If they had a report card, the Federal Housing Finance Agency (FHFA) would have been afraid to take it home to mom and dad. Laura S. Wertheimer, FHFA's Inspector General, reported to the House Committee on Financial Services on Thursday about the oversight FHFA provides to the government sponsored enterprises (GSEs) it regulates.  It barely got a passing grade.

FHFA has a dual role as both regulator and conservator of the GSEs, Fannie Mae and Freddie Mac, and is also regulator of the Federal Home Loan Banks (FHLBanks).  Wertheimer noted that the GSEs, even though they are highly leveraged, have a diminished capital buffer and are in conservatorship, have a combined market share of 60 percent of newly issued mortgage-backed securities, and collectively reported $5.4 trillion in assets at the end of last year.  The FHLBanks together reported assets of $1.1 trillion.

Wertheimer quoted FHFA Director Melvin Watt's observation that, were they not in conservatorship, Fannie Mae and Freddie Mac would be Systemically Important Financial Institutions (SIFIs) and subject to SIFI's heightened supervision requirements by the Federal Reserve. Because of their size and risk and because they are in conservatorship, the Office of Inspector General (OIG) determined that their magnitude of risk is significantly greater than that of the FHLBanks and has focused on FHFA's supervision of the GSEs.  

Wertheimer said that during her tenure (the length of which she did not specify) her office had issued 29 reports regarding FHFA's supervision of the GSEs. Those reports found the supervision program "to be burdened by both design and execution shortcomings." Twelve of those reports were during the June 2015 to December 2016 period the Financial Services Committee had requested she discuss.  Since the end of that period, an additional 17 reports were completed addressing other aspects of FHFA's supervision program.  The findings of those reports demonstrate the shortcomings identified initially have continued. The 29 reports (which were referenced individually in her testimony) identified four recurring themes.  

• Many FHFA supervisory standards and much of its guidance lack the rigor of those issued by other federal financial regulators. FHFA is a relatively new agency and while it could have used the supervisory standards and guidance the Office of Comptroller of the Currency and the Federal Reserve have used for decades, FHFA has in many cases created its own less rigorous standards and guidance or, in some areas, issued none.
• The flexible and less prescriptive nature of many FHFA standards and much of its guidance has resulted in inconsistent supervisory practices. Because of the lack of sparse guidance FHFA examiners were found to have significant discretion in a number of critical supervisory areas, leading to inconsistency and limiting the utility of some examiner work products.
• Where clear standards and guidance for specific elements of FHFA's supervisory program do exist, examiners have not consistently followed them.
• FHFA lacks adequate assurance that its supervisory resources are devoted to examining the highest risks of the GSEs.

Wertheimer said OIG recommended that FHFA adopt standards and guidance from OCC and the Fed, develop their own, or enhance existing ones.  It also suggests the agency establish benchmarks against which to measure examiners' work products. These 29 reports on FHFA's supervision of the Enterprises contained 56 recommendations to address named shortcomings. FHFA agreed in full to 68 percent or 38 of them.

Beginning in 2011 OIG questioned whether FHFA had a sufficient number of examiners to supervise the GSEs and conducted an audit in 2016 to determine whether the agency had completed and documented the examinations it had planned. It found that 50 of the 90 planned examinations of Freddie Mac were completed, 21 were cancelled or deferred, 7 were converted to monitoring and 12 were either started and not completed or lack documentation of disposition.

Results were worse for Fannie Mae with 43 of 102 targeted examinations completed, 28 cancelled or deferred, 14 converted to monitoring, and 17 in the incomplete or lacking documentation category. For both agencies both the number and percentage of completed targeted examinations decreased during the observed four-year period.

Wertheimer told the committee, "For a federal financial regulator, responsible for supervising two Enterprises that together own or guarantee more than $5 trillion in mortgage assets and operate in conservatorship, to fail to complete a substantial number of planned targeted examinations, including completing none of its 2015 planned targeted examinations for Fannie Mae within the 2015 supervisory cycle, is an unsound supervisory practice and strategy."

She said cybersecurity risk management at each of the GSEs is also a concern.  An OIG audit last year looked at whether planned cybersecurity supervisory activities at each GSE during the 2016 examination cycle were completed.  For Freddie Mac, there were two planned targeted examinations and three ongoing monitoring activities relating to cybersecurity risks. All three monitoring activities were completed, but one of the examinations was deferred and the other was not completed until after the cycle had ended.  

For Fannie Mae there was one targeted examination and three ongoing monitoring activities related to cybersecurity.  OIG found that none were completed.  FHFA did complete three ongoing monitoring activities of Fannie Mae's remediation of Matters Requiring Attention (MRA) issued in prior years. MRAs are the most serious examination findings, issued for non-compliance with laws or regulations, repeat deficiencies, unsafe or unsound practices, significant control weaknesses, and inappropriate risk-taking.

This failure to complete any planned supervision related to Fannie Mae's cybersecurity risks, a stated key objective of FHFA's supervision during 2016, provides additional cause for concern about the soundness of FHFA's supervisory practices and strategy, Wertheimer said.

Due to the concerns OIG expressed about examiner capability in 2011, two years later FHFA established a commissioned examination program.  OIG has identified several problems with that program, including that it was not on track to produce commissioned examiners within the four-year completion period.  As of March 2017, FHFA employed a total of 45 commissioned examiners, all of whom received FHFA commissions based on prior commissions from other financial regulators.  This was an increase of five commissioners since 2011.  As of March 2017, FHFA had not graduated any examiners from its own program.

Wertheimer said their fact-finding and analysis led OIG to caution stakeholders in December 2016 that the safe and sound operation of Fannie Mae and Freddie Mac cannot be assumed because of significant shortcomings in FHFA's supervision program.  While the Deputy Inspectors General of the Audits and Evaluations offices have recently observed some signs indicating improvements in the supervision program, it is too early to assess whether these improvements are sustainable.  At this juncture, she said, the office has not observed sufficient, sustained improvements to warrant removal of the caution.

Wertheimer said that her testimony should not be interpreted as a conclusion that the GSEs are not being operated in a safe and sound manner but added that it was not in OIG's charter "to reach safety and soundness decisions."

As to the FHLBanks, the Inspector General says that the magnitude of the supervision risk is not as great for those entities because of their much smaller assets sizes.  However, she also gives FHFA higher marks for its supervision of those institutions, finding that the annual examination of each FHLBank has been conducted as mandated. Where OIG reports identified shortcomings and made recommendations, FHFA has agreed with them.