records for all serviced mortgages,
including, but not limited to, records necessary to establish ownership and
the right to foreclose by the appropriate party for all serviced mortgages,
outstanding balances, and fees assessed to the borrower
c. Ensure that the Loss Mitigation and foreclosure staffs have sufficient and
timely access to information provided by the borrower regarding Loss
Mitigation and foreclosure activities; and
d. Ensure that the single point of contact has sufficient and timely access to
information provided by the borrower regarding Loss Mitigation and
foreclosure activities
i) Monitor compliance with the Legal Requirements, supervisory guidance of
the Board of Governors, and the requirements of this Order
Monitoring of compliance is currently the primary responsibility of Mortgage
Compliance and the Mortgage Servicing QA/QC function.
A plan to augment the current Mortgage Servicing QA/QC system,
is being
developed. Initial discovery concluded
was not a viable option. As an
alternative, third party software
is targeted to support the need for random
statistical data sampling requirements. EOTS will work closely with the Mortgage
Servicing QA/QC team to define the additional business requirements in the fourth
quarter of 2011 and implement the necessary system to ensure effective monitoring of
compliance with legal and regulatory requirements in 2012.
As processes are refined, EOTS will continue to work with the Mortgage Business
Unit to enable compliance changes within the systems. For more detail, see the
response to Section 7 of the Order.
ii) Ensure the ongoing accuracy of records for all serviced mortgages,
including, but not limited to, records necessary to establish ownership and
the right to foreclose by the appropriate party for all serviced mortgages,
outstanding balances, and fees assessed to the borrower
and
are the core MIS used by Default Operations to ensure the
ongoing accuracy of the records to establish ownership and the right to foreclosure,
outstanding balances, and fees assessed to the borrower.
The Mortgage Servicing Companies are currently submitting a plan and procedures to
address Mortgage Electronic Registration System (Order Section #9) and has engaged
a consultant to conduct a Foreclosure Review (Order Section #3). Business
requirements and process updates that will require enhancement to MIS as part of
these activities will be incorporated into the Review Plan and remediation effort.
10
Confidential Treatment Requested
iii) Ensure that the Loss Mitigation and foreclosure staffs have sufficient and
timely access to information provided by the borrower regarding Loss
Mitigation and foreclosure activities; and
and
are the core MIS providing the Loss Mitigation and Default
Operations staffs sufficient and timely access to information provided by the
borrower regarding loss mitigation and foreclosure activities.
The Mortgage Servicing Companies are currently submitting a plan and procedures to
address Board Oversight (Order Section #2), Single Point of Contact (Order Section
#5), Mortgage Electronic Registration System (Order Section #9), and has engaged a
consultant to conduct a Foreclosure Review (Order Section #3). Business
requirements and process updates that will require enhancement to MIS as part of
these activities will be incorporated into the Review Plan and remediation effort.
iv) Ensure that the single point of contact has sufficient and timely access to
information provided by the borrower regarding Loss Mitigation and
foreclosure activities
The Mortgage Servicing Companies are currently submitting a plan and procedures to
address Single Point of Contact (Order Section #5). Business requirements and
process updates that will require enhancements to MIS are included within the scope
of the SPOC plan.
E. Consent Order Response to Section 10e
Consent Order Section 10e requires:
(e) Testing the integrity and accuracy of the new or enhanced MIS to ensure that reports
generated by the system provide necessary information for adequate monitoring and
quality controls.
As new systems or enhancements are identified, test plans will be developed which
follow the Ally Program and Project Management Standard,
The test plans will
be designed to validate the integrity and accuracy of the new or enhanced MIS and ensure
that reports generated by the system provide the necessary information.
MIS that are spreadsheets or models must adhere to the End User Database and Spreadsheet
Controls information security guidelines. These guidelines include specific requirements to
ensure the integrity and protection of data. Spreadsheets that meet the definition of a model
as defined in the guideline will be subject to additional testing, validation and controls.
11
Confidential Treatment Requested
Current Status: All projects centrally-supported by EOTS must follow the corporate
Project Methodology,
which includes established corporate standards and a
defined change management process. New systems or enhancements to existing systems
are tracked within the Mortgage Servicing Companies’
tool. The
tool is
used by the Mortgage Servicing Companies to assist in tracking projects throughout the
project management life-cycle. This tool provides automated controls (i.e. Workflow for
project approvals, defines and segregates review and approval roles, categorization of
level of effort and business need to assist in prioritization) to manage each phase of the
project and prevent unauthorized changes to a system or tool being developed and
implemented. Several layers of review and approval are required during the various
stages of the project's life-cycle and these stages are managed by the
application.
The Project Methodology is tested annually as part of the annual external audit as well as
test procedures associated with the SAS 70 over the Mortgage Servicing Companies’
operations.
Action Plan: To add an additional layer of quality control, the Mortgage Servicing
Companies will consider implementing a self assessment process or independent audit to
periodically test a sample of enhancements or implementations and report up to the
Business Strategy Committee (”BSC”) and Senior Management the results and
recommendations for continued refinement or improvement to the system testing process
and procedures.
Review steps and detailed action plans with tasks, responsible parties, timelines and
deliverables to address each identified area for improvement are included in Appendices I
and III, respectively.
Summary / Conclusion
The Mortgage Servicing Companies have prepared a comprehensive description and
inventory of MIS. The MIS Review plan has been developed and the Mortgage Servicing
Companies will remediate deficiencies and gaps during the review. The timeline to
remediate gaps will be appropriately focused on high-risk areas. We believe we have
addressed the requirements of the Order.
12
Confidential Treatment Requested
Appendix I - Steps for the Review Plan
Below is a summary of the steps that support Management Information Systems review and remediation
plan.
1. Inventory MIS used throughout the organization
This step has been completed.
2. Draft MIS Review work plan, Timeline, and Submit for Approval.
This step has been completed.
3. Execute the MIS Review work plan - System-Level Study
This step will be fully completed on or before 12/16/2011.
4. Execute the MIS Review work plan - MIS Requirements Analysis and Categorization
This step will be fully completed on or before 2/23/2012.
5. Analyze Results of MIS Review and Summarize MIS Control Deficiencies
This step will be fully completed on or before 3/23/2012.
6. Draft and Implement Remediation and Short-Term Action Plans for High Risk/Moderate and Significant
Effort gaps.
This step will be fully completed on or before 7/13/2012.
7. Draft and Implement Remediation Action Plans for Medium Risk gaps.
This step will be fully completed on or before 1/11/2013.
8. Draft and Implement Remediation Action Plans for High and Medium Risk/Significant Effort gaps.
This step will be fully completed on or before 12/13/2013.
9. Identify New System or Enhancements and develop project plan
Completion dependent on completion of #1-6 above and enhancements or changes to the MIS proposed
by the Board Oversight Plan (Order Section #2), Single Point of Contact Plan (Order Section #5),
Compliance Program (Order Section #8), Mortgage Electronic Registration System Plan (Order Section
#9), and the outcomes of the Foreclosure Review (Order Section #3).
10. Develop Business Requirements and Testing Scenarios
Completion dependent on completion of #1-6 above and enhancements or changes to the MIS proposed
by the Order Section #2), Single Point of Contact Plan (Order Section #5), Compliance Program (Order
Section #8), Mortgage Electronic Registration System Plan (Order Section #9), and the outcomes of the
Foreclosure Review (Order Section #3).
Appendix II - Board Level Deliverables and Due Dates
This plan does not have Board deliverables and does not require Board approval
13
Confidential Treatment Requested
Appendix III - First Level Plan Details
P.
Ref.
#
1
Deliverable
1.1
Conduct
interviews with
key stakeholder to
identify MIS
10a
x
1.2
Document the
purpose and use
of MIS
10a
x
1.3
Gather and review
Policies,
Procedures and
controls
documentation
Review results of
prior year reports
10a
x
10a
1.5
Determine system
controls required
to comply with
P&P
1.6
Complete MIS
Inventory
(validate MIS
with BU and IT
owners)
1.4
CO
Section
Task
Owner
Projected
Start
Date
Projected
End
Date
Interviews were conducted with
key stakeholders within the
business units, EOTS and control
functions to identify all the
systems, databases, and end-user
developed tools.
During interview, understanding of
the end-to-end process (data) flow
and documented the purpose and
use of the MIS along with an
understanding of the reporting
process being generated from these
systems.
Obtained and reviewed IT
Governance Policies and
Procedures and Unit desktop
procedures, where available.
EOTS / BU /
Consultants
4/13/11
Completed
EOTS / BU /
Consultants
4/13/11
Completed
EOTS /
Consultants
4/13/11
Completed
x
Reviewed results of prior year
reports for MIS deficiencies that
could impact the timeliness,
completeness and accuracy of
information used in decision
making. Identified any MIS
themes or areas of risk that will
require remediation. The
following items were considered:
o Regulatory reports or
examination; and
o Internal and external audit
reports, including SAS 70
reports.
EOTS/
Consultants
4/13/11
Completed
10a
x
EOTS / BU /
Consultants
4/13/11
Completed
10a
x
Collaborated with IT and Business
Unit to identified change
management, system development,
security administration, security segregation of duties, training,
disaster recovery, business
continuity controls to be
established and followed.
Validate MIS Inventory with key
stakeholder in the IT and business.
Refer to Appendix IV.
EOTS / BU /
Consultants
4/13/11
Completed
Inventory of MIS used throughout the organization
x
14
Confidential Treatment Requested
Proj.
Ref.
#
2
Deliverable
2.1
Draft MIS
Review work plan
and Submit for
Approval
CO
Section
Task
Owner
Projected
Start
Date
Projected
End
Date
x
Prepared MIS Review Plan based
on information gathered during the
inventory and MIS analysis
process
Develop projected timeline for
review
Submit plan for approval
EOTS
4/13/11
Completed
Identify project team lead and
team members,
Obtain funding to engage
independent consultant
Engage independent consultants
Conduct interviews with the
business units to identify MIS
control gaps
Perform MIS study to identify
gaps and deficiencies. This will
include the following:
o Conduct Interviews with key
stakeholders within the BU
and IT to determine whether
IT controls are established
and being followed
o Identify and analyze the
accuracy of reports used by
management for decision
making.
Review management's and
system's quality control checks
and/or trace data utilized within
the report back to the source
system(s) to determine whether
appropriate data integrity checks
are established and effective.
Deliver MIS Study Report/Heat
Map to display gaps and
deficiencies
EOTS
8/17/11
2/23/12
MIS Review Work Plan
#10 b
x
x
3
MIS Review Report
3.1
Execute work
plan - MIS
Review
10b
x
x
x
x
x
15
Confidential Treatment Requested
Proj.
Ref.
#
4
Deliverable
4.1
Execute work
plan - MIS
Requirements
Analysis and
Categorization
Report
CO
Section
Task
Owner
Projected
Start
Date
Projected
End
Date
EOTS / BU /
Consultants
9/12/11
3/9/12
EOTS
12/19/2011
MIS Requirements Analysis and Categorization Report
#10 b, c
x
x
x
The primary
objectives: reduce
complexity,
increase
transparency,
improve data
quality, increase
business agility,
and accelerate
management
reporting.
x
x
x
Outline scope and approach of
system level assessment
Utilize inventory to complete
system-level assessment and
deliver MIS Requirements
Analysis report. Leverage gap
analysis.
Develop decision criteria for MIS
ownership (e.g. IT, business,
decommission)
Perform detailed MIS
Requirements Analysis. This
includes but is not limited to the
following:
o Gathering business
requirements
o Determining technical
requirements
o Source data interfaces/inputs/outputs
o Identification of all
interdependencies
o Determination of ownership
and transition plan, if
applicable
o Establish compliance
monitoring
Working sessions will be
conducted to identify & finalize
long-term remediation action
plans. The current definition of
remediation action plan may
require changes to MIS systems,
procedures, quality controls,
reporting, etc
Deliver MIS Requirements
Analysis and Categorization
Report
5
Summarize Listing of MIS Control Deficiencies
5.1
Analyze Results
of MIS Review
and Summarize
MIS Control
Deficiencies
#10 b, c
x
x
x
Evaluate deficiencies identified
from the Gap and Deficiencies
analysis.
Conduct open working sessions
with relevant stakeholders within
the business and IT to review list
of potential deficiencies
Conduct workshops with the key
stakeholders in business and IT
and determine impact of
deficiencies
3/23/2012
16
Confidential Treatment Requested
Proj.
Ref.
#
6
Deliverable
6.1
Draft &
Implement High
Risk Remediation
and Short-Term
Action Plans
#10 c
x
7.1
Draft &
Implement
Remediation
Action Plans
#10 c
x
8
Develop Remediation Action Plans for gaps requiring significant level of effort.
8.1
Draft &
Implement
Remediation
Action Plans
#10 c
x
Based on results from MIS
Requirements Analysis, the
Mortgage Servicing Companies
will execute
remediation/implementation plans
to include:
o Leverage gap analysis to
communicate existing
policies and procedures
o Develop plans to transfer
BU systems to IT or
enhance controls and
reporting over BU
owned systems
o Development of
sustainable IT solutions
to be maintained in IT
and BU
9
Identify New
System or
Enhancements
and develop
project plan
#10 d
Dependent on completion of the review
and MIS requirements analysis and
enhancements or changes to the MIS
proposed by the other work streams.
7
CO
Section
Task
Owner
Projected
Start
Date
Projected
End
Date
1/9/2012
7/13/2012
4/9/2012
1/11/2013
EOTS / BU
6/11/2012
12/13/2013
EOTS / BU
Depend on
10c
N/A - New System
or enhancements
may be identified
from 10c and will
be completed as
part of the
remediation
timeline
Develop Remediation Plan for High Risk Gaps and Implement Short-Term Action Plans
EOTS / BU
Develop High Risk Remediation
Action Plan with Business.
x Develop Short-Term Action Plans
for all High-Moderate and HighSignificant deficiencies.
x Implement and Monitor corrective
action
Develop Remediation Action Plans for Medium Risk/Moderate Level of Effort gaps.
Based on results from MIS
Requirements Analysis, the
Mortgage Servicing Companies
will execute
remediation/implementation plans
to include:
o Leverage gap analysis to
communicate existing policies
and procedures
o Develop plans to transfer BU
systems to IT or enhance
controls and reporting over
BU owned systems
o Development of sustainable
IT solutions to be maintained
in BU and IT
EOTS / BU
17
Confidential Treatment Requested
Proj.
Ref.
#
10
Deliverable
CO
Section
Task
Owner
Develop Business
Requirements and
Testing Scenarios
#10 e
Dependent on completion of the review
and MIS requirements analysis and
enhancements or changes to the MIS
proposed by the other work streams.
EOTS / BU
Projected
Start
Date
Depend on
10c
Projected
End
Date
N/A - requirements
and testing will be
completed as part
of the remediation
timeline which will
follow project and
change
management
methodology
18
Confidential Treatment Requested
ALLY FINANCIAL INC.
GMAC Mortgage, LLC and Residential Capital, LLC
MORTGAGE OPERATIONS TRAINING PROGRAM
Prepared for the Board of Governors of the Federal Reserve System and the Federal Deposit
Insurance Corporation
Revised November 1, 2011
1
Confidential
Table of Contents
Plan Overview for Mortgage Operations Training Plan……………………………………...3
Principles Guiding this Plan…………………………………………………………………….4
Mortgage Training Team………………………………………………………………………..4
Mortgage Training Programs.…………………………………………………………………..5
Proposed Solutions………………………………………………………………………...……..6
Mortgage Servicing Policies and Procedures……….………………………………………….7
Legal Requirements - New and Changes…………...…………………………………………..8
Documented Training - Reporting…………………………………………………...…………8
Appendix I - Project Summaries………………………………………………………………..9
Appendix II - Board Level Deliverables and Due Dates………………………..……………10
Appendix III - First Level Project Details…………………………………...………………..10
2
Confidential
Plan Overview for Mortgage Operations Training Plan
This Plan for Mortgage Operations Training is established in response to the Consent Order
dated April 13, 2011 (the “Order”) among the Board of Governors of the Federal Reserve
System (the “FRB”), the Federal Deposit Insurance Corporation (the “FDIC”), Ally Bank (the
“Bank”), Ally Financial Inc. (“Ally Financial” or “AFI”), and certain of Ally Financial’s direct
and indirect subsidiaries including Residential Capital, LLC (“ResCap”) and GMAC Mortgage,
LLC (“GMACM” and together with ResCap, the "Mortgage Servicing Companies").
Capitalized terms not defined in the Plan shall have the meanings assigned to them in the Order.
The purpose of this Plan is to set forth the actions and responsibilities necessary for Mortgage
Operations Training to comply fully with its obligations under Section 11: Training of the Order
(see Appendix I). Section 11 of the Order requires:
Within 60 days of this Order, GMAC Mortgage shall submit to the Reserve Bank an acceptable
written plan, and timeline for implementation, to improve the training of all appropriate officers
and staff of the Mortgage Servicing Companies regarding the Legal Requirements, supervisory
guidance of the Board of Governors, and the Mortgage Servicing Companies’ internal policies
and procedures regarding residential mortgage servicing, Loss Mitigation, and foreclosure, and
the policies and procedures adopted regarding a single point of contact described in paragraph
5 of this Order. The plan shall also include:
(a) A requirement that training be conducted and documented no less frequently than
annually; and
(b) procedures to timely inform appropriate officers and staff of any new or changes to the
Legal Requirements and supervisory guidance of the Board of Governors related to
residential mortgage loan servicing, Loss Mitigation, or foreclosure.
In response to the Order, this Action Plan (the “Plan”) contains recommendations for enhancing
the training of all appropriate officers and staff of the Mortgage Servicing Companies
(“Mortgage Servicing”) pursuant to Section 11 of the Order. This Plan includes foreclosure, loss
mitigation and single point of contact areas as priorities, and all remaining Mortgage Servicing
functions thereafter. The Mortgage Operations Training Team (“Mortgage Training”) will
implement this Plan in cooperation with the Legal, Compliance and Mortgage Servicing units of
Mortgage Operations Training. The Plan implementation includes improved policies and
procedures, required annual training of policies by Business Unit (e.g. Mortgage Servicing)
function, and enhanced communication with the Legal and Compliance Departments for ongoing
legal and regulatory changes.
3
Confidential
Principles Guiding this Plan
The principles guiding the Plan are to identify, manage, and mitigate compliance risks associated
with the requirements of applicable laws, regulations, regulatory guidance, emerging legislative
trends or issues, and operational deficiencies through training initiatives by:
x
x
Educating staff and officers of applicable laws, rules and regulations (“LRRs”)
Reducing the risk of adverse actions by regulators or other stakeholders
In addressing the individual Order components, this Plan introduces enhancements to the
existing Business Unit Compliance training framework. Mortgage Training, Mortgage
Compliance, and Legal will oversee and develop training activities stemming from the Order
related to redesigning training processes and revising policies and procedures to address new
changes to existing LRRs. As a first step, implementation roles and responsibilities for
Mortgage Training, Mortgage Compliance and Legal will be defined, documented and
communicated. Mortgage Training has adopted the following guiding principles as it oversees
the transformation:
x
x
Accurate and timely communication of policy and procedure changes (for this Plan and
on-going) is a shared responsibility among Mortgage Training, Compliance, Legal and
Mortgage Servicing Business Unit Management
Training methodologies shall incorporate application to an employee’s role within the
organization and include an evaluation to validate knowledge and skill proficiency
Mortgage Training Team
Mortgage Servicing and Mortgage Training are responsive to the findings and recommendations
to improve training regarding the Legal Requirements, supervisory guidance of the Board of
Governors and Mortgage Servicing internal policies and procedures. Historically, training
within the Mortgage Line of Business (“LoB”) was divided into two teams, Lending and
Servicing. Over the past year, Mortgage Training consolidated into one team, led by a Vice
President (“VP”), who reports directly to the President of Mortgage Operations. The
consolidated team supports skills-based and developmental training for the following business
channels: Servicing; Consumer Lending Sales and Operations; and Business Lending. To
support these business channels, Mortgage Training has designed the department with the
following roles: Training Coordinators, Facilitators (“Trainers”), Policy and Procedure Technical
Writers, Instructional Designers, and Job Coaches (a five-member team who resides in select
Mortgage Servicing Business Units to address real-time training needs). Three Instructional
Designers hold a Masters Degree in instructional systems design.
Training delivery methods include instructor-led, computer-based, and web-based solutions. To
address the increasing demands in the marketplace, compliance with LRRs, Consent Orders, and
to revamp existing training programs, Mortgage Training added 12 additional resources over the
last 120 days.
4
Confidential
Mortgage Training Programs
Mortgage Training regularly identifies training needs through a variety of methods including
Business Plan review, business consulting, the Compliance/Regulatory change process, and
system upgrade projects. When a potential training need exists, Mortgage Training consults with
leaders in the various channels to determine the objectives and scope of the project. At that
point, an Instructional Designer works with the project leaders and Subject Matter Experts to
complete the design and development process. The final step before implementation is to
conduct a purposeful review with a Vice President from the business unit and a designee from
each of our Legal and Compliance teams, allowing all parties to provide feedback and review
changes. Once updates are made to all parties’ satisfaction, each designee provides their formal
written approval of the training product.
Mortgage Training provides a variety of training programs including (but not limited to)
functional new hire, process change, associate development, system enhancement, and
compliance instruction. Following is a summary of some key offerings highlighted in the Order:
Current State (pre-2011)
New employees receive a [minimum] four-day training curriculum that includes company,
industry, and systems training. This curriculum includes required compliance training
courses assigned to each employee. Mortgage Training provides additional new hire support
for those functional areas with frequent hiring and a homogenous function. We provide this
comprehensive new hire training for the following areas: Customer Care, Collection, Loss
Mitigation, Recovery, and REO. These curricula include the initial 4-day program, as well as
additional department information, detailed functional training, on the job observation, and
performance-based user readiness testing. [See attached curriculum document]
Every employee in Mortgage Servicing (new or existing), including all officers and senior
leaders, completes an annual curriculum of Compliance courses specific to their role in the
organization. Training attendance and results are tracked and monitored through the Ally
Learning Center (ALC).
2011 Enhancements
Mortgage Training implemented a company-wide learning opportunity program in early
2011. This program resulted in a Learning Framework (curriculum) available for each
functional area of the company. Employees now have additional learning options for their
own growth and development in the areas of business and industry, behavioral skills, service
quality and process improvement, and risk and compliance.
We completed a restructure of the desktop procedures and new hire training curriculum for
both the Bankruptcy and Foreclosure areas. The new hire curricula for these areas is now
functionally comprehensive, and includes department information, functional training, on the
job observation, and performance-based user readiness testing. In addition, we provided
skill-standardization training to every existing member of these teams using their improved
desktop procedures and functional training material. [See attached curriculum document]
5
Confidential
In participation and alignment with Consent Order section 5, Mortgage Training
implemented a comprehensive training and certification program for the Single Point of
Contact (SPOC) initiative. This training program includes an in-depth review of default
business functions, advanced behavioral skill training, investor loss mitigation programs,
government loss mitigation programs, foreclosure, and the established internal SPOC
process. In addition, all SPOC employees will complete a Loss Mitigation Certification
program to document knowledge of loss mitigation programs and tools, investor
requirements, regulatory limitations, and foreclosure referral standards. Each SPOC
employee must complete an annual recertification as part of this plan. Mortgage Training
will continue to enhance the SPOC curriculum and training process in alignment with the
implementation and feedback from the FRB. [See attached curriculum document]
Proposed Solutions
Beyond the specific requirements of the order, Mortgage Training will work with Mortgage
Servicing leadership to transition the training function, and Mortgage Servicing business culture,
to place on-going education of employees as a priority. This transition will be demonstrated
through defined learning maps by job function (e.g., Loss Mitigation, Bankruptcy, Foreclosure)
and annual education requirements for LRRs, business and industry knowledge, and quality
service skills advancement.
Learning map solutions and curricula will include a variety of delivery methods to include
instructor-led, web-based and self-study modes. Employee achievement and solution evaluation
will be measured directly through knowledge and skills assessments and indirectly through
customer satisfaction results and audit findings.
In support of the enhanced focus on education, Mortgage Training will evaluate whether further
expansion of the Job Coach role into additional business units (e.g. Real Estate Owned, Cash
Operations, Escrow Operations) is warranted. This role will formalize the functional training for
new hires and provide coaching to existing employees on new and changing procedures,
regulations, systems, and programs. Mortgage Training will also work with Human Resources
and Mortgage Servicing Management to assess incorporating educational achievement into the
annual performance review process.
Although not specifically requested by this order, Mortgage Training added a deliverable to
facilitate a more holistic approach to on-going industry education. This approach requires more
in-depth industry training as part of a prescribed long-term curriculum. Mortgage Training will
then integrate that knowledge with the Compliance training requirements in the steps outlined in
the Plan, for a more well-integrated view of the accountability needed in our industry. Mortgage
Training will administer those training solutions starting in 2012, and ongoing throughout an
employee’s tenure. Please see Appendix 3, section 4 for details.
Mortgage Training, in response to and in cooperation with Mortgage Compliance, will augment
the Compliance/Regulatory Training curriculum in a variety of ways. We will add to the
established Compliance Training Curriculum a training course designed to influence the culture
in our organization. This course will allow employees to discuss, understand, and embrace a
6
Confidential
changing regulatory environment and its impacts. We will also partner with our Legal and
Compliance Teams to ensure the Compliance training curriculum provided for each functional
role is comprehensive and complete. We will also insert a checkpoint early into the Regulatory
Change Management process, allowing Mortgage Training to proactively identify and discuss
training needs resulting from regulatory changes.
The deliverables implemented as a result of this Plan will be ongoing, revolving training
programs, executed in 2012 and sustained in 2013 and beyond.
Mortgage Servicing Policies and Procedures
Mortgage Training maintains an online Policies and Procedures manual, which includes detailed
steps that Business Unit personnel must follow as they conduct their functional job
responsibilities. Mortgage Training uses the Policies and Procedures manual as a learning aid
during new hire training and all employees are expected to utilize the Policies and Procedures
manual as a tool when performing essential job tasks.
A project is in process to revise Mortgage Servicing policies and procedures. A third party is
engaged to conduct a gap analysis for current policies and to re-write policies where necessary.
The Ally policy on policies is the standard template and guidance for the re-write. In addition,
technical writers are validating desktop procedures across all business units. This project is
scheduled for completion no later than 10/1/11.
Another project is in process to enhance training for Mortgage Servicing policies and procedures.
The initial focus of the training plan is to educate officers and employees on the Ally standards
and guidelines for policies as well as communicate the process for on-going change
management. The training plan then includes a detailed instruction for policy changes by
business function. This project is scheduled for completion no later than 3/31/12.
The policies re-write project, procedures validation and alignment, and training for the enhanced
policies are dependencies for implementation of this Consent Order training plan. After
implementation of the revised policies during the fourth quarter 2011, officers and employees
will be required to complete training on Mortgage Servicing policies annually. The Ally
Learning Center will be used to track training completions and capture policy affirmations for
the initial implementation and yearly thereafter.
7
Confidential
Legal Requirements – New and Changes
Ally Financial’s Global Compliance and Regulatory Affairs (“GCRA”) Enterprise Program
Management team maintains a formal Compliance Training Program to promote awareness with
internal compliance policies and procedures at the Enterprise, Line of Business, and Business
Unit level. Currently, during the 4th quarter, the Mortgage Compliance Officer and staff
(“Mortgage Compliance”) work with GCRA, Mortgage Training, and the Mortgage Business to
establish the mandatory Mortgage Compliance Training Program requirements, including the
training frequency, on a yearly basis. Existing training with annual requirements for servicing
include Fair Debt Collection Practices Act, Information Protection Awareness, Service Member
Civil Relief Act, Fair Credit Reporting, GLBA Privacy Anti-Money Laundering, Company
Records and Information Management. In addition, employees must annually reaffirm for the
following policies: Acceptable Use, Conflict of Interest, Anti-fraud, Physical Security, Global
Expense, Records Management, US Lobbying and Political Activity, Ally Code of Conduct and
Ethics.
Today, Mortgage Compliance enters all applicable LRR into an internal regulatory compliance
database,
with key information about each legislative change. An email alert is
automatically generated from the database to those Business Units directly impacted by the new
or amended regulation. The Business Units are tasked with implementing the LRRs and
documenting the status of compliance for each law change within
. Mortgage Training
currently relies on the Business Units to inform them of training needs related to Legal
Requirements and the supervisory guidance of the Board of Governors.
In response to this order, Mortgage Training, in conjunction with Legal and Mortgage
Compliance, will modify the regulatory change management process and be more proactive in
addressing educational needs associated with Legal Requirements and the supervisory guidance
of the Board of Governors. By incorporating the compliance training needs into the regulatory
change management process, Mortgage Training will be able to provide Mortgage Servicing
Management and employees with timely policy and procedural updates regarding new or
changes to Legal Requirements, compliance policies or other supervisory guidance. As part of
the deliverables outlined in Appendix III of this document, Mortgage Training will produce a
process flow to illustrate the regulatory change management process. Given the reliance on the
GCRA, Mortgage Compliance and Legal, these aspects of the Training Plan have a dependency
within Paragraph 7 (Enterprise Compliance Program) and 8 – (Mortgage Compliance Program)
of the Order.
Documented Training – Reporting
Currently, Mortgage Training communicates training offerings to current employees via the Ally
Learning Center (“ALC”), an intranet portal managed by Ally Human Resources that houses all
trainings available to employees. Each module contains course descriptions, intended target
audience, and training objectives. ALC has functionality to assign courses by job family,
confirm registrations and send e-mail notifications to employees and leaders for overdue course
8
Confidential
assignments. As a result, all training resulting from this plan, including web-based instructor-led
training, will be documented, assigned and reported through the ALC.
There are several types and purposes of reporting generated from our training activity set forth
below.
Compliance Training Reporting
In partnership with Mortgage Compliance, Mortgage Training assigns employees the
required Compliance training through the ALC. Through this system, we are able to
track completion and adherence to the due dates. These results are monitored for timely
completion and reported on a monthly basis.
Mortgage Operations Training Accomplishments
Every month, Mortgage Training submits reports detailing training activity and results.
This report contains user readiness data, compiled training and contact hours, notable
accomplishments, and evaluation metrics. This report is provided directly to the
President of Mortgage Operations, and distributed to the Mortgage Operations senior
staff members including Compliance, Risk and Human Resources.
User Readiness Data
Mortgage Training administers user readiness testing to measure training effectiveness
and learner readiness. We report the summary results as a part of the Mortgage
Operations Training Team monthly executive report. For functional training, we provide
individual results to respective leaders for targeted review and coaching.
Enhancements made as a result of this plan will follow that existing process of reporting results.
Project summaries and detailed actions plans with tasks, responsible parties, timelines and
deliverables to address each identified area for improvement are included in Appendix III.
Appendix I - Project Summaries
Below is a summary of the projects that support the Mortgage Training Program.
Action Plans:
1. Enhance Compliance Curriculum and Training Plan
2. Formalize Annual Year-End Compliance Curriculum and Training Plan Evaluation
3. Enhance Mortgage Servicing Educational Change Management Process
4. Establish defined learning maps by business function.
9
Confidential
Appendix II - Board Level Deliverables and Due Dates
NA
Appendix III - First Level Project Details
Deliverable
CO
Section
Task
Owner
Projected
Start
Date
Projected
End
Date
1. Enhance Servicing Compliance Curriculum and Training Plan
Roles and
Responsibilities
Needs
Assessment
Updated
Curriculum
Training
Schedule
Implementation
Plan
1.1 Define roles and
responsibilities between
Mortgage Compliance,
Mortgage Training, and
Legal in connection with
the development of core
and Business Unit
compliance training
curriculum.
Communicate the agreed
upon roles and
responsibilities.
11
11
11
1.2 Perform evaluation to
determine the
educational needs of
Mortgage Servicing
Companies Officers and
employees, by Business
Unit.
1.3 Review evaluation
results and compare to
existing compliance
curriculum and training
plan.
1.4 Identify gaps by
Business Units.
1.5 Determine training
delivery methods and
develop content.
(Includes compliance and
legal review and
approval)
1.6 Determine method
for rollout of training
(e.g., pilot program,
train-the-trainer, etc.)
1.7 Establish schedule
for training delivery
VP, Mortgage
Training;
Legal,
7/13/11
11/15/11
Mortgage
Compliance Officer
VP, Mortgage
Training
11/16/11
VP, Mortgage
Training
1/25/12
VP, Mortgage
Training
10/25/12
1/25/12
10/25/12
4/10/13
10
Confidential
2. Formalize Annual Year-End Compliance Curriculum and Training Plan Evaluation
Compliance
Curriculum and
Training Plan
Annual
Evaluation
11
Change
Management
Process
11
2.1 Establish process and
criteria to implement an
VP, Mortgage
12/01/12 and
annual evaluation of the
Training;
annually
mortgage servicing
thereafter
compliance curriculum
Mortgage
and training annually.
Compliance Officer,
2.2 Evaluate curriculum
using established process
, Legal
and criteria.
3. Enhance Mortgage Servicing Educational Change Management Process
3.1 Work with Legal and
Mortgage Compliance to
develop a change
management process to
address educational
requirements related to
new or changes to Legal
Requirements and
supervisory guidance of
the Board of Governors.
Communication 11
3.2 Develop a
Plan
Communication Plan to
clearly define and outline
the change management
process for delivery of
educational requirements
related to Legal
Requirements,
supervisory guidance of
the Board of Governors,
and the Mortgage
Servicing Companies
internal policies and
procedures regarding
residential mortgage
servicing, Loss
Mitigation, and
foreclosure activities.
4. Establish defined learning maps by business function
Business and
industry
learning maps
by servicing
function
11
4.1 Determine
curriculum by
business function
Director, Mortgage
Training;
EVP,
Mortgage Servicing
7/13/11
12/31/13 and
annually thereafter
11/15/11
2/7/12
11/16/11
7/13/11
4/23/12
4.2 Determine specific
learning solutions
10/4/11
7/23/12
4.3 Determine
development
7/24/12
1/25/13
11
Confidential
strategies for
learning solutions
Identify Job
Coaches for
Mortgage
Servicing
Business Units
11
4.4 Establish completion
requirements
4.5 Communicate
requirements and
establish training plans
4.6 Develop business
case for adding Job
Coaches to additional
Mortgage Servicing
Business Units
9/19/11
1/24/12
4.7 Identify job coaches
1/24/12
3/26/12
4.8 Complete job coach
on-boarding & training
3/27/12
5/14/12
12
Confidential
ALLY FINANCIAL INC.
GMAC Mortgage, LLC and Residential Capital, LLC and Ally Financial
Risk Management
Prepared for the Board of Governors of the Federal Reserve System and the Federal
Deposit Insurance Corporation
Revised on December 13, 2011
1
Confidential Treatment Requested
Table of Contents
Plan Overview for Enterprise Risk Management ........................................................ 3
Approach and Activities Conducted in Response to the Order Requirements ........... 5
Ally Financial ERM Program ....................................................................................... 6
Mortgage Servicing Companies Risk Management Program ................................... 12
Appendix I - Detailed Action Plan .............................................................................. 23
Appendix II - Board Level Deliverables and Due Dates ............................................ 24
Appendix III - First Level Project Details .................................................................. 25
Appendix IV - Overview of Current ERM Program ................................................. 26
Appendix V - Typical Roles & Responsibilities Across Risk Management .............. 39
2
Confidential Treatment Requested
1. Overview for Risk Management
This document for Ally Financial and the Mortgage Servicing Companies (the
“Document”) is established in response to the Consent Order dated April 13, 2011 (the
“Order”) among the Board of Governors of the Federal Reserve System (the “FRB”), the
Federal Deposit Insurance Corporation (the “FDIC”), Ally Bank (the “Bank”), Ally
Financial Inc. (“Ally Financial” or “AFI”), certain of Ally Financial’s direct and indirect
subsidiaries including Residential Capital, LLC (“ResCap”) and GMAC Mortgage, LLC
(“GMACM” and together with ResCap, the "Mortgage Servicing Companies"), and
collectively referred to as the “Companies” for purposes of the Order. Capitalized terms
not defined in this Document shall have the meanings assigned to them in the Order.
The purpose of this Document is to set forth the actions and responsibilities necessary for
Ally Financial and the Mortgage Servicing Companies to comply fully with its
obligations under Sections 14 and 15 of the Order.
As previously communicated to the FRB, the Companies have decided to combine their
responses to Sections 14 and 15 in this consolidated Document as the Companies believe
enterprise risk management is a holistic and continuous process involving governance,
policies, procedures, tools, methodologies and resources that transcend legal entity and
organizational boundaries.
Section 3 of this Document specifies the actions being taken relative to Section 14 of the
Order, whereas Section 4 incorporates the requirements of Section 15 of the Order.
Appendices I through III include information relative to actions being taken to enhance
AFI’s Enterprise Risk Management program (“ERM Program”). Appendix IV
summarizes the components of the risk management program for the Mortgage Servicing
Companies (“Mortgage Risk Program”), whereas Appendix V references a framework
for common allocation of roles and responsibilities relative to risk management.
Section 14 of the Order requires that:
Within 60 days of submission of the comprehensive risk assessment conducted pursuant
to paragraph 12 of this Order, Ally Financial shall submit to the Reserve Bank an
acceptable written plan to enhance its ERM program with respect to its oversight of
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and
operations. The plan shall be based on an evaluation of the effectiveness of Ally
Financial's current ERM program in the areas of residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and operations, and recommendations to
strengthen the risk management program in these areas. The plan shall, at a minimum,
be designed to:
(a) ensure that the fundamental elements of the risk management program and any
enhancements or revisions thereto, including a comprehensive annual risk
assessment, encompass residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities;
3
Confidential Treatment Requested
(b) ensure that the risk management program complies with supervisory guidance of
the Board of Governors, including, but not limited to, the guidance entitled,
"Compliance Risk Management Programs and Oversight at Large Banking
Organizations with Complex Compliance Profiles," dated October 16, 2008 (SR
08-08/CA 08-11); and
(c) establish limits for compliance, legal, and reputational risks and provide for
regular review of risk limits by appropriate senior management and the board of
directors or an authorized committee of the board of directors
Section 15 of the Order requires that:
Within 60 days of submission of the comprehensive risk assessment conducted pursuant
to paragraph 12 of this Order1, Ally Financial and ResCap shall jointly submit to the
Reserve Bank an acceptable, comprehensive risk management program for the Mortgage
Servicing Companies. The program shall provide for the oversight by Ally Financial's
senior risk managers and ResCap's boards of directors and senior management of the
development and implementation of formalized policies and mitigation processes for all
identified risks to the Mortgage Servicing Companies. The program shall, at a minimum,
address, consider, and include:
(a) The structure and composition of ResCap's board risk management committees
and a determination of the optimum structure and composition needed to provide
adequate oversight of Mortgage Servicing Companies' firm-wide risk
management;
(b) a detailed description of the responsibilities of (i) the line-of-business staff,
compliance staff, and the legal department regarding risk assessment and
management, including, but not limited to, compliance and legal risks, and (ii) the
internal audit department regarding the evaluation of the effectiveness of such
risk assessment and management;
(c) written policies, procedures, and risk management standards;
(d) processes to adequately identify risk levels and trends;
(e) processes to adequately identify and control risks arising from incentive
compensation programs;
(f) processes to document, measure, assess, and report key risk indicators;
(g) controls to mitigate risks;
(h) procedures for the escalation of significant matters related to risks to appropriate
senior officers and board committees;
1
Section 12 of the Order requires an independent consultant to conduct a comprehensive assessment
(“Risk Assessment”) of the Mortgage Servicing Companies’ risks, including, but not limited to, operational,
compliance, transaction, legal, and reputational risks particularly in the areas of residential mortgage loan
servicing, Loss Mitigation, and foreclosure.
4
Confidential Treatment Requested
(i) the scope and frequency of comprehensive risk assessments;
(j) a formal method to ensure effective communication of established risk
management policies, procedures, and standards to all appropriate business line
and other staff;
(k) periodic testing of the effectiveness of the risk management program; and
(l) the findings and recommendations of the independent consultant described in
paragraph 12 of this Order regarding risk management.
This Document includes an action plan which describes the planned enhancements to the
ERM Program and the steps Ally Financial and ResCap will undertake to execute the
Mortgage Risk Program.
2. Approach and Activities Conducted in Response to the Order Requirements
This Document was prepared taking into consideration the following:
x
Industry practices: The Companies retained Oliver Wyman to provide insight
into industry best practices and emerging supervisory guidance on: risk
management; organizational structures; delineation of responsibilities between
line functions, Risk, Global Compliance and Regulatory Affairs (“Compliance”),
Legal, and Audit Services (“Audit”); governance and involvement of senior
management and the Board of Directors, and risk reporting. (As an example
Appendix V includes an overview of common allocations of roles and
responsibilities for risk management.)
x
Current state of the ERM and Mortgage Risk Programs: The Companies and
Oliver Wyman reviewed Ally Financial’s and ResCap’s current state risk
management practices against industry best practices. Oliver Wyman personally
and independently interviewed more than two dozen key stakeholders in the ERM
and Mortgage Risk Programs (collectively, “the Programs”) at AFI and the
Mortgage Servicing Companies. The purpose of these interviews was to gain
additional information regarding the Programs and to uncover areas in which the
Programs were not meeting stakeholder expectations, as it related to Mortgage
Servicing. Appendix IV summarizes the Programs.
x
Risk Assessment: The Companies and Oliver Wyman leveraged the risk
management recommendations and control testing results from the Risk
Assessment conducted by Treliant Risk Advisors in response to Section 12 of the
Order to supplement the understanding of the current state and areas of
improvement.
x
Order requirements: Ensured the Programs and action plans were cross-checked
against the requirements of the Order
The scope of the current state review took into account risk management, oversight, and
governance activities for residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities and operations (“Mortgage Servicing”).
5
Confidential Treatment Requested
this Document predominantly focuses on areas associated with day-to-day
operations of the business. While other risk types were also considered, the review and
subsequent recommendations have a heavy emphasis on operations and compliance risk.
The remainder of this Document is divided into the following sections.
x
x
x
x
x
Section 3 summarizes Ally Financial’s current ERM Program, with respect to
Mortgage Servicing, areas in which the Companies believe the ERM Program is
effective, and areas requiring improvement.
Section 4 outlines the Mortgage Risk Program.
Appendices I-III, which summarize actions being taken to enhance the Programs.
Appendix IV, which summarizes the current state of the Programs as they pertain
to the Mortgage Servicing Companies.
Appendix V, which outlines common roles and responsibilities for risk
management.
The specific action steps identified in this Document are intended to fully address the
requirements of the Order, the findings from the Risk Assessment, and to be aligned with
existing risk management initiatives within Ally Financial and at the Mortgage Servicing
Companies. The observations which drove the recommendations in this Document are
based solely on observations of activities within the Mortgage Servicing business (as per
the requirements of the Consent Order). However, in creating this Document, the
Companies sought enhancements that would be relevant, applicable and transferable
across the entire company and for other Lines of Business (“LoB”).
3. Ally Financial ERM Program
Section 14 of the Order requires that:
Within 60 days of submission of the comprehensive risk assessment conducted pursuant
to paragraph 12 of this Order, Ally Financial shall submit to the Reserve Bank an
acceptable written plan to enhance its ERM program with respect to its oversight of
residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and
operations. The plan shall be based on an evaluation of the effectiveness of Ally
Financial's current ERM program in the areas of residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities and operations, and recommendations to
strengthen the risk management program in these areas.
Ally Financial commenced, in earnest, the establishment of its ERM Program beginning
in 2009, with the hiring of experienced executives and personnel across a number of key
risk disciplines (credit, market, operations, compliance, etc.). By the end of 2009, Ally
Financial had adopted, as its approach to risk management, a “three lines of defense”
6
Confidential Treatment Requested
philosophy (see Figure 2), established a Risk and Compliance Committee (“RCC”) of the
Board and the Global Risk Management Committee (“GRMC”), and had adopted
numerous new risk policies. Starting in 2010, AFI implemented numerous other
elements of the existing ERM Program, including enhanced risk reporting to the RCC
and GRMC, a Risk and Controls Self Assessment Process (“RCSA”), enhanced
compliance risk assessments and compliance monitoring and testing, etc.
Accordingly, as of October 2011, Ally Financial believes its ERM Program is effectively
designed. In particular, Ally Financial believes Board and Senior Management oversight
at AFI is effective, the enterprise risk governance framework is well defined in the
Global Enterprise Governance and Risk Management Policy, (“ERM Policy”) and the
Global Operational Risk Management Policy (“ORM Policy”) is equally effective in
design. Ally Financial also believes it has established a clear framework around risk
appetite and the efforts to roll this framework out across the Companies during late 2011
and are beginning to have the desired impact, particularly given the linkage into the
performance management process (first implemented in 2010) and critically important
messaging on risk management from Ally Financial’s Chief Executive Officer, which
have occurred throughout 2011.
Ally Financial also believes it has developed policies, procedures and governance over
enterprise compliance risks and programs that are effectively designed to meet industry
practice and regulatory expectations, though the Companies acknowledge the compliance
program also is evolving and maturing, with numerous enhancements scheduled to be
implemented by the end of 2011.
With regard to oversight of Mortgage Servicing, specific enhancements have been
underway since late 2010 that are intended to have a positive impact on the effectiveness
of Ally Financial’s ERM Program. These include
x
x
x
x
Completion of a legal risk assessment
Enhancements to Mortgage Compliance risk assessments and additional
enhancements to Mortgage Compliance staffing and practices as required by
Section 8 of the Consent Order
Improvements to the audit program and audit staffing to address the requirements
of Sections 16 and 17 of the Consent Order
Enhancements to Ally Financial and ResCap board oversight and reporting as
required under Section 2 of the Consent Order
7
Confidential Treatment Requested
x
Enhancements to ERM pertaining to: a) enhancements to the policy framework
across the enterprise; b) further development of limits as part of the continued
evolution of the risk appetite framework; and c) enhancements to the operation of
various management level committees and councils.
In addition to the improvements already underway, Ally Financial believes the
effectiveness of its oversight will be further improved through the measures outlined in
the remainder of this section of the Document as well as the actions listed later in this
Document pertaining to the effectiveness of the Mortgage Risk Program. The
effectiveness of the ERM Program requires not only the top-down aspects of governance,
policy and oversight, but also effective identification, assessment, monitoring and
management of risks within the business, where the risks reside.
Appendix IV incorporates more detailed information describing Ally Financial’s ERM
Program.
Consent Order Response to Section 14(a): Program Enhancements
Consent Order Section 14(a) requires the Plan: ensure that the fundamental elements of
the risk management program and any enhancements or revisions thereto, including a
comprehensive annual risk assessment, encompass residential mortgage loan servicing,
Loss Mitigation, and foreclosure activities
Each aspect of Ally Financial’s ERM Program—including board and senior management
oversight; policies and procedures; risk identification, assessment, monitoring and
mitigation; and reporting—is designed to encompass all of Ally Financial’s businesses,
including Mortgage Servicing. Additionally, and as described in Appendix IV, Ally
Financial’s Risk and Control Self Assessment (“RCSA”) methodology (which was
launched in 2010) requires that management assess key business processes at least
annually, and the RCSA process applies to all of AFI’s operations, including Mortgage
Servicing.
Ally Financial believes that the improvement initiatives listed on page 7, as well as those
identified later in this Document will enhance the effectiveness of the enterprise-wide
oversight of risks in Mortgage Servicing. In addition, and as summarized in Appendix
III, Ally Financial intends to launch initiatives to determine whether additional
clarification and improvements are necessary in order to further enhance risk
management and oversight. These efforts, which are at the core of this Document,
encompass the following:
8
Confidential Treatment Requested
x
Roles and Responsibilities.
Considering the evolving and maturing nature of many of these
processes, activities, tools and organizations, both at AFI and the Mortgage
Servicing Companies, and the importance of achieving the appropriate outcomes
across all stakeholders, the effort necessary to conduct this analysis is significant
and will require a series of workshops involving AFI and Mortgage Servicing
Companies management and representatives of the various second and third lines
of defense functions. The Companies aim to complete this exercise and
determine the extent of any specific additional actions by November 30, 2011.
x
Scope of Monitoring Activities. Concurrent with the efforts to clarify roles and
responsibilities, the Companies will endeavor to further understand and document
the risk control, monitoring and testing activities that take place in each of the
first and second lines of defense as it pertains to Mortgage Servicing. As the first
line continues to expand its own monitoring of risks and controls as noted in
Appendix IV, Risk is also expanding its quality assurance activities and
Compliance is expanding its monitoring and testing activities, respectively.
Similarly Loan review has expanded its focus in Mortgage Servicing and Audit
Services continues to include Mortgage Servicing in its scope.
The over-arching goal of the Document is to
increase transparency around monitoring activities for purposes of identifying
gaps and duplication. The Companies aim to inventory the scope of activities and
control processes across the first and second lines of defense as it pertains to
Mortgage Servicing by January 31, 2012.
x
Governance.
the Companies will evaluate the roles of these
committees and councils upon concluding the previously noted evaluations and
align these committees and councils accordingly. The Companies will also
evaluate the effectiveness of the MCORC’s charter, its agenda, and MCORC
membership, in light of the MCORC’s intended purpose and will also consider
whether the correct changes to management reporting, stemming from the
changes to Board reporting required by Section 2 of the Consent Order, are
9
Confidential Treatment Requested
sufficient to ensure adequate governance over Mortgage Servicing risks by AFI
and Mortgage Servicing Companies Senior Management. The Companies aim to
complete this exercise by February 28, 2012 and in the interim, will leverage the
oversight routines performed by the Servicing Council (see Appendix IV) and the
enhanced board reporting around Mortgage Servicing (as required under Section 2
of the Order).
x
Policies, Procedures and Methodologies. Upon completion of the prior tasks, the
Companies will modify, as necessary, any existing policy, procedure and/or
program information to conform to any changes that result. The intent is to ensure
that the policies and program materials, including tools, clearly articulate and
address the practical and tactical implementation aspects of the elements of the
ERM Program. The Companies aim to complete this exercise by June 30, 2012, to
allow sufficient time for Legal and Compliance reviews and approval by
appropriate governing bodies. Any material changes will be communicated prior
to the formal policy revision, as necessary.
x
Training and Communications. Once all of the above activities have been
completed, the Companies will implement necessary training and communication
programs to ensure employees are sufficiently aware of any changes, and the key
aspects of the ERM Program. As part of this effort, the Companies will evaluate
whether ERM Program documentation can be improved or enhanced in any way
to more effectively communicate the ERM Program to all employees. These
actions will be completed by September 30, 2012, to allow sufficient time for
revisions to policies, procedures and methodologies. In the interim, the
Companies will maintain existing training and communications materials around
the ERM Program, which includes a web-based training module on Risk Appetite
and Escalation.
AFI believes these actions will help ensure that the well-designed ERM Program is
equally effective in execution and implementation, in particular as it relates to
Mortgage Servicing.
Consent Order response to Section 14(b): Compliance Risk Management Programs &
Oversight at Large Banking Organizations with Complex Compliance Profiles (FRB:
Supervisory Letter SR 08-8/CA 08-11, dated: 10/16/2008)
Consent Order Section 14(b) requires that the Plan: ensure that the risk management
program complies with supervisory guidance of the Board of Governors, including, but
not limited to, the guidance entitled, "Compliance Risk Management Programs and
Oversight at Large Banking Organizations with Complex Compliance Profiles," dated
October 16, 2008 (SR 08-08/CA 08-11)
Ally Financial’s ERM Program has been designed to comply with supervisory guidance,
including the guidance contained in SR 08-083. In general, supervisory guidance requires
that the ERM Program:
3
AFI’s Global Compliance function has separately developed a compliance risk management framework
that is consistent with SR 08-08.
10
Confidential Treatment Requested
x
x
x
x
x
x
Are formally documented in program documents and/or policies and procedures
Establish frameworks for identifying, assessing, controlling, measuring,
monitoring and reporting risks across the organization
Provide for training relative to risk management concepts throughout the
organization
Are supported by the institution’s board of directors and senior management
Are facilitated and overseen by appropriately independent corporate risk and
compliance functions, who in turn play key roles in monitoring risks that
transcend business lines, legal entities, and jurisdictions of operation
Incorporate risk assessments and periodic monitoring and testing
As noted earlier and throughout the remainder of this Document, the ERM Program itself
is designed to comply with supervisory guidance and to meet industry practice. Where
the execution of the Companies’ Programs reflects gaps to the requirements of those
programs, this Document identifies actions being taken or currently in process to address
such operational shortcomings. In particular, the actions pertaining to role clarity, scope
of mortgage activities, governance, policies, procedures, communication and training,
described on pages 9 and 10, are all designed to improve the operational effectiveness of
the ERM Program.
Consent Order Response to Section 14(c): Risk Limits
Consent Order Section 14(c) states: establish limits for compliance, legal, and
reputational risks and provide for regular review of risk limits by appropriate senior
management and the board of directors or an authorized committee of the board of
directors
Ally Financial adopted a Risk Appetite and Philosophy Statement (see Appendix IV) in
October 2010, which expresses the risk philosophy of the Ally Financial Board of
Directors and establishes the tone for risk management. The Ally Risk Appetite
Framework, in turn, establishes how much risk Ally Financial is able to accept and
willing to tolerate. It also provides a framework for establishing granular thresholds
designed to ensure that variation from expected outcomes is consistent with risk
tolerances (risk limits), and articulates how Ally Financial monitors risk exposure in
comparison to these tolerances and limits. These risk tolerances directly incorporate
compliance and legal risks (which are part of operational risk) and indirectly incorporates
reputational risks (through the Philosophy Statement), which are reviewed periodically
by the GRMC and RCC. The tolerances are listed in Figure 1 below.
11
Confidential Treatment Requested
Figure 1: 2011 Metrics and Limits for Legal (part of Operational) and Compliance
Risks
Components
Criteria
Operational Risk Ops Risk
Losses
(excl. R&W)
Risk tolerance
R&W Losses
Statement
Tolerance –
Ally Imposed
We aim to achieve operational
excellence and seek to maintain a
“no material surprises” environment
We aim to achieve operational
excellence in order to control
R&W losses
Open Control We aim to effectively resolve open
Matters
control matter issues in a timely manner
(e.g. Audit, SOX, RCSA, Loan Review,
Model Validation, etc.)
Regulatory
Compliance
Risk
Regulatory
Compliance
Complying with all laws & regulations is
a fundamental principle for Ally. In this
regard, we will establish standards,
controls and practices to meet this
principle.
Ally Financial’s Global ERM Policy makes clear that each LoB is responsible for
managing its business within the risk tolerances and limits established by the RCC,
enforcing approvals within allowable limits, and establishing processes for the escalation
of any and all exceptions to limits and/or policies to the applicable governing committee
or function.
Ally Financial believes that the Ally Risk Appetite Framework and related metrics
(approved for 2011) meets regulatory expectations, are aligned with industry practices
and are well defined. Further Ally believes that the quarterly reporting of risk appetite
metrics and results is a good practice. AFI continues to complete additional work around
risk limits and reporting transparency. Actions necessary to address these areas have
been previously outlined in a plan prepared by Risk senior management and are expected
to be completed by March 2012. These actions will address limits particular to Mortgage
Servicing; though the Companies note the challenges associated with defining
quantitative limits for areas such as legal, compliance and reputation risk. As such, in
these areas, limits may continue to be more qualitative in nature.
4. Mortgage Servicing Companies Risk Management Program
Section 15 of the Order requires that:
Within 60 days of submission of the comprehensive risk assessment conducted pursuant
to paragraph 12 of this Order, Ally Financial and ResCap shall jointly submit to the
Reserve Bank an acceptable, comprehensive risk management program for the Mortgage
Servicing Companies. The program shall provide for the oversight by Ally Financial's
senior risk managers and ResCap's boards of directors and senior management of the
12
Confidential Treatment Requested
development and implementation of formalized policies and mitigation processes for all
identified risks to the Mortgage Servicing Companies.
Pursuant to the ERM Policy, Mortgage Risk Program will, when completed be a
subcomponent of the overall ERM program for Ally Financial, leveraging the same
global policies, methodologies, tools and practices. As such, the programmatic aspects of
the Mortgage Risk Program generally exhibit the same strengths and weaknesses exist in
the enterprise programs as a whole. In that regard, the Mortgage Risk Program is aimed
at incorporating oversight by the ResCap Board of Directors and through the MCORC,
Ally Financial and Mortgage Servicing Companies senior management. The Mortgage
Risk Program also contemplates line of business ownership of the process for identifying,
assessing, monitoring and managing risks, in accordance with enterprise-wide standards,
along with active oversight and monitoring by various independent second line of defense
functions such as Compliance, Legal and Risk, and periodic audits and reviews by third
line of defense functions, (i.e., Audit Services and Loan Review.)
Similar to the ERM Program, various aspects of the Mortgage Risk Program are maturing
and/or subject to existing improvement initiatives related to prior audits, regulatory
expectations and/or self-identified issues. Improvements already underway within the
Mortgage Servicing Companies include:
x
x
x
x
x
x
x
x
Completion of a legal risk assessment
Enhancements to Mortgage Compliance risk assessments and additional
enhancements to Mortgage Compliance staffing and practices as required by
Section 8 of the Consent Order
Improvements to the audit program and audit staffing to address the requirements
of Section 16 and 17 of the Consent Order
Enhancements to Ally Financial and ResCap board oversight and reporting as
required under Section 2 of the Consent Order
Actions underway to improve policies and procedures, along with actions taken to
improve training, as required by Section 11 of the Consent Order
Expansion of the nature, timing and rigor around first-line quality control and
second-line quality assurance activities.
Business Risk and Controls management was established to promote risk
ownership and coordinate risk management practices across the Mortgage
Servicing Companies.
Servicing Strategy and Operational excellence was established to enhance risk
controls, quality management, and business processes across the servicing
business by emphasizing operational excellence.
Other
are
noted in this Document and in the following sections.
Consent Order Response to Section 15(a): Board Structure and Composition
Consent Order Section 15(a) requires the Mortgage Risk Program consider: The structure
and composition of ResCap's board risk management committees and a determination of
13
Confidential Treatment Requested
the optimum structure and composition needed to provide adequate oversight of
Mortgage Servicing Companies' firm-wide risk management
While subject to further consideration by either Mortgage Servicing Companies
management or the ResCap Board of Directors, both currently believe the existing
structure and composition of the ResCap Board of Directors and its committees is
appropriate and is designed to ensure adequate oversight of the Mortgage Servicing
Companies’ risk management.
The ResCap Board of Directors is comprised of five members, of which two are
independent, non-management members. The two independent board members form
ResCap’s Audit Committee which, through a revision to its charter on September 15,
2011, now has increased oversight of the Mortgage Servicing Companies’ risk
management activities. The changes to ResCap’s Audit Committee charter specify its
responsibility for oversight of the effectiveness of risk management, governance, and
internal controls maintained by the Mortgage Servicing Companies.
In carrying out this responsibility, ResCap’s Audit Committee is required to review and
discuss, at least annually:
x
x
x
x
Legal and regulatory matters as presented by the Mortgage Servicing Companies’
General Counsel;
Global Security reports and activities, including complaints received regarding
accounting, internal accounting controls or auditing matters, and the confidential,
anonymous submission by employees of concerns regarding questionable
accounting or auditing matters, with specific reference to ResCap;
The status and results of state and other regulatory body examinations
Guidelines and policies for assessing and managing the Mortgage Servicing
Companies’ exposure to risks, including reputation risk, the major financial risk
exposures and the steps management has taken to monitor, control, report on and
as necessary disclose such exposures.
Enhancements to board reporting have been previously
proposed in the Board Oversight Plan required under Section 2 of the Consent Order.
That work is underway, and is expected to be implemented by December, 2011. The
Companies acknowledge that the board reporting enhancements currently underway will
evolve over time, in particular as the quality of risk information improves as a result of
other enhancements outlined in this Document (e.g., improved risk assessments).
Consent Order Response to Section 15(b): Roles and Responsibilities
Consent Order Section 15(b) requires the Mortgage Risk Program include: a detailed
description of the responsibilities of (i) the line-of-business staff, compliance staff, and
the legal department regarding risk assessment and management, including, but not
14
Confidential Treatment Requested
limited to, compliance and legal risks, and (ii) the internal audit department regarding
the evaluation of the effectiveness of such risk assessment and management
The ERM Policy specifies the roles of the line of business (first line of defense) and
compliance, risk, legal and other second line of defense functions regarding risk
assessment and management. These roles are summarized in Figure 2 below
Figure 2: The Three Lines of Defense
Complementing these materials, the Global Compliance Monitoring, Testing and
Reporting Policy (August 1, 2011) identifies the responsibilities of Enterprise Monitoring
and Testing groups versus the role of LoB/Global Function Compliance staff. Similarly,
the ORM Policy (July 1, 2011), and the supporting RSCA Methodology describe the
roles of various first and second line individuals and functions in the identification,
assessment, monitoring and mitigation/control of risks.
Each of these documents establishes the LoB management as being principally
responsible for identifying, assessing, monitoring and mitigating risks applicable to its
business and/or activities, while Global Function management (otherwise known as part
of the second line of defense) is responsible for policy, methodology, tools, and
enforcement thereof.
15
Confidential Treatment Requested
Additionally, the General Counsel for the Mortgage Servicing Companies created a legal
services delivery and management plan that outlined Legal’s role, activities, and
expectations in assuming responsibility for providing all legal services to the Mortgage
Servicing Companies.
This Document previously addressed the need to undertake additional efforts to ensure
roles, and scope of activity, are clear, and clearly understood, among first and second line
of defense. These steps, outlined on pages 8-9 of this Document, are intended to address
the concerns noted herein with regard to the requirements of Section 15(b).
Refer to page 20 and the response to Section 15(k) for discussion around Audit’s
responsibilities for evaluating the effectiveness of risk management as required by
15(b)(ii).
Consent Order Response to Section 15(c) and (j): Communication and Training
Consent Order Section 15(c) and (j) requires the Mortgage Risk Program to address:
(c) Written policies, procedures, and risk management standards; a formal method
to ensure effective communication of established risk management policies,
procedures, and standards to all appropriate business line and other staff
(j) A formal method to ensure effective communication of established risk
management policies, procedures, and standards to all appropriate business line
and other staff
Ally Financial has developed several enterprise-wide risk management policies relating
to trading, credit and market risk which govern certain operations of the mortgage
business. In addition, several policies and procedures relating to the business functions
involved in and supporting the Mortgage Servicing Companies are in the development
stage and are expected to be completed by July 1, 2012. The functional desktop
procedures have been in place but are currently being adapted into the Ally Financial
policy template. The CEO and President of the Mortgage Servicing Companies
communicated the existence of risk management policies and procedures to all mortgage
business personnel. Additional risk management standards relating to specific roles and
responsibilities identified and clarified during the process outlined in section 15(b) of the
Consent Order will be part of the enhancement plan.
16
Confidential Treatment Requested
Consent Order Response to Section 15(d), (f), (g), and (i): Risk Identification
Consent Order Section 15(d), (f), (g), and (i) requires The Mortgage Risk Program
address :
(d) Processes to adequately identify risk levels and trends; processes to document,
measure, assess, and report key risk indicators; controls to mitigate risks; the
scope and frequency of comprehensive risk assessments
(f) Processes to document, measure, assess, and report key risk indicators
(g) Controls to mitigate risks
(i) The scope and frequency of comprehensive risk assessments
Ally Financial’s ERM Policy makes clear the importance of having a “bottom-up”, and
cross-business identification, assessment and management of risks to provide senior
management with information and reporting to appropriately manage and control risk
exposures within Ally Financial’s established Risk Appetite Framework.
As previously noted, the responsibility for indentifying, assessing and managing risks
exists within business management and process owners. To assist in this effort, AFI’s
ERM team has created the RCSA, encompassing a comprehensive methodology and
tools, as summarized in Appendix IV. The RSCA, which consists of Key Process
Assessments (“KPAs”), completed at least annually, and Targeted Risk Assessments
(“TRAs”), is the Companies’ mechanism for identifying key risks, trends, Key Risk
Indicators (“KRIs”), risk controls, and other related matters.
ERM launched the RCSA effort in 2010, and was heavily involved in the completion of
initial KPAs and TRAs for each LoB, including Mortgage Servicing. Over time, it is
expected that Mortgage Servicing Companies’ management will take on greater
ownership for the completion and maintenance of the RSCA process as it relates to
Mortgage Servicing, as contemplated in The ORM Policy and acknowledged by
Mortgage Servicing Companies management.
RCSA efforts will be monitored by the Business Risk and Controls
Group, reporting to the President, and Mortgage Operations. This, along with the work
contemplated the Document regarding role clarity and scope of monitoring activities is
expected to lead to improved clarity around roles, responsibilities and efforts regarding
RCSA.
The Companies also note that a multitude of risk assessments exist across Ally Financial,
each for a unique purpose and each owned by a different function. These include risk
assessments for the following topics: compliance, anti-money laundering, fraud, privacy,
Sarbanes-Oxley Section 404, and others. While most of the owners of these risk
assessments participate in risk convergence efforts (designed to achieve common risk
17
Confidential Treatment Requested
language, terminology and practices, and to share results), the Companies acknowledge
that maintaining so many risk assessments requires additional effort around their
completion and maintenance and efforts to ensure each risk assessment informs, and is
informed by the others. While no specific action plan is contemplated herein, the
Companies will continue to seek ways to streamline risk assessment processes to ensure
they combine to produce a comprehensive assessment of the Companies’ risks.
A enterprise-wide operational risk management framework is under continuing
development that will satisfy certain regulatory requirements, such as Basel II, and
provide tools to support the businesses and Global Functions in better understanding and
managing operational risks. The framework timeline has been communicated with
management, the Ally Financial Board of Directors, and the FRB. Some components of
the framework are newly developed or in development, including methodology,
governance, RCSA, and loss data collection. Other framework components are
scheduled to be developed and introduced in the time-frame between the date of this Plan
and 2013. These components include KRI’s, scenario analysis, and operational risk
capital modeling.
With regard to KRIs, it should be noted that there are numerous KRIs already in place
across the Mortgage Servicing Companies and Ally Financial’s other businesses. The
framework efforts will be designed to inventory and refine the existing structure by
establishing:
x
x
x
x
Consistent definitions, processes and protocols;
Escalation triggers and thresholds;
Linkages to risks and controls, as identified in RCSAs and other risk assessment
activities, to ensure that KRI’s are prioritized, risk-based, actionable and
comprehensive; and
Consistent transparency to senior management, applicable committees/councils,
the Ally Financial Board of Directors, and regulators.
Consent Order Response to Section 15(e): Incentive Compensation Programs
Consent Order Section 15(e) requires the Mortgage Risk Program to include: processes to
adequately identify and control risks arising from incentive compensation programs
The Companies have implemented processes designed to adequately identify and control
risks arising from incentive compensation programs for the Mortgage Servicing
Companies. While many of these processes, and the related policies, procedures and
organizational structures, have only been recently implemented or enhanced, the
Companies believe they will be effective in mitigating the risks associated with incentive
compensation programs.
All incentive/variable pay plans across AFI are required to be consistent with the
requirements of the Variable Compensation Policy as adopted by Ally Financial’s
Compensation, Nominating and Governance Committee (“CNGC”) dated April 27,
2011. The CNGC oversees Ally Financial’s Annual Incentive Plan and establishes
incentive pools at the end of the year considering the Chief Executive Officer’s
recommendations.
18
Confidential Treatment Requested
Ally Financial has also recently approved a Global Compensation Policy for exempt and
non-exempt employees (dated October 1, 2011) which among other things, establishes
guidelines and practices to identify and control risks associated with incentive
compensation programs, in accordance with regulatory requirements and applicable laws
and regulations. With regard to incentive/variable compensation, the policy requires that
each approved plan will include a review by:
x
x
x
Risk to ensure the plan does not encourage excessive risk taking and that the plan
has appropriate risk balancing features
Compliance to ensure that regulatory items are addressed as applicable;
Total Rewards4 to ensure consistency across LoBs and Global Functions as well
as to ensure that plans for control functions are independent, as appropriate, of the
results of the LoBs or Global Functions they support.
Ally Financial has also recently codified Variable Pay Procedures outlining the review
and approval process for variable/incentive plans, which include procedures around
approval for recoupment where necessary. These procedures also outline the
responsibilities of each party to the process, including Finance, Compliance, Risk,
Human Resources (“HR”) and the LoB, which is responsible for establishing a plan
administrator for purposes of executing payments under a variable compensation plan.
Within the Mortgage Servicing Companies, responsibility for oversight and plan
administration was centralized within the Business Risk and Controls Management
Group, reporting to the President of Mortgage Servicing Companies. The Business Risks
and Controls Group has responsibility for the following activities with regard to incentive
compensation programs for the Mortgage Servicing Companies:
x
x
x
Work with HR, HR Compliance, and Total Rewards to maintain an accurate
inventory of variable compensation plans and governance processes;
Create standard workflow overviews with plan administrators and maintain
procedure documentation; and
Partner with HR to manage/validate quality performance calculations and
payments.
Since creation of this structure in the first quarter of 2011, Business Risk and Controls
and the HR organization (Total Rewards, HR Compliance, HR Business Partners, HR
Second Line of Defense Plan Monitoring) have collaborated to strengthen the governance
over all the aspects of variable compensation at the Mortgage Servicing Companies. To
date, the following actions have been taken to strengthen the entire variable
compensation process for the Mortgage Servicing Companies:
x
x
4
Hired an additional Plan Administration Manager
To date, six plans have been migrated, with four plans in the transition stage for
which migration will be completed by 11/30/2011. Remaining six plans were
already managed under Business Risks and Controls Management
Total Rewards is the overall compensation and benefits team for the Company.
19
Confidential Treatment Requested
x
x
x
x
x
x
x
Developed administrative procedures for the six plans migrated into Business
Risks and Controls Management with all other procedures to be documented by
the end of 2011
Obtained approval to proceed with an automated administration system hosted by
a third party vendor in 2012
Retained an independent contractor to audit variable compensation plans
Hired a Senior Human Resources Analyst in a compensation monitoring role
Enhanced PeopleSoft to require all variable compensation participants to be
assigned to a single plan in order to process a payment under the respective plan
Collaborated with Total Rewards to review all plan codes and eliminate any codes
not in use thereby minimizing risk of assigning participants to wrong plan codes
Enhanced the process to approve Plan Amendments
The Companies believe the actions already in progress sufficiently address risks arising
from variable compensation programs for the Mortgage Servicing Companies.
Consent Order Response to Section 15(h): Risk Escalation
Consent Order Section 15(h) requires the Mortgage Risk Program: procedures for the
escalation of significant matters related to risks to appropriate senior officers and board
committees
Escalation of significant risk and control matters can occur through both unique, ad hoc
situations and also through routine and ongoing risk management practices. With regard
to unique, ad hoc situations, Ally Financial’s Risk Appetite and Philosophy Statement
states that “anyone, at any time, can and should call attention to risks that may not be
obvious and ensure that they are fully assessed and taken into account.” In addition, the
Companies’ Code of Conduct and Ethics outlines various avenues for escalation of risks
and other matters, and also incorporate the use of an anonymous hotline that is available
24/7 all year long, by which employees, vendors and others can submit any concerns
regarding not only ethical matters, but also risk and control concerns. Annually, each
employee is required to acknowledge their awareness of the Companies’ Code of
Conduct and Ethics.
Other means for escalating significant risk and control concerns arise out of ongoing risk
management activities, including those related to the RCSA process (or other risk
assessments) and those associated with monitoring activities (i.e., quality control, quality
assurance, compliance monitoring and testing, and internal audit). In each of these areas,
policies stipulate circumstances where risk and control concerns, policy violations, limit
violations and the like require escalation to the appropriate management, committee, or
governing body.
Certain of these routine escalation channels are operating effectively, including those
pertaining to credit and market risk issues, and those related to financial controls. Others,
like those pertaining to compliance and operational risks, continue to evolve along with
the ERM and compliance programs themselves, where the processes by which
information about risks and controls (through risk assessments and monitoring activities
at both the first and second line) is either recently in place or still being developed. As
these processes mature, the Companies expect to see increased reporting and escalation
20
Confidential Treatment Requested
of risk and control issues simply as a function of having more granular and substantiated
information on which to report. Furthermore, the aforementioned enhancements to riskrelated reporting to the ResCap and AFI Boards of Directors, as required under Section 2
of the Consent Order, will help ensure the right risk information is being escalated to
these governing bodies.
The Mortgage Servicing Companies launched training and awareness programs around
Risk Escalation in early 2011. The training was developed internally and delivery is
nearly complete, with more than 85% of employees having completed the training as of
September 30, 2011. Business Risks and Controls Management maintains a procedural
document outlining risk and issue escalation protocols and the further refinement,
communication and training of the escalation protocols remains a significant focus for the
Mortgage Servicing Companies in 2011. More broadly, ERM is developing a new
required training program for all Ally Financial employees regarding the Risk Appetite
Framework. This training, which also speaks to escalation, is expected to be rolled out
starting in the fourth quarter of 2011.
Consent Order Response to Section 15(k): Periodic Testing
Consent Order Section 15(k) states: periodic testing of the effectiveness of the risk
management program
The Companies believe current practices are sufficient, both in design and operation, to
ensure that the risk management programs across the Companies are subject to periodic
testing that is designed to ensure the effectiveness of these programs. This conclusion is
supported by the following:
x
x
Audit Services has responsibility for periodic evaluation of the effectiveness of
the risk management program, while oversight over the program is the
responsibility of Senior Management, the Board of Directors and various
oversight committees noted above. In regards to fulfilling its obligations, Audit
Services provides “assurance and consulting services-delivered in a systematic
and disciplined manner-that are designed to add value, improve Ally’s operations,
and determine the effectiveness of the Company’s governance, risk management
and internal controls.” In addition, Audit Services is making several
enhancements to the Audit Program pursuant to Sections 16 and 17 of the
Consent Order that are intended to further increase periodic testing of the
effectiveness of the risk management program.
Loan Review also maintains a charter, as part of the Global Loan Review Policy
(dated July 1st, 2011), establishing its purpose as, “a control function, within Ally
Financials’ third line of defense, to provide the RCC and Ally Senior
Management with an independent and timely assessment of, among other things,
21
Confidential Treatment Requested
LoB management of credit risk and the adequacy of internal credit risk policies
and procedures.”
x
Audit’s responsibilities are further articulated in the Compliance Program, which
states “The Audit Group constitutes the ‘third line of defense’ and performs
independent audit reviews of the effectiveness of the Program and the LoB
Programs.” The ERM and ORM Policies, also reaffirm Audit’s and Loan
Review’s purpose as outlined in each group’s respective charter.
x
Both Audit Services and Loan Review prepare annual and longer-term, risk-based
plans, approved by the Audit Committee and RCC, respectively, whereby audits
and reviews are performed which are designed to provide sufficient coverage
necessary to meet requirements for evaluating the effectiveness of the risk
management program. Audit and Loan Review coordinate independent efforts to
help minimize gaps and overlaps in coverage of various risks in any given period.
x
Audit Services completed various actions in 2010 necessary to meet regulatory
expectations. Audit Services is furthermore implementing a number of changes to
its practices as a result of the Consent Order, which further strengthen the rigor of
the audit process and the competency of its resources conducting audits of the
Mortgage Servicing Companies and their risk management programs.
x
Loan Review has been subject to an internal audit by Audit, with satisfactory
results, in the past year.
Consent Order Response to Section 15(l): Findings and Recommendations of the
Independent Consultant
Consent Order Section 15(l) states: the findings and recommendations of the independent
consultant described in paragraph 12 of this Order regarding risk management.
To address these risks, Ally Financial has developed a plan focused on the High and
Medium High inherent risks. Each High or Medium High inherent risk was assigned to
an appropriate business owner who is responsible for assessing the inherent and residual
risk rating, and preparing a management response on whether the business owner agrees
with the rating from the Risk Assessment. If the business owner agrees, a written action
plan will be created to improve the controls around this risk.
The review process was initiated in September 2011. Once all high and medium high
inherent risks are addressed by the business owners, the results will be consolidated and a
presentation will be made to the Mortgage Servicing Company senior management in
December 2011. Enhancements plans for areas which do not have adequate controls will
be outlined by January 2012.
22
Confidential Treatment Requested
Appendix I – Detailed Action Plan
A) Summary of Action Plan Deliverables
Below is a listing of the deliverables that support the Risk Management Plan and
Program for Ally Financial and the Mortgage Servicing Companies.
1. Role Clarity: Conduct a series of workshops with key stakeholders, and create
an implementation plan to clarify roles, responsibilities and scope of activities
regarding risk management and oversight.
2. Scope of Activities: Follow on from the workshops to create an inventory of
each first and second line groups separate risk and control monitoring activities.
3. Governance: Evaluate the roles of committees and councils to align them with
the clarified roles, responsibilities and scope of activities regarding risk
management and oversight.
4. Policies and Procedures and methodologies: Modify, as necessary any existing
policy, procedure and/or program information to conform them to any changes
that result in risk management and oversight roles, responsibilities and
activities.
5. Training and Communication: Implement necessary training and
communication program to ensure employees are sufficiently aware of any
changes and the key aspects of the enterprise risk management program that
impact their day-to-day responsibilities.
23
Confidential Treatment Requested
Appendix II – Board Level Deliverables and Due Dates
Enterprise Risk Management will review the deliverables noted above and below with the
Ally Financial, Ally Bank, and ResCap Audit Committees, as applicable.
24
Confidential Treatment Requested
Appendix III – First Level Project Details
Deliverable
Task
Owner
Roles and
Responsibilities
Facilitate workshops to clarify
roles and responsibilities as
well as scope of activities
among first and second line
personnel monitoring
Inventory current scope of
activities and control processes
across first and second lines of
defense as it relates to
Mortgage Servicing
Create a detailed
implementation plan to address
the findings and resolution of
the workshops
Evaluate and clarify as
appropriate roles and
responsibilities of the various
councils and committees within
the Mortgage Servicing
Companies
Conduct risk management
policy gap analysis for the lines
of business and create a
schedule to update global and
lines of business risk
management policies,
prioritized by policies with the
largest gaps
Communicate changes, create
and revise ERM Mortgage Risk
Program documentation and
train employees on the new
policies
Scope of
Activities
Roles and
Responsibilities/S
cope of Activities
Governance
Policies,
Procedures and
Methodologies
Training and
Communications
Projected
Start Date
Projected
Finish Date
TBD
10/11/11
11/30/11
TBD
10/11/11
1/31/12
TBD
1/31/12
2/28/12
TBD
10/11/11
2/28/12
TBD
2/28/12
6/30/12
TBD
8/11/12
9/30/12
25
Confidential Treatment Requested
Appendix IV – Overview of Current Enterprise Risk Management (“ERM”)
Program
This section provides an overview of the ERM Program as October 2011. The remainder
of this Appendix outlines Ally Financial’s:
x
x
x
x
x
Risk Governance Structure
Risk Appetite and Metrics
Risk Oversight Functions
Risk and Control Self Assessment
Risk Management Functions (Mortgage Servicing Companies)
A. Risk Governance Structure
Ally Financial’s existing risk governance structure includes committees and councils
which are established at three different levels in the organization: Board, Management,
and Line of Business.
Figure 1 illustrates Ally Financial’s current governance structure for the Mortgage
Servicing Companies. (Other Board, Management, and Line of Business committees and
councils are not shown.)
Figure 1: Governance Structure of Councils and Committees
AFI
Board level
Risk and Compliance Committee
Management level
Global Risk Management Committee
Global Credit
Risk Committee
Compliance Risk
Committee
Global New Products
Committee
Mortgage Credit and
Operational Risk
Committee
Mortgage Servicing
Companies level
Mortgage Operations Council (currently the Issue
Management Meeting)
Servicing Council
Consumer Lending
Council
Business Lending and
Capital Markets Council
26
Confidential Treatment Requested
The Risk and Compliance Committee (“RCC”) is a board level committee which
assists the Board in setting the Risk Appetite and tolerances for Ally Financial. This
committee meets at least quarterly and oversees the management of Ally Financial’s risk
profile and the implementation of its risk management program, with emphasis on credit,
market, liquidity, operational and reputational risks from both an enterprise and mortgage
perspective.
Other responsibilities of the RCC include reviewing key reports and trends of Ally
Financial’s risk exposures, reviewing Ally Financial’s compliance with legal and
regulatory requirements, and reviewing and approving policies presented to the
committee.
The Global Risk Management Committee (“GRMC”) is a management level
committee which provides reporting to the RCC. The GRMC provides oversight of senior
management’s responsibility to manage the limits and metrics in line with the tolerances
set by the RCC. It also ensures implementation of Ally Financial’s enterprise risk and
compliance programs, and reviews and escalates risk issues up to the RCC as appropriate.
The GRMC meets at least quarterly and is chaired by the Chief Risk Executive.
The Global Credit Risk Committee (“GCRC”) is a management level committee which
provides reporting to the GRMC. The GCRC ensures that consumer and commercial
credit risks are managed in a safe and sound manner, consistent with Ally Financial’s
performance objectives and risk tolerances. The GCRC meets at least quarterly but
special meetings may be convened by the GCRC Chairperson (Chief Risk Executive) as
required.
The Compliance Risk Committee (“CRC”) is a management level committee which
provides reporting to the GRMC. The CRC provides oversight of Ally Financial’s
compliance risk management strategy and implementation of its compliance program.
The committee meets monthly and is chaired by the Chief Compliance Officer.
The Global New Products Committee (“GNPC”) is a management level committee
which provides reporting to the GRMC. The GNPC oversees and makes decisions related
to the new product development process. The GNPC meets monthly and is chaired by the
Enterprise Risk Executive.
The Mortgage Credit and Operational Risk Committee (“MCORC”) is a management
level committee which serves as the official risk decisioning body for mortgage-related
risk topics. MCORC provides oversight of all lines of business under the Mortgage
Servicing Companies, including consumer lending, servicing, and capital markets.
MCORC is responsible for ensuring that credit and operational risks are managed in a
safe and sound manner, and that activities are consistent with Ally Financial’s risk
strategy and vision.
Specific responsibilities of MCORC include reviewing and approving mortgage-related
origination and servicing policies and procedures, reviewing quality reports and trends,
and monitoring open control matters. MCORC reviews and approves the representation
and warranty reserves, establishes credit criteria for the origination of residential
27
Confidential Treatment Requested
mortgage loans, and ensures that the necessary resources are dedicated to fully implement
effective risk management programs and oversight in a timely manner.
The committee was recently formed through the merger of two committees: The
Mortgage Operational Risk and Compliance Committee and the Mortgage Credit Risk
Committee. This initiative was implemented to create a single forum for mortgage risks,
especially given the frequent overlap of credit, operational and other risks. The
committee meets at least monthly and is chaired by the Mortgage and Market Risk
Executive.
At the business level, several councils and other meetings were created to serve as the
forums for discussion of activities and issues related to the Mortgage Servicing
Companies.
The Mortgage Operations Council is aimed at reviewing the activities and addressing
the concerns of the entire mortgage operations business including consumer lending,
servicing, and capital markets. One of the weekly staff meetings of the President of
Mortgage Operations serves as the council meeting.
This meeting is spearheaded by a representative from Enterprise
Operational Risk and is conducted on a temporary basis to focus explicitly on operational
risk issues. Its agenda consists of reviewing the risk convergence report and issues that
are past due or coming due, discussing issues requiring escalation, and covering Legal
and Compliance updates.)
The Servicing Council was established by the Chief Servicing Officer to facilitate
information sharing, address ongoing activities and concerns, and discuss tactical
recommendations related to issues that impact mortgage servicing. The council is
chaired by the Chief Servicing Officer and officially includes over 30 invited individuals.
The council meeting occurs once a month in place of the Chief Servicing Officer’s staff
meeting. Therefore, the council’s agenda includes financial and operational performance
of the business; updates from Legal, Compliance, and Audit, and staffing and project
updates, in addition to risk identification and management.
The Consumer Lending Council was established by the Executive Vice President of
Consumer Lending and is responsible for oversight and information sharing of
operational and reputational risk issues and tactical recommendations for issues
impacting Consumer Lending. The council is chaired by the Executive Vice President of
Consumer Lending and includes nearly 20 invited participants and meets monthly. The
council maintains and reviews open issues, discusses action plans associated with issue
resolution, reviews policies and procedures and monitoring and testing activities, and
engages in oversight of activities to ensure Consumer Lending does not engage in unsafe
or unsound business practices.
The Business Lending and Capital Markets team has incorporated a monthly
discussion of open issues, action plans associated with issue resolution, and other risk and
control-related matters at its monthly staff meeting. .
28
Confidential Treatment Requested
B. Risk Appetite and Metrics
The Ally Financial RCC assists the Board in setting the risk appetite. The RCC’s
commitment to creating a sound risk management environment at all levels of the
organization is summarized in Ally Financial’s Risk Appetite and Philosophy Statement:
“To be effective, Ally Financial proactively takes and manages risk.
Our philosophy is to invest significant effort in understanding the
nature and potential outcomes of the risks we take, and to incorporate
those risks into how we price our products, consider and design new
practices, and execute our business on a daily basis.
We strive to embed this philosophy at all levels of our organization so
that anyone, at any time can and should call attention to risks that
may not be obvious and ensure that they are fully assessed and taken
into account.”
One of the primary responsibilities of the RCC is to approve the Risk Appetite
Framework on an annual basis. This framework sets the risk capacity, risk appetite and
risk tolerances of Ally Financial, which are translated into more granular limits and
indicators, to ensure all lines of business are aligned with the high-level guidelines.
The main components of the Risk Appetite Framework are depicted in Figure 2 below.
Figure 2: Risk Appetite Framework
Risk
Capacity
•
How much risk is Ally “able” to accept based on capital and liquidity
•
Risk Appetite
Risk Tolerances
How much risk is Ally “willing” to accept based on capital
and liquidity
•
Risk Limits and
Underwriting Criteria
Indicators of Risk (Risk Metrics and
Key Performance Indicators)
How much risk is Ally “willing” to accept in other material
risks such as credit and market risk
•
More granular thresholds to ensure variation from
expected outcomes will be consistent with tolerances
•
Granular risk metrics used to continuously
monitor key risks
Figure 2. The RCC is responsible for approving the top three components of the pyramid.
The approach for determining Risk Capacity and Risk Appetite entails comparing current
and projected capital levels to regulatory “well-capitalized” minimums and evaluating
capital adequacy leveraging economic capital and stress testing. The bottom two
components represent the lower-level limits and metrics which are product-specific and
utilized by management to control and monitor risk at a more granular level.
29
Confidential Treatment Requested
The Risk Appetite Framework incorporates metrics, limits, and tolerances for interest
rate, credit, leasing, insurance, market, operational (which includes legal), regulatory
compliance, and profitability risks.
Table 1: 2011 Risk Appetite Metrics shows the current (2011) risk appetite metrics and
limits.
Table 1: 2011 Risk Appetite Metrics
Capacity
(e.g. Reg
Well-Cap
Minimums)
Appetite
(AFI Imposed)
Comparison
(Actual=A;
Forecast=F)
Criteria
Statement
Capital Adequacy
Target
Capital
Ratios
We target our current
and forecasted capital
levels (adjusted for
reasonably achievable
mgmt Action Plans,
e.g. MCP conversion)
to exceed required
regulatory and
AFI-imposed
capital levels
Tier I Contingent
Common > 5%
Tier I > 6%
Total > 10% (15%)
Tier I Contingent
Common > 8.5%
Tier I > 10.0%
Total > 12.5% (15%)
4Q10A 4Q11F 4Q12F
12.4% 11.4% 10.6%
15.0% 13.8% 12.8%
16.4% 14.9% 13.5%
With stress losses
incorporated, we
target our current and
forecasted capital
levels (adjusted for
reasonably achievable
mgmt Action Plans,
e.g. MCP conversion)
to exceed required
regulatory and AFIimposed capital levels
Tier I Contingent
Common > 5%
Tier I > 6%
Total > 10% (15%)
Tier I Contingent
Common > 8.5%
Tier I > 10.0%
Total > 12.5% (15%)
4Q11F
10.9%
13.5%
14.7%
We target for our Tier
I regulatory capital
levels to exceed
current economic
capital levels
Tier I Regulatory
Capital > Ecap
Tier I Regulatory
Capital > Ecap
> by $7.3 BN (4Q10)
We will maintain a
reserve of excess
liquidity sufficient to
allow the business to
operate and meet
all financial
obligations when
access to funding
is disrupted
See Liquidity
metric framework
See Liquidity
metric framework
See Liquidity
metric framework
Risk capacity/Risk appetite
Components
Liquidity
Target
Liquidity
Ratios
4Q12F
9.1%
11.3%
12.3%
30
Confidential Treatment Requested
Risk tolerance
Tolerance –
AFI Imposed
Comparison
Components
Criteria
Statement
Interest
Rate Risk
Earnings
at Risk
We seek to limit the downside change in ALCO approved:< 10%
the forecasted 12 month EaR given a +/100 bps interest rate shock
-100: +3.2%
+100: -6.8%
Economic
Value
of Equity
We seek to limit the downside change in ALCO approved: < 20%
the forecasted 12 month EVE given a +/200 bps interest rate shock
-200: -4.5%
+200: -0.1%
Credit Risk
Credit Risk
Guardrails
We will set our underwriting standards
& limits to help keep portfolio losses
within our portfolio guardrails
Plan, Breakeven, Capital, See Credit guardrails
and
Industry Guardrails
Leasing
Residual Risk
Residual
Risk
Guardrails
We will set our underwriting standards
and limits to help keep portfolio losses
within our portfolio guardrails
Plan, Breakeven, and
Capital Guardrails
See Lease guardrails
Insurance Risk
Combined
Ratio
Guardrails
We will set our underwriting standards
& limits to help keep portfolio losses
within our portfolio guardrails
Plan and Breakeven
Guardrails
See Insurance
guardrails
Market Risk
Market
Risk Limits
We will manage the market risk for
ALCO-approved limits
market sensitive portfolios to stay within
ALCO-approved limits
See market risk
limits
We aim to achieve operational
excellence and seek to maintain a
“no material surprises” environment
Annual net operational
losses (not incl. R&W)
< 2% of net revenues
1.02% (Jan-Nov
2010)
We aim to achieve operational
excellence in order to control
R&W losses
Ongoing portfolio
<= 7 bps (currently
$25 MM)
Legacy portfolio
<= Current Reserve
($808 MM)
$22 MM current
reserve
> 90% of open issues
closed within 30 days of
targeted issue resolution
date (severity 1,2,&3)
12/31/10 = 94%
Operational Risk Ops Risk
Losses
(excl. R&W)
R&W Losses
Open Control We aim to effectively resolve open
control matter issues in a timely manner
Matters
(e.g. Audit, SOX, RCSA, Loan Review,
Model Validation, etc.)
Regulatory
Compliance
Risk
Regulatory
Compliance
Complying with all laws & regulations is
a fundamental principle for AFI. In this < 5% re-open
regard, we will establish standards,
severity 1, 2 & 3 issues
controls and practices to meet this
principle. To this end, we will meet
commitments made to regulators with
respect to supervisory actions in a timely
and effective manner
Profitability
Return
on Equity
We aim to balance the risk/reward
equation by staying within risk
tolerances but also achieving an ROE
that is favorable to the Board approved
target (or Plan)
2011 YTD ROE (Net
Income Ex OID/Total
Equity Less OID) >= 8%
$808 MM current
reserve
12/31/10 = 0.92%
14% for 2010
31
Confidential Treatment Requested
C. Risk Oversight Functions
Risk, Compliance, and Legal, among other functions, comprise the second line of defense
and are responsible for the measurement, monitoring and reporting of risks. Audit and
Loan Review comprise the third line of defense. Figure 3 illustrates the organizational
structure of the risk oversight functions.
Figure 3: Organizational Structure of Risk Oversight Functions
Chief Executive
Officer
Other functions
Other functions
General Auditor
Other functions
Chief
Administrative
Officer
Chief Risk
Executive
Chief Compliance
Officer
General Counsel
Enterprise Risk
Executive
Mortgage Risk/
Market Risk
Executive
Other
functions
Enterprise
Operational Risk
Executive
Director
Loan Review
Executive
Other
functions
Mortgage Risk and Market Risk reports to the Enterprise Risk Executive and is
responsible for providing oversight for all mortgage risks including credit, market and
operational risks. Certain operational risk oversight activities are housed within mortgage
risk and market risk. These include Quality Assurance (primarily based on investor and
regulatory guidelines), fraud detection and prevention, valuation management, mortgage
credit policy administration, business lending oversight, repurchase management, and
servicing oversight.
Enterprise Risk Management reports to the Enterprise Risk Executive and is comprised
of Enterprise Operational Risk and other central/corporate risk functions that span the
Enterprise(i.e., functions that are not mortgage specific, but rather are executed using the
same methodology across all of Ally Financial’s LoBs and Global Functions), including
ensuring consistency in the application of enterprise-wide policies. These other functions
also include business continuity planning, global processes to ensure adherence to certain
Basel II requirements, economic capital modeling, enterprise-wide stress-testing,
corporate insurance, “top-of-the-house” credit risk data and reporting, maintenance of the
32
Confidential Treatment Requested
risk appetite framework, country risk and enterprise risk committee reporting (e.g., RCC,
GRMC, GCRC, Global New Product Committee).
Enterprise Operational Risk under Enterprise Risk Management supports Ally Financial’s
LoBs and Global Functions in implementing and sustaining an Operational Risk
Management Framework (RCSA, loss data collection, scenario analysis, key risk
indicators, risk reporting, etc.) that meets Ally Financial policy requirements and satisfies
regulatory requirements.
Compliance is a Global Function, reporting to the Chief Administrative Officer, and
responsible for driving Ally Financial’s enterprise-wide culture of compliance with laws,
regulations, and compliance policies. Compliance is comprised of two groups working
together to achieve effective oversight and management of compliance risk across Ally
Financial. The two groups are Enterprise Compliance Program Management (“Enterprise
Compliance”), and Line of Business and Global Function Compliance Officers and their
staff (“Line of Business Compliance”). The Chief Compliance Officer reports directly to
the Chief Administrative Officer, thereby ensuring independence from Risk.
Under Ally Financial’s current compliance risk management structure, senior
management is accountable for all compliance risks in the line of business, including both
existing and emerging compliance risks. Line of Business compliance officers, work with
the lines of business to identify, assess, and develop solutions to mitigate and manage
risks. Enterprise Compliance provides oversight, support, and guidance for Line of
Business Compliance through policies and procedures, independent risk-based
assessments, and training programs.
Legal reports to the Chief Administrative Officer and is responsible for identifying and
interpreting changes to rules, laws and regulations which will impact business processes.
It partners with Compliance to make sure lines of business are aware of current
guidelines and ensure they are updating policies, procedures and processes when these
guidelines change. Legal tracks relevant changes to laws and regulations in a database to
analyze their implications and assess the potential impact on business processes. Legal
alerts the lines of business affected by new regulations. The LoB then develops an Action
Plan to address the required changes. Action Plans are subsequently cross-checked with
Legal and Compliance to provide a framework intended to ensure compliance.
Loan Review is responsible for providing an objective and timely assessment of the
overall quality of the consumer and commercial loan and financing portfolios. It
identifies relevant trends that affect the collectability of the portfolios, isolates segments
of the portfolios that are potential problem areas, and identifies commercial loans with
potential credit weaknesses. Loan Review ensures accuracy and consistency of risk
ratings and assesses the adherence to internal credit policies and loan administration
procedures. This function also provides senior management with essential credit
information to determine the adequacy of the allowance for loan and lease losses.
The Loan Review Executive is independent from the lines of business and reports
directly to the RCC, with a dotted line to the Chief Administrative Officer.
33
Confidential Treatment Requested
Loan Review’s scope includes Global Automotive Services, Commercial Finance and
Mortgage. Within the mortgage business, Loan Review was originally focused on credit
risk related to the origination of loans. However, it has since expanded its scope to cover
servicing processes, including HAMP, collections, REO, and default operations. Loan
Review will complete reviews with a frequency dependent on line of business risk
profiles, portfolio trends, changes in the external environment, and results of previous
reviews.
Audit Services is responsible for developing a flexible annual audit plan using an
appropriate risk-based methodology approved by Ally Financial’s Audit Committee. It
implements and executes the approved audit plan and any other special reviews or
projects requested by the Audit Committee or agreed upon with senior management.
Audit provides an independent ongoing and at least annual assessment of the adequacy of
Ally Financial’s processes for controlling its activities and managing its risks. It has
established processes in preparing yearly, 2-year, and 3-year plans for board approval and
assigning areas of audit priority based on the internal risk assessment process. Audit
frequency is formally re-assessed for each auditable unit on an annual basis during the
risk assessment process, and may be adjusted throughout the year based upon the
occurrence of events and circumstances that could increase or decrease the entity’s
relative risk. Audit’s risk assessment results for foreclosure and loss mitigation resulted
in high priority ratings warranting annual audit plan coverage.
Audit is headed by the General Auditor who is independent from the lines of business
and reports directly to the Ally Financial Audit Committee and administratively to Ally
Financial’s CEO.
D. Risk and Control Self Assessment
The RCSA is a two step process whereby risk owners assess the likelihood and severity
of their risks (at both the inherent and residual levels) as well as effectiveness of the
controls designed to mitigate or contain those risks. In the first step, all core processes
within each line of business are assessed through the Key Process Assessment. Processes
identified as high or medium-high residual risk go through a detailed assessment in the
second step which is the Targeted Risk Assessment.
The Key Process Assessment is facilitated by Enterprise Operational Risk and is updated
at least annually to keep up with material changes in the business environment and other
internal controls. The Key Process Assessment identifies key plausible risks and related
controls, and rates them using frequency and severity factors. The ratings are
supplemented by commentary, which makes the Key Process Assessment both a
qualitative and quantitative assessment.
The Targeted Risk Assessment is facilitated by Enterprise Operational Risk on high and
medium-high residual risk rated processes as determined by the Key Process Assessment.
The assessment determines whether the residual risk is at an acceptable level. If the
residual risk level is not acceptable, a problem statement is created and a solutions
analysis is performed to determine if further action is required to mitigate the risk.
34
Confidential Treatment Requested
Each line of business has a dedicated enterprise operational risk manager who facilitates
risk identification and management activities such as the RCSA process. For example, the
dedicated Enterprise Operational Risk manager for the Mortgage Servicing Companies
has a dotted-line into the Mortgage Risk and Market Risk function and facilitates the
execution of RCSAs within the mortgage business.
E. Risk Management Functions
Within the Mortgage Servicing Companies, risks are currently managed through two
newly-established functions. These functions serve as the first line of defense and focus
on identifying and addressing risks within the day-to-day activities of the lines of
business as summarized below and in Figure 4:
(1) Business Risk and Controls Management was established to promote risk
ownership and coordinate risk management practices across the Mortgage
Servicing Companies
(2) Servicing Strategy and Operational Excellence was established to enhance risk
controls, quality management, and business processes across the servicing
business by emphasizing operational excellence
Figure 4: First Line of Defense Organizational Structure
CEO and Chairman ResCap
President Mortgage Operations
Business Risk and
Control Management
Chief Servicing
Officer
Business Units
Servicing Strategy
and Operational
Excellence
Business Units
Newly-established functions
35
Confidential Treatment Requested
Business Risk and Controls Management
Business Risk and Controls Management serves as the point of contact between Risk and
the line of business. This function was established in April 2011 (though certain of the
functions within this group were already in place at that time) and verifies that internal
controls are operating effectively, partners with the line of business to set risk
management strategies, establishes escalation procedures, and assists the business
through the internal audit life cycle.
Business Risk and Controls Management monitors new or revised business practices,
system changes, and policies to ensure that risks are identified and addressed. The
function aims to strengthen risk management practices within the business through the
following activities illustrated in Figure 5.
Figure 5: Business Risk and Controls Management Organizational Structure
President of Mortgage Operations
Business Risk and ControlsManagement
Internal Controls
and Processes
Issue Escalation
and Regulatory
Coordination
Centralized
Variable
Compensation
Business Audit
Excellence
Internal Controls and Processes performs testing to ensure key operational procedures
are performed timely and are adequately documented. This function conducts
independent testing and monitoring to identify control gaps within the business. The
function aims to strengthen the business' ownership of risk, including driving the
businesses to take the lead during the RCSA process. Internal Controls and Processes also
partners with the lines of business and Enterprise Operational Risk in the development of
the annual Key Process Assessments and Targeted Risk Assessments.
Issue Escalation and Regulatory Coordination establishes the policies, procedures and
reporting capabilities to effectively manage the issue escalation and reporting functions
as well as coordinates the timely completion of regulatory requests. This function
provides the line of business with training and tools for issue escalation up to Enterprise
Operational Risk, Audit, and Compliance through the Issue Escalation Mailbox.
36
Confidential Treatment Requested
Centralized Variable Compensation monitors and updates the current inventory of
variable compensation plans. Administration of the incentive compensation program is
currently being centralized through an external vendor.
Business Audit Excellence maintains an open dialogue with Audit and assists the
business in preparing for internal audit.
Servicing Strategy and Operational Excellence
Servicing Strategy and Operational Excellence was established in August, 2011 to help
ensure adequate controls are in place within the servicing business and provide a formal,
centralized process to manage change. The function reports directly to the Chief
Servicing Officer. It is also dotted-lined into Business Risk and Controls Management to
ensure servicing-related topics are coordinated with other mortgage risk management
activities. New units are currently being formalized under this function as outlined in
Figure 6.
Figure 6: Servicing Strategy and Operational Excellence Organizational Structure
Chief Servicing Officer
Business Risk and Controls Management
Servicing Strategy and Operational Excellence
Quality
Management
Business
Servicing
Process
Risk
Improvement
Business
Strategy and
Reporting
Servicing
Platform &
Strategy
Vendor
Oversight
Policy,
Procedure &
Change
Control
The groups under Servicing Strategy and Operational Excellence include the following:
Quality Management has been established and is in the process of expanding its
activities to include the full servicing spectrum (e.g. escrow, collections, cashiering, etc.),
which it expects to complete by December 2011. It provides quality control feedback on
business activities and aims to help the business in managing their own risks. Quality
Management consists of two departments: Quality Assurance and Operational Controls.
Quality Assurance conducts internal “quality audits” to determine the status and
effectiveness of personnel, processes, and vendors. These are documented reviews
conducted on an ongoing basis aimed to verify in real-time that activities are being
performed accurately and in accordance with policies and procedures. Operational
Controls performs quality control reviews and oversees the timeline of critical business
processes, including workflow tracking of foreclosure referral, pre-foreclosure sale, and
Loss Mitigation activities.
37
Confidential Treatment Requested
Business Process Improvement recently hired the head of this group and is increasing
the staff by year-end 2011.. Business Process Improvement is responsible for identifying
emerging opportunities through customer excellence and tracking litigation trends that
could result in control gaps. The function handles the complaint management process and
conducts customer satisfaction surveys for the servicing business. Planned developments
include enhancing the process to better incorporate economic and market analysis into
tactical business plans.
Servicing Risk is already established, manages external (investor) audits and regulatory
examinations and coordinates with external stakeholders who want to examine the
servicing business. Servicing Risk is also responsible for managing the database of
existing issues and action plans.
Business Strategy and Reporting is already established and provides analytics and
reporting for all servicing activities. Business Strategy and Reporting tracks KPIs, KRIs,
and risk metrics and develops models to track business activity in order to produce the
Operations Performance report.
Servicing Platform and Strategy is already established and evaluates the effectiveness
of the current servicing platform in order to determine if the platform is capable of
supporting future needs. This function works alongside Policy, Procedure, and Change
Control to implement required changes to the servicing platform as they become
necessary.
Vendor Oversight is fully staffed and recently identified a head of the group. This
function provides governance and oversight of vendors and conducts independent
assessments of how the servicing business manages vendor relationships. Planned
enhancements include the establishment of a dotted-line relationship up to the group
responsible for managing the Third Party Management Vendor Office established
pursuant to the Consent Order. As an ongoing effort, Vendor Oversight aims to ensure
the alignment of vendor management activities within servicing with the supplier
guidelines established at the enterprise level.
Policy, Procedure, and Change Control is in the process of identifying a head of the
group while also in the process of increasing staff, with an expectation it will be
completed by January 2012. Apart from ensuring that policies around desktop procedures
are consistent, Policy, Procedure, and Change Control’s responsibilities are to centralize
the change management process and work with the line of business to implement and
communicate changes. While Legal is responsible for monitoring the external
environment for changes in laws and regulation, this group partners with Legal,
Compliance and Training to codify and communicate such changes.
38
Confidential Treatment Requested
4
Capital
management
Confidential Treatment Requested
Source: Oliver Wyman
Sets management limits within Constructs bottom-up
individual Risk limits
plans including a 1-2
year budget and a 3-5
year strategic plan
Iterates plans with senior
management to achieve
overall corporate goals
Primary responsibility for
identification of new Risks
Responsibility for Risk
underwriting, decisioning and
pricing
Primary responsibility for
measurement methodology
and core parameters
assumptions (e.g. expected
loss for credit Risk)
Provides key inputs into the
economic capital process
For each Risk, assesses the
impact of plan on Risk levels
ensuring plans result in
acceptable profile within
the Risk
Risk
identification
and
measurement
Translates high-level Risk
appetite and limits into
business line and Risk specific
limits
Strategy
and framework
3
Owns overall measurement
Assesses Risk impact of plan, Aggregates Risks across
methodology for
business units, highlighting and
ensuring plans align with Risk
economic capital
prioritizing key Risks
appetite and resulting Risk
profile is acceptable
Identifies new and emerging
Risks and responsible for new
product Risk review
Risk appetite and limits
2
Articulates bank-wide
Risk appetite
Converts Risk appetite into
overall limits or tolerances for
specific Risks
1
Appendix V: Typical roles and responsibilities across Risk Management activities
Cross-Risk
Risk unit
Business
39
Cross-Risk
Risk unit
Develops Risk-specific policies
(e.g. credit Risk policy,
investment policy)
Provides feedback to
refine policies
Develops procedures to ensure
compliance with policies
6
Model
management/
oversight
7
Responsible for model
development and compliance
with policies for business and
finance models
Responsible for model
development and compliance
with policies for Risk models
Develops cross-Risk policies (e.g. Responsible for model Risk
model governance, aggregate
oversight and model validation
limits)
functions
Sets policy governance
structure
Policy and procedure
5
Primary review of Risk on
transactions/decisions
Monitors Risk versus limits
Typically has transaction
authority for credit Risk with
varied degree of delegation
Transactional
Risk
Management
8
Primary responsibility for Risk
reporting for each Risk type
Reports on aggregate
Risk profile
Informs senior management
about critical Risks and
initiates a resolution plan
Reporting
Typical roles and responsibilities across Risk Management activities
Confidential Treatment Requested
Business
40
ALLY FINANCIAL INC.
GMAC Mortgage, LLC and Residential Capital, LLC and Ally Bank
Ally Audit Services Consent Order Action Plan
Prepared for the Board of Governors of the Federal Reserve System and the Federal
Deposit Insurance Corporation
Revised on December 7, 2011
1
Confidential
Table of Contents
Plan Overview for Audit Services ................................................................................. 3
Effectiveness of Current Audit Program ...................................................................... 7
Specific Planned Audit Program Enhancements to Strengthen Residential Mortgage
Loan Servicing, Loss Mitigation and Foreclosure Activity Reviews ......................... 12
Appendix I - Project Summaries................................................................................. 17
Appendix II - Board Level Deliverables and Due Dates ............................................ 17
Appendix III - First Level Project Details .................................................................. 17
2
Confidential
Ally Audit Services Consent Order Action Plan
Plan Overview for Audit Services
This Program for Ally Audit Services (the “Program”) is established in response to the
Consent Order dated April 13, 2011 (the “Order”) among the Board of Governors of the
Federal Reserve System ( the “FRB”), the Federal Deposit Insurance Corporation (the
“FDIC”), Ally Bank (the “Bank”), Ally Financial Inc. (“Ally Financial” or “AFI”), and
certain of Ally Financial’s direct and indirect subsidiaries including Residential Capital,
LLC (“ResCap”) and GMAC Mortgage, LLC (“GMACM” and together with ResCap, the
"Mortgage Servicing Companies") for purposes of the Order. Capitalized terms not
defined in the Program shall have the meanings assigned to them in the Order.
The purpose of this Program is to set forth the actions and responsibilities necessary
for Audit Services to comply fully with its obligations under Sections 16 and 17 of the
Order (see Appendix I). Sections 16 and 17 of the Order require that:
16. Within 60 days of this Order, Ally Financial shall submit to the Reserve Bank an
acceptable written plan to enhance the internal audit program with respect to residential
mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations. The
plan shall be based on an evaluation of the effectiveness of Ally Financial's current
internal audit program in the areas of residential mortgage loan servicing (as defined),
Loss Mitigation, and foreclosure activities and operations, and shall include
recommendations to strengthen the internal audit program in these areas. The plan shall,
at a minimum, be designed to:
(a) Risk Assessment Process (Section 1.2) and Incremental Audit Coverage (Section
2.4) - ensure that the internal audit program encompasses residential mortgage loan
servicing, Loss Mitigation, and foreclosure activities;
(b) Center of Excellence Construct (Section 2.1) - periodically review the effectiveness
of the Enterprise Compliance Program (”ECP”) and Enterprise Risk Management
(“ERM”) with respect to residential mortgage loan servicing, Loss Mitigation, and
foreclosure activities, and compliance with the Legal Requirements and supervisory
guidance of the Board of Governors;
(c) Adequate Qualified Staffing (Section 1.1) and Staffing (Section 2.2) - ensure that
adequate qualified staffing of the audit function is provided for residential mortgage
loan servicing, Loss Mitigation, and foreclosure activities;
(d) Audit Finding Resolution (Section 1.4.3) - ensure timely resolution of audit findings
and follow-up reviews to ensure completion and effectiveness of corrective measures;
(e) Documentation, Tracking and Reporting (Section 1.4.4) - ensure that
comprehensive documentation, tracking, and reporting of the status and resolution of
audit findings are submitted to Ally Financial's audit committee; and
(f) Issue Escalation Process (Section 1.4.5) - establish escalation procedures for
resolving any differences of opinion between audit staff and management concerning
audit exceptions and recommendations, with any disputes to be resolved by the audit
committee.
3
Confidential
17. Within 60 days of this Order, Ally Financial and ResCap shall submit to the Reserve
Bank an acceptable enhanced written internal audit program to periodically review
compliance with applicable Legal Requirements and supervisory guidance of the Board
of Governors at the Mortgage Servicing Companies that shall, at a minimum, provide
for:
(a) Board Approval (Section 1.3.2) - an annual written, risk-based audit plan approved
by ResCap's board of directors that encompasses all appropriate areas of audit
coverage;
(b) Planning Process (Section 1.3.1) - the scope and frequency of audits;
(c) Independence (Section 1.4.2) - the independence of the internal auditor, audit staff,
and ResCap's audit committee;
(d) Center of Excellence Construct (Section 2.1) and Audit Program Enhancements
(Section 2.3) - inclusion in the audit scope of reviews of internal controls, MIS, and
compliance with GMAC Mortgage's internal policies, procedures, and processes,
including, but not limited to, the Loss Mitigation and foreclosure processes;
(e) Audit Program Enhancements (Section 2.3) - adequate testing and review of MIS
used in servicing, Loss Mitigation, and foreclosure activities to ensure compliance
with the Legal Requirements;
(f) Timely Completion of Audit Plan (Section 1.3.4) - controls to ensure that audits
are completed on a timely basis in accordance with the approved audit plan;
(g) Adequate Qualified Staffing (Sections 1.1) and Staffing (Section 2.2) - adequate
staffing of the audit function by qualified staff;
(h) Audit Finding Resolution (Section 1.4.3) - timely resolution of audit findings and
follow-up reviews to ensure completion and effectiveness of corrective measures;
(i) Documentation, Tracking and Reporting (Section 1.4.4) - comprehensive
documentation, tracking, and reporting of the status and resolution of audit findings
to ResCap's audit committee, at least quarterly; and
(j) Issue Escalation Process (Section 1.4.5) - establishment of escalation procedures for
resolving any differences of opinion between audit staff and management concerning
audit exceptions and recommendations, with any disputes to be resolved by ResCap's
audit committee.
Audit Services (“Audit”) has assessed the effectiveness of the current internal audit
program against the requirements of the Order, through review of current methodologies,
routines, practices and enhancements made since October 2010 (See Attachment 1).1 As
a result of this assessment, Audit has identified areas in the Program that are operating
effectively and do not require enhancement. However, Audit did identify areas where
further enhancements are warranted and actions will be taken to strengthen coverage and
review of residential mortgage loan servicing, loss mitigation, and foreclosure activities,
including servicing related ECP, ERM, and MIS activities. These enhancements are
intended to address the Consent Order as well as the findings identified in the Interagency
Review of Foreclosure Policies and Practices. In addition, Audit participated in highlevel discussions with peers and considered our proposed enhancements to be similar in
nature.
1
Departmental enhancements since October 2010 include development and implementation of
departmental training on audit methodology (Section 1.1 page 6), a more granular annual risk assessment
for 2011 (Section 1.2 pages 6-7), planning interview and process walkthrough guidance, dynamic scoping
during audits, and mandatory closing meetings with required participants (Section 1.3.3 page 9).
4
Confidential
Accordingly, this action plan is divided into two sections. Section 1 summarizes areas
where Audit has concluded that the current audit program is effective as of May 2011,
including:
x
x
x
x
An audit team comprised of seasoned professionals with dedicated resources to
cover mortgage-related audits.
An enhanced 2011 granular risk assessment process, which includes residential
mortgage loan servicing, loss mitigation, and foreclosure activities.
Audit Plan development and execution that includes Ally Financial, Ally Bank,
and ResCap Audit Committee approvals and monitoring controls to ensure timely
Audit Plan completion.
Audit governance that includes independence of the audit function, timely
resolution of audit findings, tracking and reporting of audit findings to the Audit
Committees, and an established issue escalation process.
Section 2 contains specific actions, in priority order, that Audit will take to enhance the
audit program:
x
x
x
x
x
Increased staffing through the hiring of additional qualified personnel, and
planned use of Subject Matter Experts (“SME”) during audits of residential
mortgage loan servicing, loss mitigation, and foreclosure activities. Audit will
complete these actions by December 2, 2011.
Development of a Servicing Center of Excellence (“CoE”) to enhance audits of
residential mortgage loan servicing, loss mitigation, and foreclosure activities
through: creation of standardized audit programs, utilization of in-house staff
expertise on servicing audits, staying current on emerging servicing risks and
issues, assessment of legal risks, and multiple required touch-points during
servicing audits to ensure proper scoping and focus. Audit will complete these
actions on September 7, 2011.
Creation of Standardized Audit Programs for high-risk areas of residential
mortgage loan servicing, including MIS and audit planning activities to ensure
comprehensive coverage and testing of Legal Requirements, supervisory guidance
of the Board of Governors, and compliance with mortgage’s internal policies,
procedures, and processes as required areas of focus and testing. Audit will
complete these actions by November 2, 2011.
Incremental audit coverage as a result of the business unit enhancements that will
be made to address this Consent Order Audit will encompass these activities into
the 2012 Risk Assessment and develop an Audit Plan that will be approved by the
Ally Financial, Ally Bank, and ResCap Audit Committees by April 1, 2012.
Audit will create and deliver training on residential mortgage loan servicing by
July 1, 2012
5
Confidential
Audit commenced the staffing enhancement outlined in Section 2.2. All steps related to
staffing are complete with the exception of training, which will be complete by July 1,
2012. Audit expects to fully complete the action plan by July 1, 2012 (Appendix I &
Appendix III). In addition, Audit will review the action plan and deliverables with the
Ally Financial, Ally Bank, and ResCap Audit Committees. Execution of the Action Plan
steps will be confirmed through the Quarterly Progress Reports and Independent Third
Party Verification required by the Order.
6
Confidential
Effectiveness of Current Audit Program
1.1 Adequate Qualified Staffing
Audit is comprised of an integrated, highly-skilled audit team that provides internal
audit services to Ally Financial, Ally Bank, and ResCap. Internal audit services, as
described in the Audit Services Continuum2 (See Attachment 2), include assurance
services (audits and issue validation) and consulting services (advisory work and
continuous monitoring).
Consistent for the past year and as of April 30, 2011, Audit has over 100 employees,
93% of whom are professional staff. Of the professional staff, 58% have core
certifications (e.g. CPA, CIA, CISA, CAMS, and CRCM) with an additional 34%
pursuing core certifications. 21% of the team is dedicated full time to performing
mortgage related audits. The mortgage team has an average of 10+ years of audit
experience with core competencies in loan servicing, loan originations, and mortgage
capital markets, including applicable Legal Requirements and supervisory guidance
related to mortgage audit areas. In addition, the Executive Audit Director and Audit
Director of the mortgage team each have over 12 years of audit experience within the
mortgage industry.
In April 2011, Audit implemented a robust learning and development program to
educate and train all staff levels within the department on the audit methodology and
approach to performing audits. In addition, mortgage audit team members take
regulatory compliance, mortgage servicing and capital markets training using
computer based training modules and / or instructor led courses. Finally, all audit
team members have an annual goal to complete at least 40 hours of training, and this
goal is monitored and tracked throughout the year.
While Audit has a seasoned and qualified staff as outlined above, Audit recognizes
the need to further enhance and grow the audit staff to improve the effectiveness of
the audit program. In addition, training enhancements over residential mortgage loan
servicing, loss mitigation and foreclosure activities will be implemented and Audit
will leverage external SMEs to enhance current staffing skill sets. See Section 2.2 for
details on these proposed enhancements.
1.2 Risk Assessment Process
Audit performs an annual Risk Assessment process that considers all areas of Ally
Financial inclusive of Ally Bank and ResCap and includes residential mortgage loan
servicing, loss mitigation, and foreclosure activities. The 2011 Risk Assessment was
enhanced from the 2010 Risk Assessment, using a more granular methodology, and
included a review of 220 entities across Ally Financial. Specific enhancements
include: automation via the
module within the
audit software,
use of the enterprise risk convergence structure, alignment of the audit universe to the
standard organizational structure, modifying the risk categories used to assess risks,
2
The Audit Services Continuum (finalized in September 2010) explains the various types of work
performed by Ally Audit Services and the percentage of time within the audit plan dedicated to the various
activities. For example, 80-90% of the Annual Audit Plan is dedicated to performing assurance services
(audits and issue validations).
7
Confidential
and developing guidance to help assess inherent risk and control strength, and to help
ensure adequate consideration of compliance and information technology risks.
As part of the risk assessment process, Audit conducted extensive
meetings with all levels of management to review and discuss the Risk Assessment
results. In addition to the improvements noted above, Audit will further enhance
audit coverage and scoping of residential mortgage loan servicing, loss mitigation and
foreclosure activities. See sections 2.1, 2.3, and 2.4 for further details on these
enhancements.
In addition, the company initiated a risk convergence program to leverage
complementary risk assessment results and other data to help assess risk across the
organization. Where documented, Audit leverages other risk-related assessments
from Legal, Enterprise Compliance Program (“ECP”), Enterprise Risk Management
(“ERM”), Control Self-Assessments (CSA), and SOX Control Assessments. While
Audit’s risk assessment is independent, these efforts help to confirm results and
reduce conflicting or contradictory information.
1.3 Development and Execution of Audit Plan
1.3.1 Annual Planning Process
As an output from the annual risk assessment process described above, Audit
develops a three-year rolling audit plan. The risk-scoring model within the risk
assessment factors both inherent risk and strength of controls across nine risk
categories (Financial, Credit, Operational, Compliance, Human Capital, Market,
Liquidity, Strategic & Reputation, and Governance) and generates a risk score to
determine audit priority. Audit priority determines the frequency of coverage
whereby a priority 1 rating corresponds to annual coverage; priority 2 corresponds
to biennial coverage; and priority 3 triennial coverage (See Exhibit 1). In
addition, audits can be included on the audit plan due to regulatory requirements,
management requests, or other factors. For example, the Non-Traditional
Mortgage Products audit was added to the 2011 Audit Plan due to a regulator
expectation and the Document Custody audit is conducted annually due to a
regulatory requirement.
Exhibit 1 - Audit Priority Matrix
8
Confidential
Audit frequency is formally re-assessed for each auditable unit on an annual basis
during the risk assessment process, and may be adjusted throughout the audit year
based upon the occurrence of events and circumstances that could increase or
decrease the entity’s relative risk. For example, the results of Global Security
investigations or changes to laws and regulations could increase an entity’s
relative risk whereas discontinued operations or ceasing business activities could
decrease an entity’s relative risk. In addition, results from the Audit Continuous
Monitoring Program (meetings with business management, review of operation
reports, etc.) is another process used by Audit to assist in determining potential
changes in priorities or risk, and resultant audit scopes.
1.3.2 Board Approval of Plan
Audit presents the annual audit plan to the Ally Financial, Ally Bank, and ResCap
Audit Committees by April 1, 2012 for approval prior to the commencement of
annual work. Each of these Committees is comprised of independent
representatives from the Board of Directors, and the Audit Committees are
responsible for assisting the Board of Directors in the oversight over the work of
the Internal Audit Department. Those responsibilities include review and
approval of the annual internal audit plan. In this capacity, the Audit Committee
is performing its duties as authorized by the Board of Directors. Approval of the
audit plan(s) are documented in the minutes of these meetings, and changes to the
plans during the year are also presented and subject to Audit Committee approval.
1.3.3 Execution of Audit Plan
Ally’s audit process consists of a robust three-phase audit approach (Planning,
Fieldwork, and Reporting) as depicted in Exhibit 2 below. All audit work
completed within each phase is documented and retained within the
audit work paper system (effective March 1, 2011). In addition, Audit conducts
post audit activities after the reporting phase, which includes timely resolution
and follow-up on audit findings (see section 1.4.3 for further details).
Exhibit 2 – Phases of Audit Execution
9
Confidential
Audit implemented procedural enhancements to the audit process in March 2011.
The enhancements included:
x
x
x
x
Specific guidance and direction to audit teams conducting planning
interviews. (See Attachment 3a)
Process walkthrough guidance, including a requirement to conduct process
walkthroughs prior to finalizing audit scopes. (See Attachment 3b)
Dynamic scoping to promote continued management discussions on
emerging risks and other information throughout the audit that might
require a change in audit scope.
Mandatory closing meetings for all audits, including required attendance
by relevant Risk, Compliance, Legal, and other functional partners to the
business, and affirmation by attendees as to whether they are aware of any
other matters that are relevant to the audit that may potentially impact
Audit’s opinion. This affirmation is captured within the audit work papers
related to the audit-closing meeting.
1.3.4 Timely Completion of Audit Plan
Audit has several controls to ensure timely completion of the Audit Plan. These
controls include a formal change process for additions and deletions to the plan,
weekly and monthly reporting on status, and quarterly reporting to the Audit
Committees. Audit has considered how this Action Plan will impact the goal of
completing the Audit Plan, and has taken steps to ensure its timely completion by
hiring additional staff, leveraging co-source, and continuing to execute on the
Plan.
The Audit Professional Practices Group provides a detailed listing of audits by
status to the General Auditor and Executive Audit Directors on a weekly basis.
This report captures the detailed status of each audit in process. Appropriate
follow-up is performed by the Audit Leadership Team to ensure audit activity
remains on track. If timing concerns are identified, discussions are held between
the General Auditor and the Executive Audit Directors to determine the
appropriate steps that will be taken to remove any delays and / or provide
necessary communication to the Audit Committees.
On a quarterly basis, Audit presents to the Ally Financial, Ally Bank, and ResCap
Audit Committees details on the audit plan progress and any changes to the plan.
Changes to the plan require Audit Committee approval.
Audit has a department goal of completing 90% of the audit plan by February 28
(the end of the audit plan year), with the remaining 10% completed no later than
March 31. Audit monitors and reports on this goal, and all other department goals
on a monthly basis, through the Audit Services Monthly Operations Report. An
excerpt of this report that provides evidence of the Audit Plan monitoring is
included as Attachment 4. In addition, the full report is provided to Audit
personnel, the Federal Reserve Bank Examiners and executive management to
facilitate oversight and monitoring over Audit’s annual goals. Finally, Audit
formally presents an update on department goals, including the audit plan
10
Confidential
completion goal, to the Ally Financial, Ally Bank and ResCap Audit Committees
quarterly.
1.4 Audit Governance
1.4.1 Audit Charter
Audit has an established Audit Charter (see Attachment 5a) that details Audit’s
mission, scope, accountability and responsibilities, independence as well as
objectivity, authority, and standard of audit practice. The Audit Charter was
substantially modified in 2010 following a detailed benchmarking against
industry peers, and reviews by Legal, outside counsel, and the external auditors.
In addition, the Ally Financial, Ally Bank, and ResCap Audit Committees have
established Charters (see Attachments 5b, 5c, and 5d) that detail the Committees’
mission, membership, duties and responsibilities.
1.4.2 Independence of General Auditor, Audit Staff, and Audit Committee
The Audit Charter and Audit Committee Charters mandate that Audit personnel
report to the General Auditor, who in turn reports functionally to the Audit
Committee of the Board of Directors of Ally and administratively to Ally’s Chief
Executive Officer. This reporting structure and organizational position helps
ensure Audit maintains appropriate independence and stature within the
organization. To further promote the General Auditor’s independence from
management, the Ally Financial Audit Committee is responsible for reviewing the
appointment, performance, compensation, replacement, reassignment, or
dismissal of the General Auditor. In addition, the Executive Audit Director
responsible for mortgage audit activities reports to the ResCap Audit Committee
and the Ally General Auditor. Finally, the Ally Bank Audit Director reports to
Ally Bank Audit Committee and administratively to the Ally Bank Chief
Executive Officer.
Each Audit Committee (Ally Financial, Ally Bank, and ResCap) is comprised of
external Board members who must meet the applicable independence and
experience requirements to serve on each Committee. The independence and
experience requirements are defined within the Membership sections of each
Audit Committee Charter. In addition, management is implementing a process to
review Membership requirements on an annual basis to ensure members of each
Audit Committee maintain independence and experience requirements.
1.4.3 Timely resolution and follow up of audit findings
Audit has a robust process for follow up reviews on audit findings and assessment
of corrective measures to ensure audit findings are promptly and appropriately
remediated by management. The follow up process includes audit team follow-up
with management on all open issues every 30 days, testing procedures to validate
the design and operational effectiveness of management action plans (for those
assigned high or moderate priority ratings), and documented evidence to support
conclusions on validation work. In addition, tests of design are performed on low
priority management action plans to ensure corrective actions were taken. In the
event validation testing does not support management’s closure of the corrective
actions, Audit will “re-open” the audit finding. All re-opened audit findings are
11
Confidential
reported to the Audit Committees quarterly. This reporting brings greater
attention to the issues and subsequent updates are made to the Audit Committees
to ensure management takes action to address the issues. In addition, Audit has
established metrics, which are monitored and reported to each Audit Committee
quarterly, to ensure timely performance of issue validations for high and moderate
priority issues. The current process was implemented and has been operational
since March 2010.
The timely resolution of audit findings is also an area of focus across the
enterprise, including Ally Financial’s CEO initiative on issue escalation (See
Attachment 6). Open issue discussions take place during Operations Risk and
Compliance Committee meetings held within each line of business, and during
business reviews with executive leadership. In addition, Risk Convergence
Reporting captures all risk issues across the enterprise, including open, past due
and re-opened audit issues, and that facilitates timely resolution of audit findings
and further demonstrates executive management's commitment to correct open
issues in a timely manner.
1.4.4 Documentation, tracking and reporting
Audit provides quarterly reporting to the Ally Financial, Ally Bank, and ResCap
Audit Committees on the status and resolution of audit findings and audit report
results, including audit issues and management action plans. Audit also presents
the status of open and past due audit issues to the respective Audit Committees.
The combination of Audit’s reporting and the Risk Convergence reporting noted
above in 1.4.3 elevates focus and attention on past due or re-opened issues to
ensure management addresses them timely.
1.4.5 Issue Escalation Process
The Audit Charter specifically states that Audit has a responsibility to “Report
significant disagreements with management and/or any limitations on Audit’s
Independence, Objectivity or Authority to the Audit Committee”. Audit works
with management to resolve differences of opinion. These activities include
discussion and escalation of the differences through all levels of management and
up to the General Auditor. If differences of opinion concerning audit exceptions
and recommendations cannot be resolved, Audit does allow management to
document their difference of opinion in an audit report. Audit will also document
the difference of opinion and will review this dispute with the appropriate Audit
Committee during special or regularly scheduled meetings if warranted. All such
disputes will ultimately be resolved by the Audit Committees.
2. Specific Planned Audit Program Enhancements to Strengthen Residential
Mortgage Loan Servicing, Loss Mitigation and Foreclosure Activity Reviews
2.1 Center of Excellence (“CoE”) Construct
As noted previously, one measure Audit will take to enhance audit coverage of
residential mortgage loan servicing, loss mitigation, and foreclosure activities,
including servicing related ECP, ERM, and MIS activities, is to develop a Servicing
CoE. Servicing CoE members will be identified by July 13, 2011 and will be
comprised of existing audit staff and include CoE Champions and SMEs who will be
12
Confidential
the core team accountable for executing the CoE responsibilities noted below. CoE
Members will include audit personnel with prior automotive and mortgage servicing,
compliance, operational risk management, or information technology audit
experience. Audit will establish a specific Servicing CoE charter that will formally
outline the authority, purpose, and responsibilities of both CoE members and audit
teams across Audit. This Charter will be drafted by August 3, 2011, and will be
reviewed by Audit Leadership by August 10, 2011 with any changes incorporated by
August 17, 2011. The CoE Charter will be approved by the General Auditor,
finalized and communicated to the Audit team by September 7, 2011. CoE
responsibilities will include, but not be limited to, staying abreast of both mortgage
and automotive loan servicing emerging issues, ongoing assessment of emerging
legal risks and regulatory changes, and active engagement in servicing continuous
monitoring activities.3 Additional CoE responsibilities will include, contributing to
advisory projects that assist the servicing business corrective action plans,
development of departmental training on auditing servicing areas, and input into
servicing audit scoping, findings, and reporting.
The CoE is intended to provide a consistent audit approach over both audits of
residential mortgage and automotive loan servicing through sharing of knowledge,
leveraging staff members with servicing expertise, and active engagement on
servicing audits. In addition, the CoE creates a forum to capture cross-firm risks that
could exist within the company. Once established, the CoE should provide a solid
foundation for audit planning and scoping of residential mortgage loan servicing, loss
mitigation, and foreclosure activities, and assist the department in further developing
staff skill sets required to audit these areas.
The charter will define the role of the CoE in the involvement and oversight over loan
servicing audits, and will include requirements to monitor for changes in compliance
and Legal Requirements, and supervisory guidance of the Board of Governors. In
addition, the CoE will ensure an enhanced review of ECP, ERM, MIS, Mortgage
Electronic Registration Systems (MERS), internal controls and compliance with
GMACM internal policies and procedures for residential mortgage loan servicing, loss
mitigation, and foreclosure activities through active input into the scopes of audits of
these areas going forward. Finally, the CoE will leverage existing areas of expertise
within Audit (Compliance, Third Party Management, and Training), where needed, to
enhance the audit programs for residential mortgage loan servicing, loss mitigation
and foreclosure activities. Audit will complete the Servicing CoE construct by
September 7, 2011 (Appendix 1, Deliverable 1).
2.2 Staffing
An initial staffing skill set review was completed on May 17, 2011 and a staffing
needs assessment was completed on May 19, 2011. The assessment was reviewed
with the General Auditor on May 20, 2011 with all edits made the same day. Finally,
the assessment was reviewed with Human Resources on May 23, 2011 with the
positions being posted on May 24, 2011 (See Attachment 7). Based on this Audit
plans to add an additional seven auditors (One Staff Auditor and Six Senior Auditors)
3
Continuous monitoring activities will include participation in management meetings, review of
management reporting including volume growth of key activities and related staffing requirements, and
comparison to peers.
13
Confidential
by October 24, 2011 to the approved departmental headcount (four to the mortgage
team, two to the compliance team, and one to the professional practices team) to
achieve the known incremental actions undertaken by Audit as part of this action
plan. These positions will be posted by May 23, 2011 with all positions filled by
October 24, 2011. The headcount additions are intended to provide greater audit
coverage of residential mortgage loan servicing, loss mitigation, and foreclosure
activities, and will be used to implement the audit enhancements identified in this
plan. Once the CoE charter and Standardized Audit Programs are implemented,
Audit will perform a reassessment of staffing levels to determine if additional
headcount is required and review the assessment with the General Auditor by
November 18, 2011. If Audit determines additional headcount is required, staffing
needs will be reviewed with the General Auditor and Human Resources by December
2, 2011.
In addition to internal SMEs, Audit plans to engage external SMEs for high-risk
residential mortgage loan servicing audits, including loss mitigation and foreclosure
activities by November 15, 2011. These SMEs will provide consultation on industry
perspective and input into the planning and scoping of such audits. Audit estimates
the use of significantly higher external SME hours annually to assist with audits of
residential mortgage loan servicing. These external SMEs will be required to have
specific expertise related to the areas being audited, and their experience may be
beyond internal audit or accounting related fields (i.e. Legal, Compliance, Risk
Management, etc.). Audit will leverage existing co-source arrangements to procure
the necessary external SME skill sets needed.
Finally, Servicing CoE members and audit teams conducting servicing audits will
participate, as appropriate, in additional training offered either by Mortgage Training
or by an outside firm to help maintain those individuals’ awareness of Legal
Requirements, supervisory guidance, and policies and procedures.
Audit will complete the staffing actions by December 2, 2011 (Appendix I,
Deliverable 2), and the training by July 1, 2012.
2.3 Audit Program Enhancements
The Servicing CoE will develop Standardized Audit Programs for high-risk areas of
residential mortgage loan servicing, including loss mitigation and foreclosure
activities by November 2, 2011. The contents and coverage of these programs are
dependent upon the outcome of additional actions being taken by the business and
support functions as a result of the Consent Order. These Programs will be drafted by
October 5, 2011 and benchmarked with external SMEs and Legal, Risk, Compliance
and Servicing Management by October 25, 2011, to ensure the planned coverage and
testing strategies are effective, comprehensive, and capture testing of specific Legal
Requirements (both State and Federal) and supervisory guidance of the Board of
Governors. Audit will incorporate changes from external SMEs and Legal, Risk,
Compliance and Servicing Management by October 31, 2011 and then review the
Standardized Audit Programs with Audit Leadership. During the development of
these audit programs, Audit will include test steps to review internal controls, MIS
(includes technology platforms, applications and other information system
components), Third Party Management (includes contract development), and
14
Confidential
compliance with mortgage’s internal policies, procedures, and processes as required
areas of focus and testing. Finally, Audit will review and incorporate test steps into
the Programs to cover findings identified in the Interagency Review of Foreclosure
Policies and Practices Report issued in April 2011.
In addition, the Servicing CoE will develop a Planning Audit Program that will
include procedural steps to ensure the review of ECP, Legal, and ERM Risk
Assessments as well as Control Self-Assessments and SOX Control Assessments.
Audit will use the results of these risk assessments to assist in defining the audit
scope by incorporating identified material risk exposures of residential mortgage loan
servicing, loss mitigation, and foreclosure activities into the audit coverage.
Once established, the programs will be reviewed, at least annually, and updated as
necessary to ensure relevance. Audit will complete the standardized audit programs
by November 2, 2011 (Appendix I, Deliverable 3).
2.4 Incremental Audit Coverage
As a result of impending changes, resulting from management action plans related to
the overall Consent Order, Audit plans to evaluate and enhance mortgage related
audit scopes. The timing of the reviews will be determined as part of the 2012 Audit
Risk Assessment and Audit Plan development process that will be completed and
presented to the Ally Financial, Ally Bank, and ResCap Audit Committees by April 1,
2012. Specifically, Audit plans to include coverage in the following areas:
x
x
x
Risk Assessment – Audit will utilize the independent risk assessment of
servicing being conducted to comply with Sections 12 and 13 of the Consent
Order to determine if any changes to the 2011 Audit Plan are warranted. In
addition, Audit will use the independent risk assessment as an input into the
2012 Audit annual Risk Assessment, and to assist in the development of the
audit scope for reviews of residential mortgage loan servicing, loss mitigation,
and foreclosure activities and operations. The 2012 Audit annual Risk
Assessment will commence in December 2011 and results will be reviewed
with the Audit Committees in March 2012. By November 7, 2011, Audit will
begin using the independent risk assessment during the planning of residential
mortgage loan servicing audits.
Foreclosure Review – Audit will review the results of the independent review
of residential mortgage foreclosure actions required under Sections 3 and 4 of
the Consent Order, and validate that the appropriate corrective actions were
taken by management. Audit will incorporate process changes and
improvements resulting from this review into control testing for servicing
audits, as applicable. Since October of 2010, Audit has completed two
Advisory projects, the first completed on December 16, 2010 and the second
completed on October 27, 2011, to assist the business with remediation
efforts. Audit also expects additional audit coverage in the 2012 Audit Plan
that will be developed by April 1, 2012.
Single Point of Contact (“SPOC”) – Going forward, Audit will incorporate
SPOC control testing into loss mitigation and foreclosure audits or advisory
projects to comply with section 5 of the Consent Order. As part of this
review, Audit will ensure that servicing management has developed effective
15
Confidential
x
x
x
x
x
controls to maintain adequate staffing in order to meet the SPOC goals and
objectives. Audit is currently performing a design review of the SPOC
process as part of the 2011 Loss Mitigation – Loan Modification audit with
the work scheduled to be completed by March 1, 2012.
Third Party Management (“TPM”) –Audit will evaluate the procedures that
encompass enhanced controls to adequately monitor and track vendor
selection, contracting, and performance for residential mortgage servicing
audits, where warranted. Such TPM testing will be conducted to comply with
Section 6 of the Consent Order. Coverage of TPM is a required step within
the Standardized Audit Programs. As noted above, audit will include TPM
within the 2012 Audit Risk Assessment and ensure adequate coverage in the
2012 Audit Plan that will be developed by April 1, 2012.
ECP and ERM – Once fully developed and operational, Audit will ensure
reviews of ECP and ERM include a review and assessment of the
effectiveness of these programs over residential mortgage loan servicing, loss
mitigation, and foreclosure activities. Audit completed an audit of the Global
Compliance and Regulatory Affairs on February 24, 2011 and Operational
Risk Management on February 22, 2011. Audit will include ECP and ERM
within the 2012 Audit Risk Assessment and ensure adequate coverage of the
effectiveness of ECP and ERM over residential mortgage loan servicing in the
2012 Audit Plan that will be developed by April 1, 2012.
MERS – Audit will add a dedicated MERS audit to the audit universe that
will include control testing to ensure compliance with MERS membership
rules, terms, and conditions, including mortgage assignments and
endorsements, certifying officers, resolutions, reporting, and quality
assurance. Such MERS testing will be conducted to comply with Section 9 of
the Consent Order. The timing of this audit will be dependent on the
completion of the MERS Consent Order Action Plan, but it will be included
within the 2012 Audit Risk Assessment and Audit Plan that will be developed
by April 1, 2012.
Consent Order Action Plan Review – Audit will perform a detailed review
of finalized action plan deliverables for Mortgage Servicing Compliance
(Section 8 of the Consent Order), MIS, Training, and SPOC to ensure the
plans are reasonable, measurable, and clearly written. Audit completed this
review on July 13, 2011.
Consent Order Finalized Action Plan Deliverables - Audit will perform
issue validation on completed management actions to be determined by the
Ally Financial, Ally Bank, and ResCap Audit Committees.
16
Confidential
Appendix I
Below is a listing of the deliverables that support the Audit Consent Action Plan.
1.
2.
3.
4.
5.
Servicing CoE – September 7, 2011
Staffing Analysis and Reassessment – December 2, 2011
Standardized Audit Programs – November 2, 2011
Audit Annual Risk Assessment and 2012 Audit Plan– April 1, 2012
Training – July 1, 2012
Appendix II
Audit will review the deliverables noted above and below with the Ally Financial, Ally
Bank, and ResCap Audit Committees.
Appendix III
Deliverable
CO
Section
Task
Servicing CoE
16 (b) &
17 (d)
Servicing CoE
16 (b) &
17 (d)
Establish a cross
functional CoE team
from Audit
Draft CoE Charter
Servicing CoE
Servicing CoE
Servicing CoE
16 (b) &
17 (d)
16 (b) &
17 (d)
Review Draft CoE
Charter with Audit
Leadership
Incorporate changes
into the CoE Charter
16 (b) &
17 (d)
16 (b) &
17 (d)
Communicate CoE to
Audit
Staffing
Analysis
16 (c) &
17 (g)
Assess current staffing
skill sets
Staffing
Analysis
16 (c) &
17 (g)
Assess current audit
staffing needs to
execute consent order
action plans,
Foreclosure Advisory
work and existing
Servicing Audits
Servicing CoE
Start
Date
End Date
7/13/11
7/13/11
,
7/13/11
8/3/11
,
8/3/11
8/10/11
8/10/11
8/17/11
,
8/17/11
9/7/11
,
9/7/11
9/7/11
9/7/11
9/7/11
5/1/11
5/17/11
5/17/11
5/19/11
Executive
Director
Obtain CoE Charter
Approval from General
Auditor
Finalize and Publish
CoE Charter
Servicing CoE
16 (b) &
17 (d)
Owner
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
17
Confidential
Deliverable
CO
Section
Task
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Review initial
assessment with
General Auditor
Incorporate changes to
the staff analysis
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Staffing
Analysis
16 (c) &
17 (g)
Based on results of
analysis, review results
with General Auditor
and Human Resources
Post new audit
positions, if necessary
Staffing
Analysis
16 (c) &
17 (g)
Onboard new positions,
if necessary
Standardized
Audit Programs
17 (d)
Standardized
Audit Programs
17 (d)
Standardized
Audit Programs
17 (d)
Standardized
Audit Programs
17 (d)
Draft Audit Programs
for Planning,
Foreclosure, Loss
Mitigation, Bankruptcy
and MIS
Review programs with
Legal, Servicing Risk,
Compliance and
Servicing Management
Incorporate changes
from input and consent
action plans into Draft
Audit Programs
Benchmark program
with SMEs
Standardized
Audit Programs
17 (d)
Based on results of
analysis, review results
with Human Resources
Post position and hire
additional staff.
Reassess staffing needs
resulting from Consent
order deliverables 1 and
3
Review initial
assessment with
General Auditor
Incorporate changes to
the staff analysis
Incorporate changes
from SMEs into Draft
Owner
,
Start
Date
End Date
5/19/11
5/20/11
5/20/11
5/20/11
5/20/11
5/23/11
5/24/11
10/24/11
10/27/11
11/18/11
10/27/11
11/18/11
11/18/11
12/2/11
12/2/11
12/2/11
12/2/11
12/2/11
12/2/11
12/2/11
9/15/11
10/5/11
10/5/11
10/25/11
10/5/11
10/25/11
10/5/11
10/25/11
10/5/11
10/31/11
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
Director
Executive
18
Confidential
Deliverable
CO
Section
Standardized
Audit Programs
17 (d)
Standardized
Audit Programs
17 (d)
Audit Annual
Risk
Assessment and
2012 Audit Plan
Training
16 (a)
16 (c) &
17 (g)
Task
Owner
Audit Programs
Director
Review Standardized
Audit Program with
Audit Leadership
Incorporate changes
and Finalize
Standardized Audit
Programs
Complete the 2012
Audit Risk Assessment
and finalize 2012 Audit
Plan
Create and deliver
training on residential
mortgage loan
servicing
Start
Date
End Date
10/31/11
11/2/11
10/31/11
11/2/11
12/7/11
4/1/12
11/2/11
7/1/12
Executive
Director
Executive
Director
Executive
Director
Executive
Director
19
Confidential