Questions and Answers 2 FINAL 12102019.docx

The Government has received the following questions:

1. While the heading of the PWS states “Financial Statement Audit Support”, Section 5.1.1.15 indicates the Contractor will prepare and submit audit report(s), which include a report on compliance with applicable laws and regulations, a report on internal controls and an opinion or disclaimer of opinion on Ginnie Mae’s financial statements. It is unclear whether this solicitation is for a “support” role or for the main role of statement auditor. Can you clarify? Is there an option to serve as support for the audit of Ginnie Mae loan portfolio with the OIG assuming ultimate responsibility for the work?

A: It is OIG’s intent that the selected Independent Public Accountant (IPA) will be responsible for conducting the audit and issuing the independent auditor report.

2. Can you be more specific on the areas that are under audit? The original Sources Sought for MAJOR AUDIT SUPPORT SERVICES presented the opportunity to bid on the Ginnie Mae non-pooled loan portfolio alone. This RFP p.13 Section 5.1.1.11 mentions the Guaranty Asset, Guaranty Obligation, Reserves for Loan Losses as well as non-pooled assets, all as significant estimates.

A: It is the OIG’s intent that the selected IPA will conduct a full scope financial statement audit of Ginnie Mae.

3. Is there an opportunity to bid on portions of this RFP rather than the entire job?

A: No. The entire solicitation requirements must be met.

4. P14 – Instructions to Offerors, Pages 9 and 15: Can the government clarify the Socioeconomic Participation ratings available to large businesses? Page 8 indicates that an offer that is not a small business (i.e. a large business) can achieve an Excellent rating if it meets the specified criteria, which is inconsistent with the ratings appearing on page 15. The ratings on page 15 seem to indicate that the highest available rating for Socioeconomic Participation for a large business is “Fair” (i.e. only small businesses can achieve ratings of “Good” or “Excellent”).

A: The rating scheme on page 9 and 15 are not inconsistent.

5. P02 – PWS, Page 6, Paragraph 5.0: Is the contractor responsible for the full scope financial audit or will OIG personnel perform portions of the audit? If shared between the contractor and OIG, which component (e.g. financial statement(s), line items, business cycles, information systems) will be assigned to the contractor?

A: It is OIG’s intent that the selected IPA will be responsible for conducting the audit and issuing the independent auditor report.

6. P02 – PWS, Page 14, Paragraph 5.1.1.15: Can the government confirm that the contractor is responsible for issuing an opinion on the financial statements?

A: It is OIG’s intent that the selected IPA will be responsible for conducting the audit and issuing the independent auditor report.

7. P02 – PWS, Page 6, Paragraph 5.1.1.15: Can the government clarify if the contractor is responsible for issuing an opinion on the effectiveness of internal control?

A: It is OIG’s intent that the selected IPA will be responsible for conducting the audit and issuing the independent auditor’s report on the financial statements. A separate opinion on the effectiveness of internal control is not required; however an element of the independent auditor’s report is required to include a report on internal controls over financial reporting.

8. P02 – PWS, Page 14, Paragraph 5.1.1.13: This paragraph mentions the contractor’s responsibility to prepare the Summary of Unadjusted Differences (SUD) in response to GAO’s request in their annual audit communication letter. Will the contractor be responsible for preparing other deliverables prescribed by GAO? If so, can the government clarify the volume and scope of those deliverables?

A: The Contractor is expected to provide or assist with preparing documents requested by GAO in support of the government wide financial statement audit.

9. Please provide copies of the financial statements and related audit reports for the entity.

A: Copies of the 2018, 2017, and 2016 financial statements and related audit reports are provided.

10. Please provide copies of last year’s management letters, if issued, for the entity to help properly evaluate the control environment and the scope of our work

A: In regards to the fiscal year 2018 Management Letter; we did not issue a written communication. We did provide oral comments to Ginnie Mae management at the exit conference regarding Ginnie Mae not fully complying with its own procedures regarding approving quarterly statements, proper sign-off of new accounts as well as not properly accruing income for a specific revenue type.

11. What was the actual level of effort for the audits of each entity by labor category for 2018? If that is not available, please provide the level of effort estimated in the contract or previous proposals for those audits.

A: The Government leaves that up to the offerors. Not applicable, as this was done in-house with Government FTEs

12. Please provide contract award amounts by entity for the previous audit.

A: Not applicable, as this was done in-house with Government FTEs.

13. What was the prior year’s hours and fees?

A: Not applicable, as this was done in-house with Government FTEs.

14. What is the anticipated/ estimated or budgeted level of effort required for this contract? Are the hours and amount significantly different from what were incurred during the most current audit? If yes, why?

A: Not applicable, as this was done in-house with Government FTEs

15. What was the prior contract number?

Because this is an email submission, what is the email file size your email system will allow?

A: Not applicable. The Government does not have an in-bound size limit, but encourages early submission to ensure the Government receives the proposal in a timely manner.

16. Because there is a page limit for this submission, are the proposal cover, table of contents, cover letter, or other required front matter excluded from the page limit?

A: The proposal format has been prescribed.

A: No, it will not.

A: Section 1.2 is hereby amended from:

The objective of this contract is to obtain the services of an independent public accounting firm (IPA) to complete an Audit of the Ginnie Mae’s financial statements for the fiscal year 2020( comparative statements, if applicable) and upon exercise of three (3) subsequent option periods beginning with fiscal year 2021, in accordance with the CFO Act of 1990, as amended.

To:

The objective of this contract is to obtain the services of an independent public accounting firm (IPA) to complete an Audit of the Ginnie Mae’s financial statements for the fiscal year 2020( comparative statements, if applicable) and upon exercise of four (4) subsequent option periods beginning with fiscal year 2021, in accordance with the CFO Act of 1990, as amended.

Other sections are amended to include 4 option periods.

Question: 19 - Attachment E – Level of Effort Hours

Will the Government please clarify whether Attachment E should provide the rough order of magnitude expected hours by labor category for each individual phase (planning, internal control, testing, and reporting) or all as one.

A: Each individual phase.

A: Yes.

Instructions to Offerors, Evaluation Factors and Rating Scales

· Should the Proposal Matrix be provided as a separate attachment to the Offeror’s proposal submission? If not, in which volume/section should it be included?

· Will the Government please confirm that the Proposal Matrix is excluded from any page limits?

· Should one Proposal Matrix encompass all section responses (i.e., Technical Approach, Quality Control Plan, Management Plan, Past Performance, Socioeconomic Participation, and Price) OR should each section response have its own Proposal Matrix?

A: Yes, the proposal matrix is a separate attachment to the proposal. There is no page limitation on the proposal matrix. One proposal matrix for all volumes is acceptable.

· Volume I – Technical Proposal (encompassing the Technical Approach, Quality Control Plan, Management Plan, and Past Performance)

· Volume II – Socioeconomic Participation

· Volume III – Price Proposal.

A: The proposal matrix comes from a mandatory template.

A: Sections number and title are acceptable.

A: Not applicable. The Government does not have an in-bound size limit, but encourages early submission to ensure the Government receives the proposal in a timely manner.

A: The Government will truncate the proposal counting from the page after the cover page for each section

· Considering the use of the word “spreadsheet,” should Offerors provide this information in Microsoft Excel format?

· If yes, will the Government please confirm that Offerors may provide the Excel spreadsheet as a separate attachment to their proposal submission?

A: Any Microsoft Excel compatible spreadsheet is acceptable. As indicated in the solicitation, “ The spreadsheet does not count towards page limit totals.”

A: The solicitation stands as is.

A: Resumes are not required for the management plan.

A: Yes, resumes, to the extent required, are exempt from the page limitation.

· Should Offerors provide Attachment #5 – Past Performance Chart as a separate attachment to their proposal submission?

· If yes, should Offerors include the 1-page narratives within Attachment 5 OR within the Technical Proposal?

A: Yes. The past performance volume of the proposal is separate from the technical approach section.

A: Confirm.

A: The solicitation stands as is. Letters of commitment are required.

A: Pricing proposal instructions have been prescribed.

A: Confirm

A: Attachment 7 will be determined after contract award.

OR

If an Offeror chooses to propose an alternative payment schedule than the one in Attachment #7, will the Government please confirm that the submission of Attachment #7 is not required and that Offerors may include their proposed payment schedule within their Price Proposal?

A: Pricing proposal instructions have been provided – the labor hour and FFP chart is required.

A: : Pricing proposal instructions have been provided – the labor hour and FFP chart is required.

A: Travel has been covered by the following solicitation provision and contract clause:

1.6.1 TRAVEL

The Contractor may be required to travel to conduct fieldwork at the contractor and/or subcontractor’s location, unless otherwise specified. Travel shall be approved in advance by the COR or Contracting Officer. Travel is subject to the Federal Travel Regulations.

The primary travel locations outside of the Washington, D.C. area where fieldwork may be required could include the following: New York, NY; Anaheim, CA; Houston, TX; Andover, MA; and Minneapolis, MN.

In addition, if the Government’s intent is to achieve small business participation goals, the Government should consider revising the evaluation factors. For example, under the “Excellent” rating, rather than the Government requiring the Offerors to propose 41%-50% total subcontracting and then 60% of that value to small businesses, the Government should require Offerors to simply propose 30% to small businesses.

Attachment 1

· (5) Terms of any express warranty

· (8) A completed copy of the representations and certifications at FAR 52.212-3 (see FAR 52.212-3(b) for those representations and certifications that the offeror shall complete electronically)

· (9) Acknowledgment of Solicitation Amendments

· (11) If the offer is not submitted on the SF 1449, include a statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation.

A: The solicitation stands as is. That information should be filled in as part of the proposal package. Attachment 1 submissions will not count towards page limitations.

· In which volume/section should Offerors provide this information?

· Will the Government please confirm that this information is excluded from any page limits?

A: Confirm. That information should be filled in as part of the proposal package. Attachment 1 submissions will not count towards page limitations.

A: The solicitation stands as is, as FFP pricing is also required.

Attachment 2

Attachment 3

Attachment 6

A: If not applicable, no text is required.

Attachment D

A: Confirm

Attachment E

A: We look for the Offerors to do so.

image3.emf

2019-FO-0001.pdf

Government National Mortgage Association, Washington, DC

Audit of Fiscal Years 2018 and 2017

Financial Statements

Office of Audit, Financial Audits Division Washington, DC

Audit Report Number: 2019-FO-0001 November 13, 2018

To: Michael Bright, Executive Vice President and Chief Operating Officer, TA

From: Thomas R. McEnanly, Director, Financial Audits Division, GAF

Subject: Audit of the Government National Mortgage Association’s Financial Statements for Fiscal Years 2018 and 2017

Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of the Government National Mortgage Association’s fiscal years 2018 and 2017 financial statements.

HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit.

The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG website. Accordingly, this report will be posted at http://www.hudoig.gov.

If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216.

MedinaM

Typewritten Text

\\signed\\

Highlights

What We Audited and Why We were engaged to audit the accompanying financial statements and notes of the Government National Mortgage Association (Ginnie Mae) as of September 30, 2018 and 2017. The Government Corporation Control Act, as amended, requires the Office of Inspector General to audit the financial statements of Ginnie Mae annually. This report presents the results of our fiscal years 2018 and 2017 audits of Ginnie Mae’s financial statements, including our report on Ginnie Mae’s internal control and test of compliance with selected provisions of laws and regulations that apply to Ginnie Mae.

What We Found In fiscal year 2018, for the fifth consecutive year, we were unable to obtain sufficient, appropriate evidence to express an opinion on the fairness of the $3 billion (net of allowance) in nonpooled loan assets from Ginnie Mae’s defaulted issuers’ portfolio as of September 30, 2018.

Ginnie Mae also continued to improperly account for Federal Housing Administration reimbursable costs as an expense instead of capitalizing them, also for the fifth consecutive year.

The combination of these unresolved issues for a number of years was both material and pervasive because it impacted multiple financial statement line items across all of Ginnie Mae’s basic financial statements. As a result of the scope limitation in our audit work and the effects of material weaknesses in internal control, we have not been able to obtain sufficient, appropriate evidence to provide a basis for an audit opinion on Ginnie Mae’s fiscal years 2018 and 2017 financial statements. This report contains the updated status of prior-year audit findings, comprised of four material weaknesses, one significant deficiency, and one reportable noncompliance with selected provisions of laws and regulations.

What We Recommend Our prior-year audit recommendations are directed toward improving and strengthening Ginnie Mae’s governance of its financial operations. We did not have any new audit recommendations in fiscal year 2018. Open recommendations made in previous years are not included in this report.

Audit Report Number: 2019-FO-0001 Date: November 13, 2018

Audit of the Government National Mortgage Association’s Financial Statements for Fiscal Years 2018 and 2017

Table of Contents

Independent Auditor’s Report

Material Weaknesses

Finding 1: Material Asset Balances Related to Nonpooled Loan Assets Were Not Auditable

Finding 2: Deficiencies in Ginnie Mae’s Internal Controls Over Financial Reporting Were Under Remediation

Finding 3: Allowance for Loan Loss Account Balances Remained Unreliable

Finding 4: Financial Management Governance Problems Continued, Although Progress Was Made

Significant Deficiency

Finding 5: Ginnie Mae Was Not in Full Compliance With Federal Information System Controls Requirements for Integrated Pool Management System

Compliance With Laws and Regulations

Finding 6: Ginnie Mae Did Not Comply With the Debt Collection Improvement Act of 1996

Scope and Methodology

Followup on Prior Audits

Appendixes

A. Auditee Comments and OIG’s Evaluation

B. Ginnie Mae’s Fiscal Years 2018 and 2017 Financial Statements and Notes

Independent Auditor’s Report

Executive Vice President and Chief Operating Officer Government National Mortgage Association

In our audits of the fiscal years 2018 and 2017 financial statements of the Government National Mortgage Association (Ginnie Mae), we found

That certain material weaknesses and other limitations on the scope of our work resulted in conditions that continued to prevent us from expressing an opinion on the accompanying financial statements as of and for the fiscal years ending September 30, 2018 and 2017.

That Ginnie Mae’s internal control over financial reporting was not effective as of September 30, 2018 and 2017. We identified four material weaknesses and one significant deficiency in internal control over financial reporting.

One instance of reportable noncompliance for fiscal year 2018 with certain provisions of applicable laws and regulations we tested.

The following sections and appendixes discuss in more detail (1) our report on the financial statements, (2) our report on internal control over financial reporting, (3) our report on compliance with laws and regulations, (4) agency comments and our evaluation, and (5) the current status of prior-year audit findings.

Report on the Financial Statements We were engaged to audit the accompanying financial statements of Ginnie Mae, which are comprised of the balance sheets as of September 30, 2018 and 2017, and the related statements of revenues and expenses and changes in investment of the U.S. Government, the cash flows for the years then ended, and the related notes to the financial statements.

Management’s Responsibility Ginnie Mae’s management is responsible for the preparation and fair presentation of these financial statements in accordance with U.S. generally accepted accounting principles (GAAP).

This responsibility includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

U.S. DEPARTMENT OF

HOUSING AND URBAN DEVELOPMENT

OFFICE OF INSPECTOR GENERAL

Auditor’s Responsibility Our responsibility is to express an opinion on these financial statements based on conducting the audit in accordance with U.S. generally accepted government auditing standards. However, we were not able to obtain sufficient, appropriate evidence to provide a basis for an audit opinion because of the unresolved matters described in the Basis for Disclaimer of Opinion paragraph below.

Basis for Disclaimer of Opinion The following unresolved matters are a scope limitation in our audit work that contributed to our disclaimer of opinion on the fiscal year 2018 financial statements. There were no other satisfactory alternative audit procedures that we could adopt to obtain sufficient, appropriate evidence with respect to these unresolved matters. Readers are cautioned that amounts reported in the financial statements and related notes may not be reliable because of these unresolved matters.

Nonpooled loan assets. For the fifth consecutive year, Ginnie Mae could not bring its material asset balances related to its nonpooled loan assets (NPA) into an auditable state in fiscal year 2018. Therefore, we were unable to audit the $3 billion (net of allowance) in NPA reported in Ginnie Mae’s financial statements as of September 30, 2018. The NPA represents 9 percent of Ginnie Mae’s total assets in the balance sheet. These NPA assets relate to (1) claims receivable, net ($253 million); (2) mortgage loans held for investment, including accrued interest, net ($2,736 million); and (3) acquired property, net ($25 million). This condition occurred because the subledger database project (SLDB), which was the solution developed by Ginnie Mae management in response to our finding, was not yet in place and fully implemented at the end of fiscal year 2018.

Therefore, we were again unable to perform all of the audit procedures needed to obtain sufficient, appropriate evidence to render an opinion on the nonpooled loans assets. As a result, we deemed our audit scope insufficient to express an opinion on Ginnie Mae’s $3 billion in NPA and related accounts as of September 30, 2018.

Receivable for reimbursable expenses from FHA. For the fifth consecutive year, Ginnie Mae continued to account for Federal Housing Administration (FHA) reimbursable costs as an expense instead of capitalizing the costs as an asset in fiscal year 2018. This practice caused Ginnie Mae’s asset and net income line items to be misstated. Due to multiple years of incorrect accounting, we believe the cumulative effect of the errors identified was material. However, we were unable to determine with sufficient accuracy a proposed adjustment to correct the errors due to insufficient available data.

Disclaimer of Opinion Because of the significance of the matters described in the Basis for Disclaimer of Opinion, we have not been able to obtain sufficient, appropriate evidence to provide a basis for an audit opinion. Accordingly, we do not express an opinion on these financial statements.

Emphasis of Matter As discussed in notes 3 and 4 to the financial statements, Ginnie Mae did not recognize the amount of interest income that would be earned on uninvested funds it maintained in the U.S.

Treasury Financing Fund account. This was due to an ongoing legal dispute with the U.S.

Treasury regarding the appropriateness of paying this interest to Ginnie Mae without it having signed the borrowing agreement.1 Before fiscal year 2018, the U.S. Treasury paid Ginnie Mae interest income without requiring it to sign this agreement. As this issue has not been resolved legally, we cannot conclude on the appropriateness of reporting or not reporting this revenue in accordance with U. S. GAAP in Ginnie Mae’s fiscal year 2018 financial statements.

Additionally, depending on the outcome of this dispute, we caution readers about the potential impact of this unsettled issue on Ginnie Mae’s fiscal year 2018 and prior years’ issued statements. Our opinion has not been modified with respect to this matter in fiscal year 2018.

Other Matters Ginnie Mae’s Annual Report and Report to Congress contain a wide range of information, including required supplementary information, such as the management discussion and analysis, which is not directly related to the financial statements. This information is presented for additional analysis and is not a required part of the financial statements. Therefore, it has not been subjected to the auditing procedures applied in the audit of the financial statements. As a result, we do not express an opinion on the information or provide assurance on it.

Report on Internal Control Over Financial Reporting

Management’s Responsibility Ginnie Mae’s management is responsible for (1) evaluating the effectiveness of internal control over financial reporting; (2) providing a statement of assurance on the overall effectiveness of internal control over financial reporting, including providing reasonable assurance that the broad objectives of the Federal Managers’ Financial Integrity Act are met; and (3) ensuring compliance with other applicable laws and regulations.

Auditor’s Responsibility In planning and performing our audit of the financial statements in accordance with U.S.

generally accepted government auditing standards, we considered Ginnie Mae’s internal control over financial reporting to determine the appropriate audit procedures for expressing our opinion on the financial statements. However, we did not plan our audit for the purpose of expressing an opinion on the effectiveness of Ginnie Mae’s internal control. As a result, we do not express an opinion on the effectiveness of Ginnie Mae’s internal control.

We are required to report all deficiencies that are considered to be significant deficiencies or material weaknesses. We did not consider all internal controls relevant to operating objectives, such as those controls relevant to preparing performance information and ensuring efficient operations.

1 The borrowing agreement establishes and documents that Ginnie Mae’s mortgage-backed securities program is subject to the Federal Credit Reform Act, which permits payment of interest to Ginnie Mae under the Act.

Definition and Inherent Limitations on Internal Control Over Financial Reporting An entity’s internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, the objectives of which are to provide reasonable assurance that (1) transactions are properly recorded, processed, and summarized to permit the preparation of financial statements in accordance with U.S. GAAP and assets are safeguarded against loss from unauthorized acquisition, use, or disposition and (2) transactions are executed in accordance with provisions of applicable laws, including those governing the use of budget authority, regulations, contracts, and grant agreements, noncompliance with which could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect and correct misstatements due to fraud or error.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis. A material weakness is a deficiency or a combination of deficiencies in internal control, such that there is a reasonable possibility that a material misstatement of Ginnie Mae’s financial statements will not be prevented or detected and corrected on a timely basis. A significant deficiency is a deficiency or combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance.

Results of Our Consideration of Internal Control Over Financial Reporting Our consideration of internal control was for the limited purpose described above and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies. Therefore, material weaknesses or significant deficiencies may exist that were not identified. We identified five deficiencies in internal control that are described below.

Material Weaknesses in Financial Reporting

Material Asset Balances Related to Nonpooled Assets Were Not Auditable For the fifth consecutive year, Ginnie Mae could not bring its material asset balances related to its NPA and related accounts into an auditable state in fiscal year 2018. Therefore, we were unable to audit the $3 billion (net of allowance) in NPA reported in Ginnie Mae’s financial statements as of September 30, 2018. These assets relate to (1) claims receivable, net ($253 million); (2) mortgage loans held for investment, including accrued interest, net ($2,736 million);

and (3) acquired property, net ($25 million). The NPA represents 9 percent of Ginnie Mae’s total assets in the balance sheet. This condition occurred because, although efforts were underway to develop financial management systems capable of handling loan-level transaction accounting, these systems were not yet fully in place at the end of fiscal year 2018. In addition, the critical accounting policies and procedures, which dictate how the NPA and related accounts will be recorded in the financial statements, were not finalized until the end of fiscal year 2018.

Therefore, we were again unable to perform all of the audit procedures needed to obtain sufficient, appropriate evidence to formulate a conclusion on the fairness of the financial statements. As a result, we deemed our audit scope insufficient to express an opinion on Ginnie Mae’s $3 billion in NPA and related accounts as of September 30, 2018.

Deficiencies in Ginnie Mae’s Internal Controls Over Financial Reporting Were Under Remediation Ginnie Mae made progress in certain areas of internal control over financial reporting in fiscal year 2018; however, the majority of the weaknesses identified in prior-year audits continued.

These weaknesses included (1) improper accounting for FHA’s reimbursable costs and accrued interest earned on nonpooled loans and (2) accounting issues related to revenue recognition, fixed assets, advances, and note disclosures. We are reporting these continued weaknesses because Ginnie Mae had not remediated a number of our concerns and due to continued disagreement with Ginnie Mae regarding its accounting practice for advances. Until these control deficiencies are fully remediated, Ginnie Mae will lack assurance that its internal controls can be relied on to prevent or detect risk of material misstatements in its financial statements in a timely manner.

Allowance for Loan Loss Account Balances Remained Unreliable As reported for the past 3 years, Ginnie Mae’s loan loss account balances had not been remediated and remained a work in progress at the end of fiscal year 2018 due to various underlying accounting issues. The allowance for loan loss account represents Ginnie Mae’s best estimates of receivables that are expected to be uncollectible. This condition occurred because the SLDBproject solution, which was intended to address reliability concerns with the allowance for loan loss account balances, was not fully implemented in fiscal year 2018. As a result, the balances of the allowance for loan loss account reported in Ginnie Mae’s financial statements as of September 30, 2018, remained unreliable.

Financial Management Governance Problems Continued, Although Progress Was Made In fiscal year 2018, as in the past 4 fiscal years, we remained concerned about Ginnie Mae’s financial management governance problems, although some progress was made this year.

Specifically, this concern included issues with (1) keeping Ginnie Mae’s OCFO operations fully functional; (2) ensuring that emerging risks affecting its financial management operations were identified, analyzed, and responded to appropriately and in a timely manner; (3) establishing adequate and appropriate accounting policies and procedures and accounting systems; (4) lacking effective monitoring and oversight of MSSs as service organizations; and (5) implementing an effective entitywide governance of the estimation models, which are used to generate accounting estimates for financial reporting. The lack of proper alignment in its people, process, and technology at the right time, right place, and right seats contributed to our ongoing concern, as well as Ginnie Mae’s inability to produce auditable financial statements for the fifth consecutive fiscal year.

Significant Deficiency in Financial Reporting

Ginnie Mae Was Not in Full Compliance With Federal Information System Controls Requirements for Its Integrated Pool Management System Ginnie Mae was not in full compliance with Federal information system controls requirements for IPMS. Our review of the general controls over IPMS identified deficiencies with (1) transaction security within the utility software of the CICS transaction server of IPMS, (2) privileged accounts’ password controls, (3) contractor employees’ access controls, and (4) the review process for incompatible duties. These deficiencies occurred because Ginnie Mae did not

(1) know that users’ access was not properly restricted, (2) know that the contractor considered privileged accounts to be service accounts, (3) ensure that all of the terms and critical requirements of the contract were followed, and (4) document the review process for incompatible duties. As a result, these deficiencies could (1) allow powerful capabilities to be at the disposal of unauthorized users, (2) increase risk because the privileged accounts could allow unauthorized access to an organization’s infrastructure, (3) cause an agency to be unable to assess contractor performance or the potential risks associated with a user, and (4) increase the risk that erroneous or fraudulent transactions could be processed. In addition, we assessed the status of HUD’s actions to address information system control deficiencies identified in previous audit reports.

Intended Purpose of Report on Internal Control Over Financial Reporting The purpose of this report is solely to describe the scope of our consideration of Ginnie Mae’s internal control over financial reporting and the results of our procedures and not to provide an opinion on the effectiveness of Ginnie Mae’s internal control over financial reporting. This report is an integral part of an audit performed in accordance with U.S. generally accepted government auditing standards in considering internal control over financial reporting.

Accordingly, this report on internal control over financial reporting is not suitable for any other purpose.

In addition to the internal control issues included in this report, other matters involving internal control over financial reporting and Ginnie Mae’s operations that are not included in this report will be reported to Ginnie Mae management in a separate management letter.

Report on Compliance With Laws and Regulations In connection with our audits of Ginnie Mae’s financial statements, we tested compliance with selected provisions of applicable laws and regulations consistent with our auditor’s responsibility discussed below. We caution that noncompliance may occur and not be detected by these tests. We performed our tests of compliance in accordance with U.S. generally accepted government auditing standards.

Management’s Responsibility Ginnie Mae is responsible for complying with laws and regulations applicable to Ginnie Mae.

Material Weaknesses

Finding 1: Material Asset Balances Related to Nonpooled Loan Assets Were Not Auditable For the fifth consecutive year, Ginnie Mae could not bring its material asset balances related to its NPA and related accounts into an auditable state in fiscal year 2018. Therefore, we were unable to audit the $3 billion (net of allowance) in NPA reported in Ginnie Mae’s financial statements as of September 30, 2018. These assets relate to (1) claims receivable, net ($253 million); (2) mortgage loans held for investment, including accrued interest, net ($2,736 million);

and (3) acquired property, net ($25 million). The NPA represents 9 percent of Ginnie Mae’s total assets in the balance sheet. This condition occurred because, although efforts were underway to develop financial management systems capable of handling loan-level transaction accounting, these systems were not yet fully in place at the end of fiscal year 2018. In addition, the critical accounting policies and procedures, which dictate how the NPA and related accounts will be recorded in the financial statements, were not finalized until the end of fiscal year 2018.

Therefore, we were again unable to perform all of the audit procedures needed to obtain sufficient, appropriate evidence to formulate a conclusion on the fairness of the financial statements. As a result, we deemed our audit scope insufficient to express an opinion on Ginnie Mae’s $3 billion in NPA and related accounts as of September 30, 2018.

Concerns Continued Regarding the Auditability of the Accounting…