Why Most CPA Firms Fail the GSE Seller-Servicer Audit Test Before the Engagement Even Starts

For the full engagement described here, a CPA firm must bring mortgage-specific attestation, servicing controls, HUD and healthcare accounting, and tax advisory capabilities together without compromising independence. Most generalist firms fail this test before fieldwork because the documents needed to qualify show work they are not equipped to do.

What the GSE seller-servicer audit actually is — and why most firms misread it

General-practice firms tend to offer a financial statement audit with added reports. The seller-servicer needs a layered contractual and regulatory compliance engagement whose requirements begin before anyone reviews a ledger. The FHFA, which regulates Fannie Mae and Freddie Mac, sets minimum seller/servicer eligibility standards, while the Enterprises set the approval requirements for entities that sell or service loans on their behalf. The audit relationship helps the seller-servicer take part in the market as well as get an annual opinion.

The full scope brings together at least seven technical disciplines, including financial statement audits, SOC 1 and SOC 2 examinations, HUD multifamily and Section 232 healthcare audits, skilled nursing accounting, mortgage banking attestation under USAP, closely held business tax advisory, and emerging AI assurance work. These disciplines do not substitute for one another. A firm with depth in two or three cannot serve the full scope merely by assigning more people to the engagement. The proposed firm must establish which obligations apply to the client and whether it can meet each one. The qualification process answers that question through financial competence, independence, quality-control documentation, and increasingly specialized attestation gates.

How Fannie Mae and Freddie Mac set the financial reporting floor that audited statements must clear

Fannie Mae’s Selling Guide requires seller/servicers to maintain Adjusted Net Worth of at least $2.5 million, plus an amount linked to the portion of Residential First Lien Mortgage Servicing UPB serviced for Fannie Mae and Freddie Mac. Audited financial statements provide evidence that the financial thresholds are met. The audit is an instrument of proof. A firm must understand how UPB-linked calculations are constructed and disclosed, rather than assume that familiarity with ordinary financial statement ratios will suffice.

The Freddie Mac Multifamily Seller/Servicer Guide requires applicants to have at least two years of audited financial history and meet minimum standards as of the application date. Its tangible net worth floor is the greater of a defined dollar threshold or a base amount plus a percentage of total servicing UPB. Those requirements demand asset-class competence from the auditor. Can the proposed team recognize a calculation that appears reasonable but does not follow the guide?

Fannie Mae’s published review documentation identifies missing comprehensive written internal audit plans, independent internal audit functions, and audit schedules covering all required components. These are seller/servicer deficiencies, but they also expose gaps that the retained CPA firm should have surfaced. Reading the guide once is not equivalent to knowing what its requirements demand as audit evidence.

Why audit independence fails as a pre-engagement eligibility test, not an ethics reminder

Fannie Mae’s eligibility requirements specify that internal audit and management control procedures must be independent of the key loan manufacturing and servicing functions they review. The audit function must report directly to senior management and/or the board of directors. The seller/servicer’s internal reporting structure and the external CPA firm’s independence are separate matters, but both need proof that they are kept apart from the work under review.

An audit regulator’s published inspection findings document failures to obtain independence confirmations from all audit participants, assess whether everyone charging time needed a confirmation, and obtain confirmations at the beginning of the audit. These failures make the documentation risk concrete. A team can have a policy but lack the records to show that it followed it. When a firm submits a proposal, it must document its independence structure to qualify before its technical approach can be considered. The firm must therefore demonstrate who is covered, what relationships require assessment, and whether the necessary documentation is in place before the engagement letter is signed.

The peer review gate that eliminates firms before a proposal is scored

A firm cannot qualify if its required peer review is missing or has lapsed. For the GSE engagement described here, the firm must provide its most recently completed peer review report and internal documents on what it has done to correct deficiencies. A “pass with deficiencies” result can raise disqualifying questions even though it is not a failed review.

The GSA’s December 2025 ordering guide for civilian contract auditing services recommends including peer review in RFQ qualification requirements and evaluation criteria, while recognizing limited circumstances for a more permissive standard. That is a separate procurement context, but it illustrates the same gatekeeping mechanism. Where a clean, current report is required, pricing and personnel cannot cure its absence. General-practice firms that do no government or GSE-adjacent work may not keep up with the required GAGAS peer review cycles. Even firms that clear the financial, independence, and peer review gates then face a specialized servicing attestation that general audit experience does not equip them to perform.

Why the SOC 1 Type II requirement eliminates most generalist firms at the servicer review stage

A servicing-scoped SOC 1 Type II report addresses controls that investors’ auditors need to understand. If there is no SOC 1 report, each investor’s external auditor must visit the servicing facility to test controls directly or issue a scope limitation on the investor’s financial statement audit. GSEs and institutional private-label investors treat the absence of a current report as a serious servicing-counterparty risk, making the CPA firm’s capability gap the client’s problem.

SSAE 18 (AT-C 320) governs the independent CPA’s attestation to controls, and a Type II report covers operating effectiveness over a six-to-twelve-month period. Generic SOC experience is not enough here. Mortgage servicing scope requires custodial and remittance testing, while SOC 2 introduces a separate trust services criteria framework.

The Freddie Mac Single-Family Seller/Servicer Guide, current as of Bulletin 2026-10, August 5, 2026, requires a careful distinction. Section 1201 treats SOC-1 and SOC-2 reports as confidential information, while Section 1302.2 separately requires a SOC 2 Type 2 examination for qualifying Servicers as an information-security obligation. It does not say that those reports are required seller/servicer review documentation. The qualification case rests on the applicable servicing and information-security obligations.

How the USAP attestation requirement tests whether the firm understands mortgage servicing mechanics

The Uniform Single Attestation Program for Mortgage Bankers gives independent CPAs a standardized framework for testing compliance with minimum servicing standards defined by the Mortgage Bankers Association. It is an annual attestation distinct from a financial statement audit. The distinction changes what the auditor must understand. Accounting accuracy alone does not establish whether a servicer followed the required custodial mechanics, remittance timing, and agency expectations.

How would a team recognize a servicing control failure without knowing what compliant servicing looks like? USAP makes that knowledge gap visible in the work product. A generalist cannot treat operational fluency as something to acquire incidentally while completing the engagement. The team needs a reference framework to judge how servicing is done as well as check balances.

They must submit an internal control report with their financial audit, prepared in compliance with the elements of AU-C 940.55. That provision governs the report’s form and content. The resulting knowledge requirement compounds rather than duplicates USAP expertise, because the firm must address servicing compliance under one framework and internal control reporting under another. Experience with either deliverable does not establish competence in both.

Where HUD 232 and skilled nursing accounting create the engagement’s most acute failure point

A Section 232 audit is the annual financial statement audit for healthcare properties financed with a federally insured Section 232 mortgage. The properties include skilled nursing, assisted living, intermediate care, and board and care facilities. Here, the engagement crosses another technical boundary. The auditor needs healthcare accounting fluency as well as knowledge of HUD reporting, rather than general experience with property owners or mortgage borrowers.

HUD requires submissions through REAC and FASS, electronic systems with specific formatting requirements. A sound audit does not complete the filing obligation. Without prior system experience, a firm faces a practical barrier to producing a compliant submission, even if its financial statement work is otherwise strong. The dual audit tracks described for these borrowers bring the Consolidated Audit Guide and Uniform Guidance into the engagement, with strict deadlines and distribution limits adding operational pressure.

The properties’ eligibility also shapes the scope. They must provide ongoing, continuous care and oversight for people needing long-term care or medical attention, and they must hold the appropriate municipal or state license. The auditor therefore needs to understand the licensing framework as well as the accounts. Medicaid and Medicare cost principles then sit on top of federally insured mortgage reporting. This is the engagement’s most concentrated convergence point, because healthcare knowledge, HUD audit expertise, and filing experience must work together rather than remain isolated specialties within the firm.

The closely held business tax advisory dimension and the conflict trap it creates for the wrong firm

Most independent mortgage banks are closely held, and their owners often turn to the same CPA firm for personal and entity tax planning. That relationship can complicate the independence structure required for attestation. Advisory work across entity and personal returns, pass-through allocations, and compensation planning must be structured to preserve the firm’s independent role.

Non-bank independent mortgage banks lack a single federal prudential regulator and navigate state regulators, CFPB requirements, and GSE counterparty standards. That fragmented setting increases the significance of the CPA relationship. Yet a broader relationship also makes pre-engagement assessment more demanding when the firm advises both the business and its owners. A firm without experience separating advisory and attestation responsibilities risks creating an independence impairment or relinquishing the tax relationship to preserve the audit role. This returns the analysis to the earlier independence gate, but with the actual service relationships in view. Tension left unaddressed in the proposal can emerge later when unwinding those relationships is costly.

How do you find a CPA firm that understands Fannie Mae and Freddie Mac seller-servicer audit requirements?

Choosing a firm takes documented proof that it can do all the work that applies, along with a reputation for quality audits. For the full engagement described here, the proposal must show that the firm has enough prior mortgage banking audit experience to address UPB-linked net worth requirements, a clean and current GAGAS peer review, and an independence structure that covers everyone on the engagement. It must also demonstrate active SOC 1 and SOC 2 examination capacity scoped to servicing operations. The evidence needs to connect the proposed team’s experience to the reports the client actually requires.

Beyond the financial statements, qualification requires USAP attestation history and experience with HUD 232 and Uniform Guidance compliance audits, including REAC and FASS filings. Skilled nursing or assisted living work requires fluency in Medicaid and Medicare cost principles. Owner advisory must be structured from the outset so that it does not impair attestation independence, rather than relying on a policy drafted for the first time at engagement inception.

That evidence needs to be evaluated at proposal stage. A firm with the full capability set can address the engagement as an integrated obligation, while a generalist’s missing qualifications may surface only when the submission documents are assembled. By then, replacing the firm creates transition costs and puts the eligibility timeline at risk.