CMS Case Study

Citizens Bank and Trust Risk Assessment Summary 2020-2021

Audit Area

Mortgage Banking

Risk Factor

Score

Definition (score range)

High (21-30)

Moderate (11-20)

Low (0-10)

Rationale

Potential violations of high profile regulations with potential fines, legal liability or costly corrective action are possible.

Significant regulatory requirements are evident; however, regulatory expectations are clear, seasoned, and considered routine. Violations if any will be technical in nature.

Regulatory requirements are limited to low-profile regulations and law issues that warrant action but have significantly lower levels of risk.

Mortgage Banking is subject to a substantial level of regulations and applicable federal and state laws. In addition, there have been a number of mortgage banking regulatory changes. Failure to comply with regulations can result in lawsuits, financial loss, and damage to the Bank's reputation. However, there are mitigates to this risk which include a very experienced Compliance Officer (Karen Mitchell) who is actively involved with regulatory compliance in this area. The Bank employs a Mortgage Banking Manager with knowledge of compliance requirements. The most recent FDIC Compliance Exam (November 2018) noted strong compliance management system. However, the most recent loan compliance audit (2019) resulted in several recommendations. Mortgage Banking exposes the Bank to an increased level of repurchase risk. Mortgage Banking also poses the risk that the investor could reject a loan or require the Bank to repurchase the loan or to indemnify the investor if the loan does not conform to the investor's requirements (i.e. defects in documentation or underwriting, or if the loan becomes delinquent within a specified time after purchase). Additionally, Mortgage Banking subjects the Bank to additional accounting requirements. The Bank's policy is to have all mortgage loans approved by the investor underwriter prior to closing.

Compliance

21

Material financial misstatement is possible due to incorrect handling of infrequent, complex transactions or estimates. Critical management decisions may be based on these financial areas. Complex manual or automated systems are new, critical to management

Material financial effect is possible; however, activity is routine and noncomplex and errors would be readily evident in normal operations.

Impact on accurate timely financial reporting is minimal. Likelihood of material financial reporting effect is negligible.

Nature of Transactions

16

Seasoned and complex manual or automated systems are important to management decision making or product delivery; however, collaborating or alternative back-up systems exist. There is no basis for control assessment, or they are thought to be weak.

Noncomplex systems and operations are seasoned, with well established back up routines.

The Bank uses a software (Calyx) which automates the Mortgage Banking workflow from pre-qualification and origination through processing, underwriting, closing, secondary tracking, and delivery. Investors underwrite and prepare closing documents on the Bank's behalf.

Nature of Operations

16

decision making, or important to product delivery.

Controls are strong or adequate.

Internal controls are in place and enhanced testing of Home Mortgage Disclosure Act (HMDA) data is performed. Additionally, a review of all denied mortgage applications is performed. As noted above, the Compliance Officer is actively involved with regulatory compliance in this area. The Bank employs a Mortgage Banking Manager with knowledge of compliance requirements. The most recent FDIC Compliance Exam (November 2018) noted strong compliance management system. However, the most recent loan compliance audit (2019) resulted in several recommendations.

Controls are nonexistent or known to be weak.

Internal Controls

14

Minor changes since last audit are anticipated this year.

No changes since last audit are planned this year.

No significant changes are anticipated within the Mortgage Banking area within the next 12 months.

Major changes since last audit are anticipated this year or not recently reviewed.

Changes to systems, processes, or procedures

12

Management lacks experience or places low priority on internal controls.

Management has average experience.

Management is experienced and has high priority on controls.

While Management is new to the Bank, they achieved their position based on the level of knowledge and previous experience with Mortgage Banking. As with other areas of the Bank, a strong emphasis is placed on maintaining a sound control environment.

Management

10

89

Risk Score

- 21 -