Idea Transcript
Maryland Department of Housing & Community Development
Business Process & Risk Review Community Development Administration (CDA) Single Family Loan Programs
Version 1.0 October 2015
Process & Risk Review for CDA: Single Family Origination
Document History Revision History Version 1.0
From
Author R. Dean
Change Summary Initial draft
Distribution This document has been distributed to: Name
Title
Date of Issue
Version
Caroline Varney-Alvarado
Special Assistant
1.0
Sue McLean
Chief Innovation Officer
1.0
Robert Dean
Director and Chief Technology Officer
1.0
Approvals This document requires the following approvals. Name Bill Ariano
Signature
Title Deputy Director, Single
Date of Issue
Version 1.0
Family Housing and Energy Programs Amy Shiman
Director, Single Family
1.0
Housing Programs Rob Dean
Director and Chief
1.0
Technology Officer
2|Page
Process & Risk Review for CDA: Single Family Origination
Table of Contents 1 Introduction ............................................................................................ 4 Purpose .................................................................................................................................. 4 Objectives .............................................................................................................................. 4 Background ............................................................................................................................ 4
2 Organizational Context of Single Family Loan Programs........................ 5 Purpose .................................................................................................................................. 5 Subject Matter Experts (SME’s) .............................................................................................. 5 Reporting Requirements ......................................................................................................... 6
3 Overview of Single Family Loan Programs' Processes.......................... 6 Main Functions ....................................................................................................................... 6 •
Origination for borrowers ............................................................................................... 6
•
Reservation ................................................................................................................... 7
•
Underwriting .................................................................................................................. 7
•
Closing .......................................................................................................................... 7
4 Information Technology Resources of Single Family Loan Programs .... 8 List of Information Technology Resources .............................................................................. 8
5 Risk Assessment .................................................................................... 9 Database Risk and Review Survey .................................................................................... …..9 Risks. ....................................................................................................................................10
6 Costs .................................................................................................... 11 7 Recommendations for Mitigating Risks ................................................ 13 Recommendations for Risk Mitigation....................................................................................13 Recommendations for Process Improvement ........................................................................13 Recommendations for Opportunities .....................................................................................13
Appendix................................................................................................... 14 Appendix A Process Flow Diagram .......................................................................................14 Appendix B Database Risk and Review Surveys ...................................................................15
3|Page
Process & Risk Review for CDA: Single Family Origination
1 Introduction Purpose This document is a Process and Risk Review of the Community Development Administration’s Single Family Loan Programs, to include databases and systems currently in use. The Process and Risk Review outlines the business processes, utilization of database and systems, identifies gaps and risks, and offers recommendations for improvement in data collection, reporting, and analytical requirements for operations management, service delivery, and capacity planning. Objectives The objectives of the Process and Risk Review are as follows: •
Provide context of how the unit/program is currently operating
•
Document the business process and requirements in documented sources
•
Provide an understanding of any gaps with the current systems, procedures, processes, and operations.
Background To support DHCD’s transition to AGILE development, substantial work has been carried out to gather information, assess, and analyze the process and identify any risks with systems used in administering the Single Family Loan Programs . The information gathered was fully reviewed and documented in this Process and Risk Review, which includes the following analysis and deliverables that are in the scope of the process and risk review: •
Review of existing documentation and requirements conducted to date
•
Stakeholder consultation: survey and interview for information gathering and elicit business requirements
•
Overview of Single Family Loan Programs and uses of database/system
•
Process Flow Chart
•
Recommendations for Improvement
4|Page
Process & Risk Review for CDA: Single Family Origination
2 Organizational Context of Single Family Origination
Purpose The objectives of the Single Family Loan Origination Programs are to offer affordable homeownership programs to qualified first time home buyers, and to offer programs (purchase, refinance, or rehabilitation) that address special housing challenges.
CDA Single Family Housing provides homebuyer assistance programs by offering mortgage loans and down payment and closing cost assistance to eligible homebuyers with low-to moderate-income, programs to rehabilitate single family rental housing to improve basic livability, and programs to meet unique housing needs, including lead paint reduction, weatherization assistance and financing for persons with special needs. Subject Matter Experts (SME’s) The program currently has a staff of 44. SME’s within the program are as follows: •
Bill Ariano, CDA Deputy Director
•
Amy Shiman, CDA SF Director
•
Maddy Ciulu, CDA SF Deputy Director, Homeownership
•
Lorrie Love, CDA Report and Information Management (reservations, HO)
•
Shawn Kingston, CDA SF Deputy Director, Special Loan Programs
•
Patrice Locke, CDA Loan Processor (reservations, HO)
•
Julie Harding, CDA Underwriter (reservations, SLP)
•
Sheila Locke (reservations, SLP) 5|Page
Process & Risk Review for CDA: Single Family Origination Reporting Requirements Reporting requirements for Single Family Loan Programs include, but are not limited to Governor’s Office of Performance Improvement (GOPI), local governments and municipalities. A list of reporting requirements from stakeholders are listed below: Stakeholder
Reporting Requirements
Caine Mitter, US Bank
Financial reporting for TBA and MCC
CDA Single Family, CDA Finance, MHF Finance, DCA Single Family Asset Management
Management reporting
Ballard Spahr
Annual and quarterly reports
MERS
MERS reporting
3 Overview of Single Family Loan Programs’ Processes Main Functions CDA’s Single Family Origination team works internally with CDA Finance, DCA Asset Management and MHF Finance, as well as local lenders, sub-servicers and trustees externally. Principal tasks in the single family loan origination process are: •
Origination for borrowers
•
Reservation
•
Underwriting
•
Closing
Origination Loan applications are completed and submitted. For the Homeownership program, partner lenders enter data into their respective loan origination systems. For the Special Loan programs, CDA staff perform data entry. Ideally, level 1 and 2 partner agencies or their subcontractors would be able to perform data entry, too.
6|Page
Process & Risk Review for CDA: Single Family Origination Reservation The application is received. For the Homeownership program, a real estate appraisal is used for the loan. For the Special Loan programs, an estimate for construction is used for the loan amount. Underwriting For the Homeownership program, the underwriting is performed by lender partners and then validated by CDA staff. For the Special Loan programs, loan underwriting may be performed either by CDA staff or by staff at a level 2 partner agency. Closing Hardcopy documents are obtained from loan closings and retained by the department. Hardcopy documents are retained in the DocuShare document management system. Process Flow Chart 1 The process flow chart shown in Appendix A is a diagram that represents the work and data flows of DCA Single Family Origination. The process flow chart identifies both internal and external stakeholders involved in the process.
1
Appendix A
7|Page
Process & Risk Review for CDA: Single Family Origination
4 Information Technology Resources for Single Family Loan Programs List of Information Technology Resources The Homeownership Program utilizes multiple systems, including: •
Emphasys/AOD modules, including SF, LT, Lender Online, and QuickReports
•
Calyx Point/PointCentral
•
DocMagic
•
MERS
•
DocuShare
The Special Loans programs utilize: •
Emphasys/AOD modules, including SF and LT
•
DocuShare
There are multiple Word, PDF and Excel spreadsheet files contained on CDA share drives on DHCD’s secure network. For Special Loan programs, spreadsheets are used extensively to track budgets and expenditures, loan pipeline, funding roll-over from previous year, loan pull-thru rate (or fall out rate).
8|Page
Process & Risk Review for CDA: Single Family Origination
5 Risk Assessment The risk assessment consists of categorizing information resources (databases, systems, etc.) by impact and identifying and categorizing risks by likelihood. The criterion for each assessment is described in the risk assessment chart below:
HIGH Y=3
ELEVATED RISK (LOW, HIGH) Risk Factor=3
HIGH RISK (MEDIUM, HIGH) Risk Factor=6
VERY HIGH RISK (HIGH, HIGH) Risk Factor=9
MEDIUM Y=2
LOW RISK (LOW, MEDIUM) Risk Factor=2
ELEVATED RISK (MEDIUM, MEDIUM) Risk Factor=4
HIGH RISK ((HIGH, MEDIUM) Risk Factor=6
LOW Y=1
LOW RISK (LOW, LOW) Risk Factor=1
LOW RISK (MEDIUM, LOW) Risk Factor=2
ELEVATED RISK (HIGH, LOW) Risk Factor=3
LOW X=1
MEDIUM X=2
HIGH X=3
Likelihood
(X,Y) Risk Factor=X*Y
Impact
Database Risk and Reviews Survey A Database and Risk Review Survey 2 was completed on behalf of Single Family Loan Programs , in order to identify the benefits, issues, and risks of the current database/system. Two survey responses were completed.
2
Appendix B
9|Page
Process & Risk Review for CDA: Single Family Origination
Risks
Special Loan Programs flow-through rate (Impact = medium, Likelihood = medium) Flow-through rate information is dependent on manual processes. Accuracy of flow-through rate information impacts the Department’s decision-making ability. Audit compliance , general (Impact = low, Likelihood = medium) Ability to produce compliance material for the Special Loan Programs is dependent on manual processes. Audit compliance, HOME program (Impact = high, likelihood = medium) Ability to produce compliance material is dependent on manual processes, with steps that can be easily overlooked. Non-compliance could jeopardize Department’s HOME program funding. Data integrity (Impact = medium, Likelihood = medium) The Homeownership Program can be adversely impacted by inadequate validation during data entry, as well as poor audit trails for data entry and subsequent modifications. Personally Identifiable Information (Impact = medium, likelihood = medium) The processes and systems used involve a significant amount of Personally Identifiable Information, including social security numbers and borrowers’ financial information.
10 | P a g e
Process & Risk Review for CDA: Single Family Origination
6 Costs Business Process Cost Analysis: 6.1 Estimated Annual cost to support Special Loan Programs Housing Choice Voucher Annual Operating Cost (HCV staff size: 16 employees) Payroll Cost
Overhead Cost
Software Cost
Salaries Average
Benefits Average
Lease $42.00sf average100sf
DoIT Fees
Phones
$50,000/per
$8,000/per
$4,200/per
$660/per
$300/per
$46,200.00
$7,260.00 $3,300.00
$800,000.00 $128,000.00 $928,000.00
$82,560.00
• Xerox DocuShare • AOD
$191,521.00 3 +25,000.00 4 $216,521.00
Total Estimated HCV Annual Operating Cost: $1,227,081.00 Software Cost is 17.6 % of total operating cost
6.2
Graph of estimated annual cost to support CDA’s Special Loan Programs: Estimate Annual Cost for CDA's Special Loan Programs
$87,720.00
$225,445.00 $986,000.00
3 4
Payroll
Overhead Software
This is the Department’s total cost for AOD software This is the Department’s total cost for DocuShare software
11 | P a g e
Process & Risk Review for CDA: Single Family Origination
6.3 Estimated Annual cost to support CDA’s Homeownership Program Housing Choice Voucher Annual Operating Cost (HCV staff size: 17 employees) Payroll Cost
Overhead Cost
Software Cost
Salaries Average
Benefits Average
Lease $42.00sf average100sf
DoIT Fees
Phones
$50,000/per
$8,000/per
$4,200/per
$660/per
$300/per
$46,200.00
$7,260.00 $3,300.00
$850,000.00 $136,000.00
$986,000.00
$87,720.00
• Xerox DocuShare • AOD • Calyx Point • DocMagic $191,521.00 5 +25,000.00 6 +7,824.00 +1,100.00 $225,445.00
Total Estimated HCV Annual Operating Cost: $1,229,165.00 Software Cost is 18.3 % of total operating cost
6.4 Graph of estimated annual cost to support CDA’s Homeownership Program: Estimate Annual Cost for CDA's Homeownership
$87,720.00
$225,445.00 $986,000.00
5 6
Payroll
Overhead Software
This is the Department’s total cost for AOD software This is the Department’s total cost for DocuShare software
12 | P a g e
Process & Risk Review for CDA: Single Family Origination
Recommendations:
7.1 Recommendation for Risk Mitigation: Most risks currently result from the Department’s reliance on manual processing. Greater automation, such as the implementation of scheduled reports, can lessen these risks.
Effective data validation and audit trails will strengthen data integrity.
Greater usage of data encryption and stronger system authentication will better safeguard Personally Identifiable Information.
7.2 Recommendation for Process Improvement: Streamlining data intake and report production would simplify the processes.
7.3 Recommendation for Opportunities: For both Special Loan Programs and the Homeownership Program, the ability for current business systems to interface with the external loan origination systems would expedite data intake while decreasing data entry risks.
The use of a commercial “Geocoder” service for the Special Loan Programs would simplify the capture of census track and demographic information.
13 | P a g e
Process & Risk Review for CDA: Single Family Origination
Appendix A
Borrower begins
Origination
Asset Management
Finance
MHF Insurance MHF claim
Yes
MHF policy
MHF policy required?
Origination Reservation Underwriting Closing
RRB or TBA Ratelock
Lenders
State/Federal funds
Partners
Yes
No Workout?
REO
Foreclosure
Servicing (tracking)
Trustee(s) Sub-servicer(s)
General ledger Cash management Debt service
14 | P a g e
Process & Risk Review for CDA: Single Family Origination
Appendix B Q1: What is your name and title? Amy Grutzner, Director Single Family Housing Programs
Q2: In what Division and Unit do you work at DHCD ?(EX: CDA, Weatherization) CDA, Single Family
Q3: DHCD Databases to be Reviewed •
Maryland Affordable Housing Trust
•
Other (please specify)AOD
Q4: What is your role as it applies to the system under review? Director of Single Family
Q5: What is the primary usage for the database/system(s)? Tracking for SF loans under origination, reservation, closing and post closing. Also tracking of DPA.
Q6: Identify all stakeholders that utilize or benefit from this system, both internally and externally. Include contact information if available. 74 different lenders, 2,300 borrowers (annually) for MMP. Also numerous borrowers for MHAT.
Q7: Who would be the best qualified person(s) to fully demonstrate the system’s business process? (Subject Matter Expert) Maddy Ciulu and Shawn Kingston
Q8: How does the business process differ from the actual usage of the system? Respondent skipped this question
Q9: What type of platform does the system utilize ? (EX: Access, SQL, cloud, Excel, etc.) Respondent skipped this question
Q10: Was the database designed as a single or multi-user system? Respondent skipped this question
Q11: Do you have access to, or aware of the existence of any of the following documents related to the database/system under review? If so, also indicate whether the source is electronic or paper. •
User ManualsAccess to
Q12: If the system has alternative uses or capabilities other than the main purpose, please define the alternative functionality (EX: Document Management) Respondent skipped this question
Q13: If the system under review interfaces with any other internal or external systems, please identify the systems and the purpose for the interaction.. Respondent skipped this question
Q14: Explain what the system does effectively? How does it improve the business process? Respondent skipped this question
Q15: Does the system have any inadequacies or vulnerabilities? If so, list and explain. AOD shuts down and is slow on a periodic basis, which disrupts our department.
Q16: Does the business process entail seasonal or cyclical usage? When is the system used the most? (EX: End of month processing)If so, detail the usage and the frequency of heavier usage. end of month reporting
Q17: Is the system impacted by recurring changes (EX: legislative changes to programs) ? If so, explain how the business process and the database/system is effected. Respondent skipped this question
•
Q18: Choose the functionality/capability that the system under review currently has, is not needed, or does not have but would be beneficial. Other (please specify)Poor training by AOD. Just had seminar about 3 weeks ago
Q19: Identify whether any of the following are possible risks to the integrity of the system under review •
Over Reliance on Key StaffRisk
Q20: Does the system contain Personally Identifiable Information (PII), If so detail the exposure (EX: SSN) Respondent skipped this question
Q21: Indicate if the following practices might mitigate risks associated with the system under review. Respondent skipped this question
Q22: Is the system under review included in DHCD's Continuity of Operation Programs Plan (COOP)?If so, indicate if the plan is sufficient regarding data recovery times, data backup schedules, or any other concerns associated with the current COOP plan.
15 | P a g e
Process & Risk Review for CDA: Single Family Origination Respondent skipped this question
Q23: Does the system follow a Record Retention Schedule (RRS) Respondent skipped this question
Q24: If the system does follow a Record Retention Schedule, is it in compliance with the schedule? Respondent skipped this question
Q25: Identify any other opportunities or threats that may be associated with this system? Respondent skipped this question
16 | P a g e
Process & Risk Review for CDA: Single Family Origination Q1: What is your name and title? Maddy Ciulu- Deputy Director
Q2: In what Division and Unit do you work at DHCD ?(EX: CDA, Weatherization) CDA SF
Q3: DHCD Databases to be Reviewed •
Single Family Data Warehouse
Q4: What is your role as it applies to the system under review? Supervisor
Q5: What is the primary usage for the database/system(s)? MMP loan origination
Q6: Identify all stakeholders that utilize or benefit from this system, both internally and externally. Include contact information if available. DHCD, MMP lenders,
Q7: Who would be the best qualified person(s) to fully demonstrate the system’s business process? (Subject Matter Expert) Lorrie Kirshner
Q8: How does the business process differ from the actual usage of the system? Tailored to specific MMP needs
Q9: What type of platform does the system utilize ? (EX: Access, SQL, cloud, Excel, etc.) Excel
Q10: Was the database designed as a single or multi-user system? multi-user
Q11: Do you have access to, or aware of the existence of any of the following documents related to the database/system under review? If so, also indicate whether the source is electronic or paper. •
Standard Operating ProceduresElectronic, Aware of existence, Access to
•
Data DictionariesElectronic, Aware of existence, Access to
Q12: If the system has alternative uses or capabilities other than the main purpose, please define the alternative functionality (EX: Document Management) Respondent skipped this question
Q13: If the system under review interfaces with any other internal or external systems, please identify the systems and the purpose for the interaction.. Lender Online
Q14: Explain what the system does effectively? How does it improve the business process? Loan origination data management
Q15: Does the system have any inadequacies or vulnerabilities? If so, list and explain. memory space issues
Q16: Does the business process entail seasonal or cyclical usage? When is the system used the most? (EX: End of month processing)If so, detail the usage and the frequency of heavier usage. daily
Q17: Is the system impacted by recurring changes (EX: legislative changes to programs) ? If so, explain how the business process and the database/system is effected. Respondent skipped this question
Q18: Choose the functionality/capability that the system under review currently has, is not needed, or does not have but would be beneficial. •
Document ManagementCurrently Exist
• • • • •
WorkflowCurrently Exist Electronic/Digital SignaturesBeneficial CollaborationBeneficial DashboardsBeneficial Online TrainingBeneficial
Q19: Identify whether any of the following are possible risks to the integrity of the system under review •
Over Reliance on Key StaffRisk
• • • •
Lack of Standard Operating ProceduresNot a risk Data ValidationNot a risk Multiple ownership of dataRisk PII exposureNot a risk
17 | P a g e
Process & Risk Review for CDA: Single Family Origination • •
Public exposure of sensitive dataNot a risk Ability to make unauthorized changesNot a risk
Q20: Does the system contain Personally Identifiable Information (PII), If so detail the exposure (EX: SSN) yes
Q21: Indicate if the following practices might mitigate risks associated with the system under review. •
Cross TrainingMay Mitigate Risk
• • • • • • • •
Business process reviewMay Mitigate Risk Business process re-engineeringMay Mitigate Risk Standardization of DataMay Mitigate Risk Legal Disclosures where appropriateWould not Mitigate Risk Removal of Personally Identifiable Information(PII)Would not Mitigate Risk Modifications to Continuity of Operations Programs (COOP) planWould not Mitigate Risk Succession PlanningMay Mitigate Risk Change ManagementMay Mitigate Risk
Q22: Is the system under review included in DHCD's Continuity of Operation Programs Plan (COOP)?If so, indicate if the plan is sufficient regarding data recovery times, data backup schedules, or any other concerns associated with the current COOP plan. Respondent skipped this question
Q23: Does the system follow a Record Retention Schedule (RRS) •
Yes
Q24: If the system does follow a Record Retention Schedule, is it in compliance with the schedule? •
Yes
Q25: Identify any other opportunities or threats that may be associated with this system? Respondent skipped this question
18 | P a g e