Vendor Management in the mortgage banking industry is a unique beast. I should know, for the last 15 years I’ve managed several hundred vendors from the local small business owner to enterprise platforms that access, transmit, or store borrower PII and can disrupt operations quickly.
If you’ve gone through a Fannie MORA or Freddie CORE review in the last 5 years, you’ll agree that when it comes to vendor management, the gloves are off. There is great emphasis on board and senior management oversight. You can outsource the work, but you cannot outsource accountability.
In a spider web of vendor connections, the risk of the 3rd, 4th, and nth party still lands on your desk. Your program must demonstrate risk-based controls across the full third-party lifecycle (risk assessment, due diligence, contracting, monitoring, and termination).
Assuming you’ve got full visibility of your vendor panel the MORA and CORE findings around vendor management do a great job in helping you mature a vendor management program. Small tweaks to your program can take it from good to great. That is, if you’re willing to put in the work.
What Fannie and Freddie Expect: MORA/CORE Ready
Governance & Oversight. Establish clear program ownership, defined roles and responsibilities, and consistent reporting to senior management and the board.
Complete Vendor Inventory. Maintain a complete inventory of all third parties, including vendors discovered through procurement and credit card spend, and ensure it stays current.
Risk Tiering That Drives Controls. Tier vendors using objective criteria, and tie each tier to specific due diligence, contract clauses, and monitoring requirements.
Risk-Aligned Due Diligence. Collect and review due diligence evidence that matches the vendor’s tier and the data/processes they touch.
Contracts With Leverage. Use contract terms that give you enforceable rights (security, audit, incident notice, subcontractor controls, and termination support) rather than relying on policy language alone.
Continuous Monitoring. Monitoring cannot be an annual checkbox, build a cadence that reflects vendor risk, change events, performance, and control evidence.
Nth-Party Governance. Require visibility into subcontractors and downstream service providers, and document how you evaluate and monitor that extended chain of risk.
Resiliency & Incident Readiness. Demonstrate that critical vendors can sustain operations and that you are prepared for disruptions through clear incident response, escalation, and recovery expectations.
Common MORA/CORE Findings: Vendor Management Program Gaps
Incomplete Vendor Inventory. Reviews frequently surface vendors that were never captured in the inventory (often via procurement gaps or non-PO spend), which undermines the entire lifecycle program.
Weak or Subjective Risk Tiering. If tiering is inconsistently applied or not backed by documented criteria, it’s difficult to justify the level of due diligence and monitoring performed.
Due Diligence Gaps. A common issue is missing evidence, incomplete reviews, or undocumented decisioning, especially when the vendor is high-risk or touches borrower PII.
Expired SOC Reports (and Missing Bridge Letters). An out-of-date SOC report will not pass muster with an auditor. A bridge letter is a formal attestation that controls remained in place and operating effectively since the SOC period ended. Without it, there is no evidence of control continuity.
Weak Contract Protections. Findings often cite missing or insufficient clauses around security requirements, audit rights, incident notice, subcontractor controls, and termination/transition support.
Lack of Nth-Party Oversight. If subcontractors are not identified, assessed, and governed, reviewers will treat it as an unmanaged extension of your own risk exposure.
Poor Ongoing Monitoring. Programs break down when monitoring is sporadic, purely calendar-driven, or not tied to risk and change events.
Key triggers can include failing SLAs, reputational risk, reduction in force at the vendor level, change of scope, and breach issues.
A good example is when a low-risk vendor releases a new product that now requires access to PII. In that case, the risk level should increase and trigger a new risk assessment, followed by a deeper review of the applicable privacy and security controls.
If the controls are not in place, vendor management should notify executive management. The board may still own the decision to proceed, but the organization must be able to defend that decision to an agency auditor. That is where documentation becomes critical.
Weak Issue Management. Reviewers expect issues to be tracked, remediated, validated, and formally closed with evidence, especially for repeat or high-impact items.
Missing Exclusionary List Screening. If screening (OFAC, SAM, FHFA SCP, Freddie Mac Exclusionary List) is not performed, or not evidenced, expect it to be cited.
No Exit Planning for Critical Vendors. Critical relationships require documented transition and data return/destruction planning so the business can continue if the vendor fails or the relationship ends. In fact, Fannie Mae now requires a 180 notice if a lender is changing a critical vendor.
Table Stakes: Required Documentation
Vendor Profile & Ownership. Document who the vendor is, how they are owned/structured, and who is accountable on both sides of the relationship.
Scope of Service. Clearly define what the vendor does, what business process they support, and what systems/data are in scope.
Data Classification. Identify the sensitivity of the data involved (including borrower PII) and align handling, security, and monitoring expectations accordingly.
Risk Assessment & Tiering. Maintain the completed assessment, the tier outcome, and the rationale so it is defensible during review.
Executed Contracts. Keep fully executed agreements and any amendments readily available, with key risk clauses identifiable.
Compliance Acknowledgements. Retain documented acknowledgements of applicable policies and compliance requirements (privacy, security, regulatory, and internal standards).
Monitoring Evidence. Maintain evidence of your monitoring activities (reviews performed, outcomes, follow-ups, and issue tracking) aligned to tier.
Exclusionary List Screening Evidence. Keep proof of screening and re-screening, including timing, lists checked, and results.
Contract Requirements
Data Use Restrictions. Limit how data can be used, prohibit unauthorized secondary uses, and clearly define ownership and permitted purposes.
Security Requirements. Require baseline controls that match the risk and data classification and define how those controls will be evidenced.
Incident Notification. Establish clear timeframes and escalation expectations for security/privacy incidents and operational disruptions.
Audit Rights. Preserve the right to request evidence, conduct reviews, and validate controls, directly or through independent reports.
Subcontractor Controls. Require notification/approval for subcontractors, flow-down of obligations, and visibility into nth-party dependencies.
Termination Support & Transition. Ensure the vendor supports an orderly transition, including cooperation, data return, and continuity needs.
Data Destruction. Define requirements for return and secure destruction of data at termination, including timeframes and evidence of completion.
Organizations that blend operational expertise, modern technology, and a clear understanding of customer needs are best positioned to boost efficiency, reduce risk, and deliver stronger outcomes as the industry continues to evolve. In Part 2, we’ll look at how these trends are shaping the next phase of opportunity—and what organizations can do now to prepare.
This is Part 1 of a two‑part series. Part 2 will examine the tier‑driven controls, AI governance expectations, and geographic risk considerations that distinguish a solid vendor management program from one that is truly audit‑ready. Part 2 will be published on the Stellar Innovations media page.
STEVEN GREENFIELD, CMB
SVP – Mortgage Solutions
Stellar Innovations
Steven.Greenfield@stellaripl.com