GNMA and Agency Seller Servicer Compliance Audits

GNMA and agency seller/servicer compliance audits are mandatory conditions of agency participation. For independent mortgage bankers, mortgage banking audit and compliance services must cover financial statements, internal controls, and compliance with program rules. To keep their approval, they must understand each of these duties, especially as specialized HUD reporting and new AI governance requirements call for assurance beyond the annual financial audit.

Why GNMA and agency seller/servicer compliance audits exist as a structured accountability mechanism

Nonbank mortgage companies originate and service the majority of loans in federally backed securities, yet they generally lack a federal regulator comprehensively overseeing their safety and soundness. That gap makes the annual audit and compliance reporting cycle the primary accountability mechanism available to Ginnie Mae and FHFA. The Financial Stability Oversight Council warned in 2024 that, under a stress scenario, nonbanks could put the stability of the broader financial system at risk. The failure of a large nonbank, or multiple smaller ones, could disrupt mortgage markets and increase federal fiscal exposure.

Because comprehensive federal prudential oversight does not extend to these companies, the agencies have built financial monitoring into their approval and eligibility requirements. Participation therefore carries an obligation to provide independent evidence of financial condition and compliance. Mortgage banking specialists, including Pease Bell, help provide assurance that issuers meet those requirements in their work, which helps agencies monitor them. Their role matters because the agencies need more than accurate totals. They also need evidence that an issuer’s controls and conduct meet the conditions under which it participates.

Who must comply and how issuer eligibility is tied directly to audit obligations

An approved Ginnie Mae issuer must submit audited financial statements and compliance reports even when it has no securities or commitment authority outstanding. The obligation follows approval status, rather than a particular transaction or level of activity. HUD audit guidance Chapter 6 requires annual financial statements prepared by an independent auditor to reach Ginnie Mae’s Review Agent within 90 days of fiscal year end. Issuers must also submit separate reports on internal controls and compliance with specific requirements.

Eligibility also depends on a chain of approvals that reaches beyond Ginnie Mae. A Ginnie Mae MBS issuer must remain an FHA-approved mortgagee in good standing, so a HUD or FHA compliance failure can affect its Ginnie Mae eligibility. On the origination side, most FHA applicants must submit audited financial statements. Small supervised mortgagees below the applicable federal banking regulator’s asset threshold may instead submit unaudited regulatory reports. However, HUD retains the right to demand audited financials when it considers the lender a heightened risk, making the exemption conditional.

Fannie Mae’s Selling Guide, Section A4-1-02, also requires sellers/servicers to provide financial statements and reports to keep their seller/servicer eligibility. The shared principle is that approval must be supported by recurring evidence, although the programs retain their own requirements. Pease Bell brings mortgage banking audit and compliance experience to this overlapping chain of obligations. Such experience helps issuers coordinate submissions across interconnected programs rather than treating each deadline as an isolated accounting task. For prospective issuers, the central implication is that the cost and work of maintaining eligibility begin with the approval model itself.

What should a CPA firm verify in a seller/servicer audit

The examination has three distinct purposes, namely assessing financial statement accuracy, internal control adequacy, and compliance with specific requirements. Financial statements must follow GAAP and include the balance sheet, statement of operations, cash flow statement, notes, and required supplemental schedules. The auditor’s opinion states whether those statements are fairly presented. That conclusion is important, but it does not by itself answer whether controls operate effectively or whether the issuer complies with program rules.

For internal controls, auditors check how the controls over financial reporting are designed and how well they work. Material weaknesses and significant deficiencies have direct eligibility consequences, making this more than a description of accounting procedures. The compliance report tests selected provisions of applicable laws, regulations, contracts, and grant agreements. Together, the reports distinguish the reliability of the financial picture from the processes and obligations behind it. This is why mortgage banking expertise must extend beyond GAAP to the operational requirements of agency participation.

HUD OIG’s December 2025 audit report on Ginnie Mae’s own financial statements provides a concrete illustration of this reporting structure. Sikich CPA LLC carried out the financial statement audit and provided separate reports on internal control and compliance. The audit found no material weaknesses or significant deficiencies and no reportable noncompliance for fiscal year 2025. Ginnie Mae’s audit shows how financial reporting, controls, and compliance receive separate attention. A clean result in one area is not a substitute for examining the others.

Net worth and liquidity are also core verification targets. Ginnie Mae’s minimum net worth requirements add a servicing-balance component to a base amount, while its capital requirement ties tangible net worth to total assets. Auditors examine both the calculations and the adequacy of liquid assets. For a firm such as Pease Bell, the relevant capability is therefore the combination of financial accounting knowledge and mortgage banking compliance experience.

Where HUD Section 232 and skilled nursing facility compliance add a distinct layer of audit obligation

After closing, borrowers and operators on a HUD 232/LEAN or 223(a)(7) loan face a reporting cadence that extends beyond the standard annual cycle. They must send in annual financial statements prepared under GAAP within 90 calendar days of the end of the fiscal-year-end quarter. Property operators must also send in quarterly financial statements. HUD’s Section 232 program insures nursing homes, intermediate care facilities, board and care homes, and assisted living facilities. For these participants, the reporting burden compounds their seller/servicer audit obligations.

Skilled nursing and long-term care facilities face a further intersection between cost report preparation and HUD reporting. The two processes overlap, so knowledge of both can reduce duplicate work and the risk of inconsistent filings. Related financial information must remain consistent across reports prepared for different purposes, with each report completed on time. That need makes specialized knowledge of the full reporting chain materially different from general financial statement audit experience.

HUD OIG’s April 2026 review found that HUD’s Office of Residential Care Facilities had not always acted on financial risks already disclosed in borrowers’ audited statements. A statement can disclose a risk without that disclosure receiving an adequate regulatory response. As oversight grows, operators whose statements show signs of risk should expect those signs to get more attention. Documentation therefore matters beyond getting an audit opinion, because the information disclosed also helps with later monitoring.

How the GAO’s findings reveal the limits of the current audit-and-monitoring regime

GAO’s February 2026 report identified gaps in how Ginnie Mae and FHFA monitor nonbank financial condition, rather than in the existence of audit submission requirements. FHFA has no written procedures for checking how reliable the financial data that nonbanks report about themselves is. Both agencies’ watch-list processes also fall short when they assess key risks of certain short-term credit lines. Ginnie Mae’s stress scenario analysis looks at a single adverse scenario, which may leave it less prepared for a wider range of outcomes.

The distinction is between evidence about an issuer and the conclusions an agency draws from that evidence. A clean audit opinion cannot show that a watch-list process covers every relevant financing risk. Nor can it show whether an agency has looked at enough stress scenarios. GAO made four recommendations covering data-reliability procedures, short-term credit-line risk assessment, and consideration of additional stress scenarios. Both agencies agreed with those recommendations, signaling an evolving monitoring standard within the existing audit framework.

GAO also recommended that Ginnie Mae develop processes for participating in interagency coordination exercises and incorporating lessons into its issuer default strategy. Ginnie Mae neither agreed nor disagreed with that recommendation. As monitoring procedures become more demanding, the quality and documentation of submitted financial data become more consequential. New risks can require additional forms of scrutiny without reducing the value of existing audits.

What Fannie Mae and Freddie Mac’s new AI governance requirements add to the seller/servicer compliance picture

Fannie Mae and Freddie Mac have issued binding AI governance frameworks for seller/servicers that are already in effect. These frameworks add a compliance obligation to agency participation rather than leaving AI governance as a separate technology decision. Their requirements extend accountability beyond the financial statements to the systems used in origination and servicing. The careful reader’s question is therefore what evidence can demonstrate compliance when the subject is an AI or ML system.

Fannie Mae requires written policies that cover the full AI/ML system lifecycle and must be reviewed and updated at least once a year. Those policies must have a designated owner and be grounded in applicable legal and regulatory requirements. Information security obligations also apply. Crucially, vendor and subcontractor AI governance must meet the same standards as governance for internal systems.

Seller/servicers dealing with both GSEs must satisfy the more stringent elements of each framework. That creates a particular burden where third-party AI tools are used anywhere in the origination or servicing process. Vendor controls must support governance equivalent to that required for internally developed systems. Both GSEs have signaled that AI/ML will be a focal point of examinations and enforcement. As a result, the governance program documented in the submitted policy must withstand testing.

Why existing audit standards — including SOC 1 and SOC 2 — do not fully address what the GSE AI frameworks require, and what fills the gap

SOC 1 and SOC 2 examinations remain important for mortgage banking procurement and controls evidence, but their scope does not fully answer the new AI governance questions. SOC 2 uses the AICPA Trust Services Criteria, including security, availability, processing integrity, confidentiality, and privacy. It was not designed to address model card completeness, training-data provenance, fair-lending testing methodology, or results by protected class. Those are model-level questions that the GSEs may request evidence about. The gap concerns the scope of assurance.

The AICPA released Technical Q&A Section 9561 on September 11, 2026, addressing service organizations’ use of AI in SOC 1 and SOC 2 examinations. The guidance establishes that the existing frameworks apply, but does not expand them to cover AI-specific risks. Updates to the standards are anticipated, with the earliest implementation timeline likely 2027. Consequently, an existing SOC report does not automatically establish that an AI-enabled workflow meets all GSE governance obligations.

AIUC-1, the Artificial Intelligence Unified Controls standard, was launched in mid-2025 to deal with model-level AI risk. It organizes requirements and controls across six risk pillars and requires quarterly technical testing, including adversarial red-teaming and jailbreak attempts. Maintaining its twelve-month certificate also requires a full annual re-audit. This provides a structured, independently verifiable framework that maps onto the GSEs’ expectations in ways existing SOC reports do not. It does not, however, make other obligations interchangeable, including Freddie Mac’s requirement to audit against named standards such as NIST 800-53 and ISO 27001.

Pease Bell CPAs brings experience across mortgage banking audit and compliance, SOC 1 and SOC 2 examinations, and assurance for emerging standards including AIUC-1. For AI-enabled origination and servicing, governance assurance must also reach model-level risk. Maintaining agency approval now depends on understanding those boundaries and meeting the obligations on each side of them.