How to Evaluate an Audit Firm's Seller-Servicer Competency Before You Sign an Engagement Letter

Evaluating mortgage banking audit and compliance services for independent mortgage bankers begins with evidence of seller-servicer competence. Before signing an engagement letter, independent mortgage bankers and regional lenders should test the proposed team's GSE knowledge, relevant credentials, regulatory experience, staffing depth, and quality controls. The letter should record the fit that diligence has already shown, with that diligence done before the letter is signed.

Why seller-servicers carry a different audit risk than ordinary mortgage companies

Seller-servicers must meet requirements that go beyond the financial reporting required of an ordinary mortgage company. GSE reporting requirements, HUD program compliance where applicable, and formal AI governance mandates create distinct demands on the auditor. General corporate audit experience does not establish competence here. The firm must understand the requirements that apply to this seller-servicer and translate them into appropriate audit work.

Fannie Mae requires seller/servicers to have internal audit and management control procedures that are independent of all key functions of loan manufacturing and servicing. That independence requirement makes familiarity with the GSE guides more than background knowledge. An auditor must understand what the required separation means in practice. AI governance adds another layer, with Freddie Mac's provisions effective March 3, 2026, and Fannie Mae's framework effective August 6, 2026.

A poor match risks a delayed report and an audit opinion supported by work that failed to surface risks regulators and counterparties are specifically watching for. The firm must judge whether it can do the work before taking it on, but the client faces the consequences if that judgment falls short. For the seller-servicer, the engagement letter is therefore not where vetting begins. It is where vetting ends.

What PCAOB standards actually require of a firm before it accepts an engagement

PCAOB's July 2025 Audit Focus describes engagement acceptance as a professional responsibility. In the publication, staff remind auditors of smaller public companies and broker-dealers of the standards already in place. It is not itself a new Board rule.

QC 20 requires a firm's quality control system to provide reasonable assurance that it undertakes only engagements it can reasonably expect to complete with professional competence. It also requires appropriate consideration of the risks of providing services in the particular circumstances. The Audit Focus lists factors to weigh, including whether the firm has enough knowledge and experience or can draw on subject-matter experts with industry expertise as needed. Access to expertise can support an engagement. A general assertion that specialists are available, however, does not explain whether the proposed team has the resources this work requires.

AS 1220, as amended, makes competence an explicit qualification for the engagement quality reviewer. SEC-approved amendments take effect in late 2026 and require the reviewer to possess the knowledge and competence needed to serve as engagement partner on the work under review. Review is not a substitute for specialization. Where mortgage banking expertise is needed to lead the engagement, the reviewer must have that level of competence too.

Ask what evidence supports the firm's decision that it can perform this engagement competently.

Reading the engagement letter as a competency test before signing it

When the draft arrives, read the scope first. Does it identify the GSE reporting framework by guide reference, rather than describe only a financial statement audit? Where HUD work applies, the scope should identify the compliance testing included and the relevant Consolidated Audit Guide provisions. It should also state which obligations under Freddie Mac Bulletin 2025-16 and Fannie Mae Lender Letter LL-2026-04 the engagement will cover.

AU-C 210.10 requires six elements in an audit engagement letter. These are the objective and scope, auditor responsibilities, management responsibilities, inherent limitations, applicable financial reporting framework, and expected form and content of reports. These requirements establish the baseline. A missing inherent-limitations statement or vague identification of the reporting framework is a defect regardless of the firm's claimed experience.

The letter should address maintenance of GSE-required internal audit procedures independent of loan manufacturing functions, rather than rely solely on generic internal-control language. Fees and timing provide another test of the firm's understanding. A compressed schedule without contingency for GSE data requests raises questions about whether the firm has accounted for mortgage banker financial reporting cycles.

The draft is the first documentary test of competence, but it cannot establish competence alone. Its value lies in making the firm's understanding visible and exposing omissions before signature. To judge whether its language reflects real capability, the seller-servicer must also examine the people behind it.

Credential and experience questions to ask before the letter is drafted

The selection meeting should begin with GSE and mortgage banking experience. Ask for documented work with GSE reporting cycles and mortgage banker financial reporting forms, then ask how many seller-servicer audits the firm completed in the prior two years and who led them. Speak with the proposed engagement partner rather than only a business development representative. The partner's ability to discuss guide requirements without consulting notes is a useful signal, while the record of prior leadership helps test continuity.

For engagements involving HUD 232, SNF exposure, or multifamily housing, the inquiry should address the specific programs and agreements involved. HUD audits require both financial statement and compliance audit work under GAAS and GAGAS. Confirm that the firm performs both components and is not assigning compliance work to an unfamiliar subcontractor. HUD's July 23, 2026 memorandum told owners to ask firms to confirm their knowledge of the current Consolidated Audit Guide, the compliance testing required, and the programs and agreements specific to each project. Ask about active familiarity with REAC and FASS electronic filing too, because routine program work should include familiarity with its filing requirements.

Where SOC examinations are relevant, verify that the provider is a licensed CPA firm enrolled in the AICPA peer-review program. The AICPA peer review public file is one place to check, and the firm should also send its latest peer review letter directly. Staff credentials spanning CPA, CISA, and CISSP bring accounting, IT audit, and security knowledge to the review. Promised outcomes deserve a different response. No legitimate auditor can promise a clean Type 2 report before the observation period begins.

Across these domains, ask which capabilities are in-house and which require a specialist. Credentials and relevant experience establish a minimum qualification threshold. The staffing answer then shows how the firm expects to meet it on this particular engagement.

How the AI governance mandates changed what mortgage banking audit competence now requires

Freddie Mac Bulletin 2025-16, issued December 3, 2025, changed Sections 1302.2 and 1302.8 of the Single-Family Seller/Servicer Guide. Its AI and ML provisions require a comprehensive framework for development, deployment, and oversight. For audit selection, they introduce a test that older mortgage banking experience alone cannot answer.

Fannie Mae Lender Letter LL-2026-04, issued April 8, 2026, established a formal governance framework for approved sellers or servicers using AI or ML in origination or servicing. It applies whether the tools are internally developed or vendor-provided. An auditor who checks compliance must therefore understand both the guide requirements and how AI systems work in production mortgage environments.

A vendor's SOC 2 Type II report is necessary but no longer sufficient for AI-enabled mortgage workflows. The distinction is between assurance over the vendor's controls and evaluation of the applicable AI governance requirements. AIUC-1 is an emerging assurance structure for testing how AI agents behave in production. It covers data protection, operational boundaries, attack resistance, and error prevention through independent technical testing, with quarterly adversarial testing. Its relevance should not be confused with established market adoption or with the GSE obligations themselves.

Ask how the proposed team evaluates compliance with the two GSE mandates and how it has mapped its procedures to their requirements. A discussion of AI in general does not answer that question. A firm without that mapping has not demonstrated readiness for the engagement, however fluent its presentation may be about emerging technology.

Quality-control practices that distinguish a specialist firm's infrastructure from a capable generalist's

Specialized knowledge must reach the staff performing the work and the reviewer assessing it. Ask who will serve as engagement quality reviewer on the specific assignment, then independently verify that person's relevant mortgage banking or HUD credentials.

If the engagement involves changing firms, ask how the prospective auditor will handle predecessor communications. PCAOB standards govern communications between predecessor and successor auditors, so failure to initiate the inquiry is a warning about acceptance discipline. Ask the firm to walk through recent ownership or management changes, prior restatements or material weaknesses, and whether personnel are free from obligation to or interest in the prospective engagement. Applied answers reveal more than a description of standard policy.

Independence also has a structural dimension beyond individual intentions. The AICPA has sharpened its ethics interpretations around fee concentration, making the proposed engagement's share of firm revenue a relevant question. Ask whether that share would be disproportionate. A firm may have capable people while facing an economic dependence that compromises independence.

Finally, request evidence of how the firm tests its own work. Its most recent internal inspection findings help move the conversation from stated procedures to examined performance. A summary focused on mortgage banking engagements is especially relevant to this selection. The most recent peer review letter is the clearest single filter, and hesitation to provide it is informative.

What the due-diligence process should look like in practice, from RFP through signature

Before issuing an RFP, establish the qualification screen. Confirm PCAOB registration status and AICPA peer review standing, then map the engagement's GSE obligations, HUD participation, SNF exposure, SOC needs, and AI governance requirements. Require respondents to address each applicable dimension by name. This prevents a broad claim of mortgage industry experience from standing in for a response to the actual assignment.

During the RFP and reference stage, request named seller-servicer clients served in the past two years. Ask those clients about timeliness and whether the firm surfaced issues they had not expected. Obtain the peer review letter and a summary of mortgage banking internal inspection findings at this stage so that the technical interview can explore the evidence.

The proposed engagement team should take part in the interview. Require the partner to explain the approach to the relevant GSE guides, HUD provisions where applicable, and AI governance mandates. Ask how the firm will staff the full cycle and maintain continuity if the partner rolls off, looking for identified backup depth rather than another account of the partner's qualifications. The interview connects institutional capability to the people assigned to deliver it.

Before signature, compare the draft letter with what the team demonstrated. Scope, management responsibilities, compliance testing, and AI governance coverage should reflect the engagement discussed. Confirm that later scope changes, interim review additions, or new compliance obligations will trigger a formal amendment. That expectation belongs in the terms from the start.

A firm willing to work seriously through these stages does more than answer questions. It demonstrates the reasoning behind its acceptance decision and gives the seller-servicer grounds to assess that decision.