This section applies to large servicers as defined in section 13-13-01.

1.    Large servicers shall establish and maintain a board of directors responsible for its oversight. For large servicers that are not approved to service loans by a government- sponsored enterprise, or where these federal agencies have granted approval for a board alternative, an institution may establish a similar body constituted to exercise oversight and fulfill the board of directors’ responsibilities in subsection 2.

2.    The board of directors shall be responsible for:

a.    Establishing a written corporate governance framework, including appropriate internal controls designed to monitor corporate governance and assess compliance with the corporate governance framework.

    b.    Monitoring and ensuring institution compliance with the corporate governance framework and this chapter.

c.    Reporting, accurately and timely, regulatory reports, including the requirements for filing the mortgage call report as required by section 13-13-23.

d.    Establishing internal audit requirements that are appropriate for the size, complexity, and risk profile of the servicer, with appropriate independence to provide a reliable evaluation of the servicer’s internal control structure, risk management, and governance.

3.    Licensees subject to this section shall obtain an external opinion audit, including audited financial statements and audit reports conducted by an independent public accountant annually, including at a minimum:

a.    Annual financial statements, including balance sheet, statement of operations or income statement, cashflows, notes, and supplemental schedules prepared in accordance with generally accepted accounting principles.

b.    Assessment of the internal control structure. c.    Computation of tangible net worth.

d.    Validation of mortgage servicing rights valuation and reserve methodology, if applicable.

e.    Verification of adequate fidelity and errors and omissions insurance.

f.    Testing of controls related to risk management activities, including compliance and stress testing, where applicable.

4.    Licensees subject to this section shall establish a risk management program under the oversight of the board of directors that identifies, measures, monitors, and controls risk sufficient for the level of sophistication of the servicer. The risk management program must:

a.    Have appropriate processes and models in place to measure, monitor, and mitigate financial risk and changes to the risk profile of the servicer and assets being serviced.

b.    Be scaled to the complexity of the organization, but be sufficiently robust to manage risks in several areas, including:

(1) Credit risk. The potential that a borrower or counterparty will fail to perform on an obligation.

(2) Liquidity risk. The potential that the servicer will be unable to meet its obligations as they come due because of an inability to liquidate assets or obtain adequate funding or that it cannot easily unwind or offset specific exposures.

(3) Operational risk. The risk resulting from inadequate or failed internal processes, people, and systems or from external events.

(4) Market risk. The risk to the servicer’s condition resulting from adverse movements in market rates or prices.

(5) Compliance risk. The risk of regulatory sanctions, fines, penalties, or losses resulting from failure to comply with laws, rules, regulations, or other supervisory requirements applicable to the servicer.

(6) Legal risk. The potential that actions against the institution that result in unenforceable contracts, lawsuits, legal sanctions, or adverse judgments can disrupt or otherwise negatively affect the operations or condition of the servicer.

(7) Reputation risk. The risk to earnings and capital arising from negative publicity regarding the servicer’s business practices.

5.    Licensees subject to this section shall conduct a risk management assessment on an annual basis, concluding with a formal report to the board of directors. Evidence of risk management activities throughout the year must be maintained and made part of the report, including findings of issues and the response to address those findings.

6.    Licensees subject to this section must maintain the audits, policies and procedures, and assessment results as part of their books and records available to the commissioner upon request.