Independent Auditor Role in CFPB and State Mortgage Regulatory Examinations

Mortgage banking audit and compliance services for independent mortgage bankers need to support federal supervision, state licensing and examinations, and GSE seller/servicer requirements together. As CFPB examinations contract and state examinations expand, the independent auditor’s role shifts from responding to document requests to maintaining year-round compliance infrastructure. To be ready for an examination, a company needs current, independent testing and evidence it can use as well as an audit report finished before the deadline.

Why the federal-state compliance balance shifted for mortgage companies

The bureau has shifted more attention toward banks and pulled back from some nonbank examinations, while states have expanded their examination activity. That distinction is important for independent mortgage companies. Under 12 U.S.C. § 5514(a)(1)(A), the CFPB’s direct supervisory authority covers nondepository mortgage originators and servicers of all sizes. This market has no larger-participant threshold, so smaller companies stay within federal supervisory reach even when there are fewer examinations.

What changes when states take a larger role? For one company, the number of open state examinations can nearly double year-over-year as requests grow longer and cover more ground. States are also deploying specialized tools, including the CSBS non-bank cybersecurity examination procedures. A mortgage company may have no single examination schedule to help it plan its response to these requests.

New state frameworks make that expansion more durable. California enacted Assembly Bill 801, the California Fair Lending Examination Act, signed September 30, 2026, establishing periodic fair lending examinations for California-chartered banks, credit unions, and CRMLA licensees. New York DFS adopted regulations in January 2026 to put the state Community Reinvestment Act into effect for non-bank independent mortgage bankers licensed under the New York Licensed Mortgage Bankers Law. Meanwhile, the CFPB has moved away from statistical-disparity enforcement theories toward intentional discrimination and identifiable harm. Mortgage companies still have to comply with ECOA under that narrower approach while also facing more state review.

What the CFPB's own examination framework still requires from an independent audit function

The CFPB Supervision and Examination Manual treats independent audit as a structural component of compliance management. The manual specifies that the function should review compliance with federal consumer financial laws and remain independent of both the compliance program and business functions. It should also give the board a determination of whether its risk-management policies and procedures are being implemented. Independence is therefore more than an engagement label. It defines whose work the auditor evaluates and whether the auditor can assess that work without operational influence.

The manual’s compliance management review procedures treat independent audit as separate from the compliance officer’s work and from quality control. Can a capable compliance officer and a thorough quality control plan substitute for it? Under this framework, they cannot. Combining those functions leaves a gap in the compliance management system even if each does its own work well. The independent assessment asks whether the arrangements adopted by the board actually operate as intended, rather than relying on the judgment of the people responsible for running them.

The manual retains procedures for mortgage origination, mortgage servicing, reverse mortgage servicing, ECOA, HMDA, RESPA, TILA, UDAAP, and the SAFE Act. Its broader coverage also includes privacy and other consumer financial law topics relevant to the company’s activities. Choosing the scope still calls for care in deciding which obligations apply. With advance notice, defined scope, and narrower information requests in 2026, audit documentation already on hand carries more weight because an expedited examination draws on that record. That federal framework also supplies a baseline against which state examiners can assess the compliance program.

How state mortgage examination requirements layer obligations on top of the federal baseline

State licensing rules have audit requirements that states can enforce on their own, whether or not the CFPB examines a company that year. Most require annual financial statements audited by an independent CPA in accordance with GAAS. Florida statute § 494.0063 provides a concrete example. It requires audited financial statements to be prepared by an independent licensed CPA and requires mortgage lenders to obtain an annual financial audit report as of fiscal year-end.

BSA/AML independent review creates a separate obligation within this structure. Many states explicitly require an independent AML/BSA audit for mortgage licensees at licensing or examination and will not accept a self-audit as satisfying that requirement. A completed financial statement audit does not answer that request. The distinction is between assurance about financial reporting and an independent review directed at AML/BSA compliance. Treating both as a generic “annual audit” obscures the different work that state examiners expect to see.

Cybersecurity and fair lending broaden the scope further. States that use the CSBS framework ask about IT controls and data security in examinations, while California’s fair lending framework and New York’s CRA rules each call for documentation of their own. These examples illustrate part of the state regulatory structure. A multi-state lender faces financial audits tied to fiscal years, AML/BSA reviews on a separate cadence, and control reviews prompted by examinations. Meeting one state filing requirement leaves the company with other work to do to prepare for state reviews.

What GSE seller/servicer requirements add to the independent audit obligation

GSE approval adds a contractual source of audit obligations to the federal and state layers. Fannie Mae guidance emphasizes a comprehensive, written internal audit plan that evaluates and monitors the quality of loan origination and servicing. Independence remains central to that assessment. Compliance officers and quality control plans alone do not fully satisfy the requirement for an internal audit function free from operational influence. A company needs more than a CFPB compliance management review or state licensing audit to meet the GSE obligation.

SOC reporting adds a further question about evidence. Does the report cover the services, risks, and operating period on which the seller or servicer needs to rely? A SOC 1 report supports the requirement only when its scope fits, a credible service auditor issues it, identified risks are addressed, and complementary user entity controls, or CUECs, are in place and operating. When subservicers are involved, the engagement team must assess the relevant SSAE 18 SOC 1 reports for each one.

Dovenmuehle Mortgage, Inc. announced in February 2026 that it had completed its 2025 SOC 1 Type 2 and SOC 2 Type 2 audits. The SOC 1 examined the design and operating effectiveness of controls over financial reporting. The SOC 2 covered security, availability, processing integrity, confidentiality, and privacy. The example illustrates recurring assurance deliverables. The servicing chain calls for control evidence beyond what a state financial filing or a federal compliance review supplies on its own.

How the independent auditor functions across these three layers in practice

Federal, state, and GSE reviews run on different schedules and cover different subjects, so the audit function needs to keep working across engagements. The work starts with a framework for risk assessment. Audit programs and testing procedures then translate that assessment into reviews calibrated to CFPB and GSE requirements, with ongoing assessments and reporting to the audit committee. Findings give management a chance to fix problems before examiners report them.

In practice, that process reaches into loan files, servicing procedures, data privacy controls, and AML transaction monitoring. Loan-level testing finds errors, while documentation reviews check for consistency and whether policies reflect current regulations. IT general controls testing and security audits extend the assessment to the systems supporting those activities. These are distinct areas of work, each providing its own assurance. Their common purpose is to produce an independent record of how the company’s controls operate across the obligations that apply to it.

Subservicer review takes this work beyond the company’s own operations. Assessing SOC 1 reports provides the mechanism for demonstrating to GSEs and investor auditors that servicing-chain controls are in place and operating effectively. Full outsourcing or co-sourcing with an existing internal team can support the required independent function, particularly for BSA/AML and GSE purposes. Both internal and external staff need to assess work independently of the people who do it.

The HUD Section 232 and skilled nursing facility context, where audited financials are a primary risk signal to regulators

HUD Section 232 makes the consequences of financial reporting especially clear. The program provides federal mortgage insurance for residential care facilities, including nursing homes, intermediate care facilities, board and care homes, and assisted living facilities. HUD’s Office of Residential Care Facilities, or ORCF, administers it under 24 CFR Parts 200 and 232. Here, audited financials serve as an early risk signal. They help regulators identify borrower distress, rather than merely document that a reporting obligation has been completed.

The updated Section 232 Handbook became effective January 5, 2026, for all new loan applications and transactional requests. Section 232 borrower financial statements must comply with HUD’s Uniform Financial Reporting Standards under 24 CFR 5.801 and 24 CFR 200.36. Auditors serving these borrowers need familiarity with both the reporting standards and the updated handbook. Section 232 transactions rose materially from FY 2024 to FY 2025, and average deal size also increased.

HUD OIG Audit Report 2026-BO-0001, issued April 2, 2026, found that HUD did not always address risks reported in borrowers’ audited financial statements. The finding identifies a failure to act on reported risks. It does not, by itself, establish that the audits were deficient or that better auditing would have prevented defaults. Instead, it demonstrates how the audit report functions as documentary risk evidence that requires a regulatory response. Quality and timeliness affect the usefulness of that signal, but producing it and acting on it remain separate responsibilities.

Skilled nursing facilities also go through initial compliance surveys that states conduct under CMS oversight and reviews for Medicare and Medicaid certification. Their auditors must navigate this reporting context without treating those reviews as substitutes for HUD financial reporting. Many Section 232 operators are closely held LLCs or S-corporations, making the annual audit a primary means of surfacing ownership-level financial risk. That creates a connection to the firm’s tax and advisory relationship with management. Across mortgage segments, regulators read audit output first, so that evidence needs to be in place before scrutiny begins.

How do independent mortgage bankers find a CPA firm that provides examination-ready infrastructure?

For an independent mortgage banker or regional lender selecting a CPA firm, the relevant comparison is coverage of the obligations the company actually faces. A firm’s understanding of seller-servicer audit requirements for Fannie Mae and other mortgage agencies needs to extend beyond familiarity with their names. The engagement should address the written audit plan, origination and servicing quality, relevant SOC reports, and operating CUECs. General financial audit capability is only one part. A firm is a better fit when its audit work links those requirements to federal compliance review and state licensing obligations.

The practical template is a risk assessment, calibrated audit programs, ongoing testing, and reporting to the audit committee. Financial statement audits prepared under GAAS by an independent CPA form the foundation, with submission deadlines built into the calendar. Florida’s § 494.0063 requires licensed mortgage lenders to submit their reports within 120 days after fiscal year-end. BSA/AML independent review by a third party belongs on a separate cadence rather than being assumed to fall within that financial audit. IT and cybersecurity coverage structured against the CSBS procedures should likewise be part of the annual scope.

For servicers, current SOC 1 Type II reports under SSAE 18 need to cover a full operating period, with CUEC documentation maintained for GSE reviews and investor auditor reliance requests. For HUD participants, the engagement also needs to cover the financial reporting obligations of their program. For closely held mortgage companies, the same regulatory understanding also informs tax planning, entity structure, and financial management discussions.