CITB Health (CH)

Correct: In mortgage lending, the Equal Credit Opportunity Act (ECOA) requires lenders to provide specific reasons for adverse actions. Because ML models can be opaque, implementing explainable AI (XAI) tools is essential to generate these reason codes. Furthermore, regular disparate impact testing is a critical compliance control to ensure the algorithm does not inadvertently use variables that serve as proxies for protected classes, which would violate fair lending laws.

Incorrect: Manual overrides for specific LTV ratios do not address the underlying lack of transparency in the model’s logic across the entire portfolio. Statistical sampling and variance testing against traditional methods may identify inconsistencies but fail to provide the legally required explanations for individual credit decisions. Claiming proprietary trade secrets is not a valid legal defense for failing to provide adverse action notices or for failing to demonstrate compliance with fair lending regulations.

Takeaway: Effective governance of AI in mortgage lending requires a combination of technical explainability and proactive testing for discriminatory bias to satisfy federal consumer protection requirements.

Correct: The Homeowners Protection Act (HPA) of 1998 requires mortgage servicers to automatically terminate PMI on the date the LTV is scheduled to reach 78% of the original value of the property (provided the borrower is current on payments). Unlike ‘borrower-requested cancellation’ at 80% LTV, which may require evidence of value, ‘automatic termination’ at 78% is a statutory requirement that does not require a borrower request or a new appraisal for standard residential mortgages.

Incorrect: Option B is incorrect because while RESPA governs escrow accounts, the specific timing and triggers for PMI termination are governed by the HPA. Option C is incorrect because the standard automatic termination threshold under federal law is 78%, not 75%. Option D is incorrect because while credit reporting might be affected, the primary regulatory violation and the core issue in the audit finding relate to the statutory termination requirements of the HPA, not the FCRA.

Takeaway: Under the Homeowners Protection Act, servicers must automatically terminate PMI when a loan reaches 78% LTV based on the original property value, assuming the loan is current.

Correct: In the context of model risk and IT succession, a formal roadmap is essential. It ensures that the specific, often undocumented, technical knowledge regarding complex mortgage calculations (like ARM caps and floors) is transferred systematically. Including a period of supervised performance allows the successor to demonstrate competency under the guidance of the expert, while mandatory documentation ensures the model remains auditable and maintainable after the transition.

Incorrect: Manual verification by the servicing department is a detective control that does not address the root cause of the succession risk and is prone to human error. Transitioning to off-the-shelf software is a strategic business decision that may take years to implement and does not solve the immediate risk of the developer’s departure. A one-time training session and a manual are insufficient for complex proprietary systems, as they lack the depth of hands-on experience and the structured validation provided by a formal transition period.

Takeaway: Effective IT succession planning for mortgage models requires a structured, documented knowledge transfer process and supervised performance to ensure operational continuity and model integrity.

Correct: Attribute-Based Access Control (ABAC) allows for fine-grained, context-aware permissions. By requiring dual-authorization (the ‘four-eyes’ principle) specifically for overrides of critical mortgage data like LTV ratios, the firm ensures that no single individual can unilaterally manipulate risk data. This directly addresses the whistleblower’s concern regarding the circumvention of underwriting principles and provides a preventative control that is more robust than simple role-based assignments.

Incorrect: Increasing the frequency of user access reviews is a detective control that may identify inappropriate access after the fact but does not prevent real-time manipulation of loan data. Multi-factor authentication and IP filtering are perimeter security measures that protect against external threats but do not address the misuse of legitimate internal privileges. Centralized logging is an essential audit trail component, but it is a detective control that occurs after the data has already been modified, failing to prevent the initial unauthorized override.

Takeaway: Effective IAM in mortgage servicing requires granular, context-aware controls and dual-authorization for critical data modifications to prevent internal fraud and ensure data integrity.

Correct: The primary risk associated with balloon mortgages is refinance risk. Because the loan does not fully amortize over its term, a large lump sum (the balloon) is due at maturity. Borrowers typically rely on their ability to refinance the debt into a new loan or sell the asset to cover this payment. If credit markets tighten or property values drop, the borrower may be unable to satisfy the debt, leading to default.

Incorrect: The suggestion that a servicer must automatically re-amortize the loan is incorrect because balloon mortgages do not typically feature an automatic right to refinance unless a specific reset or conditional refinance option was included in the original note. The claim regarding predatory classification is incorrect because balloon mortgages are defined by their payment structure, not by a requirement for downward interest rate adjustments. The idea of maintaining a secondary lien position is incorrect because the balloon payment is part of the primary debt obligation and is the final payment of the loan, not a separate lien.

Takeaway: The defining risk of a balloon mortgage is the borrower’s dependency on future market conditions to refinance or liquidate the asset before the lump-sum maturity date.

Correct: Developing a dual-track career progression framework addresses the root cause of IT turnover by providing clear professional growth paths for technical staff without forcing them into management roles. Combining this with a mentorship program ensures that critical institutional knowledge regarding complex mortgage calculations, such as LTV and PMI triggers, is preserved and shared, thereby enhancing engagement through professional development and reducing operational risk.

Incorrect: Rigorous code reviews and documentation protocols are important for quality control but do not address the human element of engagement or the reasons why staff are leaving. Migrating to a third-party provider is a strategic business shift that may reduce the need for certain staff but does not solve the retention issue for the remaining team and introduces new vendor risks. Performance bonuses tied strictly to ticket volume can lead to burnout and prioritize quantity over quality, often decreasing long-term engagement.

Takeaway: Effective IT retention in specialized mortgage environments requires a combination of clear technical career paths and structured knowledge management to align employee growth with operational stability.

Correct: Incorporating a safety risk assessment directly into the change management workflow ensures that physical risks, such as electrical hazards or ergonomic strain, are identified and addressed specifically for each project. This systematic approach aligns with internal audit best practices by embedding controls into the existing business process, ensuring that safety is considered during the planning phase of any IT infrastructure change.

Incorrect: General annual training is a baseline requirement but does not address the unique risks of a specific migration project. Restricting implementation windows to 8 hours is an arbitrary operational constraint that may not be feasible for complex mortgage system upgrades and does not address non-fatigue risks. Appointing an HR officer for oversight is a reactive, resource-intensive measure that fails to integrate safety into the technical lifecycle of IT operations.

Takeaway: Effective IT governance requires integrating workplace safety risk assessments directly into the change management process to ensure regulatory compliance and staff protection during physical deployments.

Correct: An event-driven architecture with automated triggers ensures that the system proactively identifies and acts upon data changes (such as the LTV reaching the 80% threshold) without relying on manual intervention. This design principle ensures that the servicing system remains compliant with the Homeowners Protection Act by automating the termination of PMI when the scheduled LTV reaches the legal requirement.

Incorrect: Increasing the frequency of manual audits is a detective control and does not address the underlying architectural design flaw. Deploying a secondary reporting server for manual review still relies on human intervention and does not provide the systemic automation required for reliable compliance. Enhancing encryption protocols addresses data security and confidentiality but does not resolve the functional failure of the PMI termination logic.

Takeaway: Effective IT architecture in mortgage servicing should incorporate automated, event-based triggers to ensure systemic compliance with regulatory requirements such as PMI termination thresholds.

Correct: Establishing a tiered manual processing protocol directly addresses the business continuity concern by ensuring that the mortgage underwriting process can continue even if the primary automation fails. By prioritizing specific loan types and identifying external resources (third-party services), the bank ensures that critical operations remain functional, which is the core requirement of a business continuity plan in a highly automated environment.

Incorrect: Implementing real-time data mirroring focuses on data availability and disaster recovery of the database itself, but it does not provide a solution for the failure of the processing application (the OCR system) or the workflow. Increasing stress test frequency is a preventative control that helps identify risks but does not provide a continuity solution once a failure occurs. Updating SLAs with penalty clauses provides financial recourse but does not mitigate the operational risk of a stalled loan pipeline or ensure regulatory compliance during an outage.

Takeaway: Effective business continuity for automated mortgage processes requires functional manual workarounds and resource scalability to maintain the loan pipeline during system failures.