13-13-09. Corporate governance

13-13-09. Corporate governance

This section applies to large servicers as defined in section 13-13-01.

1. Large servicers shall establish and maintain a board of directors responsible for its

oversight. For large servicers that are not approved to service loans by a government-

sponsored enterprise, or where these federal agencies have granted approval for a

board alternative, an institution may establish a similar body constituted to exercise

oversight and fulfill the board of directors' responsibilities in subsection 2.

2. The board of directors shall be responsible for:

a. Establishing a written corporate governance framework, including appropriate

internal controls designed to monitor corporate governance and assess

compliance with the corporate governance framework.

b. Monitoring and ensuring institution compliance with the corporate governance

framework and this chapter.

c. Reporting, accurately and timely, regulatory reports, including the requirements

for filing the mortgage call report as required by section 13-13-23.

d. Establishing internal audit requirements that are appropriate for the size,

complexity, and risk profile of the servicer, with appropriate independence to

provide a reliable evaluation of the servicer's internal control structure, risk

management, and governance.

3. Licensees subject to this section shall obtain an external opinion audit, including

audited financial statements and audit reports conducted by an independent public

accountant annually, including at a minimum:

a. Annual financial statements, including balance sheet, statement of operations or

income statement, cashflows, notes, and supplemental schedules prepared in

accordance with generally accepted accounting principles.

b. Assessment of the internal control structure.

c. Computation of tangible net worth.

d. Validation of mortgage servicing rights valuation and reserve methodology, if

applicable.

e. Verification of adequate fidelity and errors and omissions insurance.

f. Testing of controls related to risk management activities, including compliance

and stress testing, where applicable.

4. Licensees subject to this section shall establish a risk management program under the

oversight of the board of directors that identifies, measures, monitors, and controls risk

sufficient for the level of sophistication of the servicer. The risk management program

must:

a. Have appropriate processes and models in place to measure, monitor, and

mitigate financial risk and changes to the risk profile of the servicer and assets

being serviced.

b. Be scaled to the complexity of the organization, but be sufficiently robust to

manage risks in several areas, including:

(1) Credit risk. The potential that a borrower or counterparty will fail to perform

on an obligation.

(2) Liquidity risk. The potential that the servicer will be unable to meet its

obligations as they come due because of an inability to liquidate assets or

obtain adequate funding or that it cannot easily unwind or offset specific

exposures.

(3) Operational risk. The risk resulting from inadequate or failed internal

processes, people, and systems or from external events.

(4) Market risk. The risk to the servicer's condition resulting from adverse

movements in market rates or prices.

(5) Compliance risk. The risk of regulatory sanctions, fines, penalties, or losses

resulting from failure to comply with laws, rules, regulations, or other

supervisory requirements applicable to the servicer.

(6) Legal risk. The potential that actions against the institution that result in

unenforceable contracts, lawsuits, legal sanctions, or adverse judgments

can disrupt or otherwise negatively affect the operations or condition of the

servicer.

nes, penalties, or losses

resulting from failure to comply with laws, rules, regulations, or other

supervisory requirements applicable to the servicer.

(6) Legal risk. The potential that actions against the institution that result in

unenforceable contracts, lawsuits, legal sanctions, or adverse judgments

can disrupt or otherwise negatively affect the operations or condition of the

servicer.

(7) Reputation risk. The risk to earnings and capital arising from negative

publicity regarding the servicer's business practices.

5. Licensees subject to this section shall conduct a risk management assessment on an

annual basis, concluding with a formal report to the board of directors. Evidence of risk

management activities throughout the year must be maintained and made part of the

report, including findings of issues and the response to address those findings.

6. Licensees subject to this section must maintain the audits, policies and procedures,

and assessment results as part of their books and records available to the

commissioner upon request.