Last week, Stellar Innovations shared the foundation of a MORA/CORE ready vendor management program what Fannie and Freddie expect, the most common findings that surface during reviews, and the table stakes documentation and contract protections every program needs.
This week we go a level deeper. Once the foundation is in place, what separates a good vendor management program from one that can confidently withstand agency scrutiny? Tier driven controls, emerging risk areas like AI governance and geographic concentration, and perhaps most importantly, reading the documentation you collect. Here’s what a mature, audit ready program looks like in practice.
Tier-Driven Add-Ons
SOC Reports (Reviewed) & Bridge Letters. For applicable vendors, obtain SOC reports, document your review, and collect bridge letters when reports are expired to evidence control continuity.
Security Questionnaires. Use questionnaires to validate control maturity where independent assurance is limited, and document follow ups on gaps.
Privacy / Data Flow Mapping. Map how data moves between parties and systems so you can validate storage locations, access, retention, and downstream sharing.
Financial Review. For critical vendors, assess financial health and viability to reduce disruption risk and support resiliency planning.
BCP/DR Evidence (RTO/RPO). Obtain and review business continuity and disaster recovery evidence, including stated recovery time and recovery point objectives, and confirm they align to your operational needs.
Access Controls. Validate how access is granted, reviewed, and removed, especially for privileged access and administrative functions.
Nth-Party Inventory. Require a current list of subcontractors supporting the service and assess material changes over time.
AI Governance & Disclosures. If the vendor uses AI/ML (including embedded features), document where it’s used, what data it touches, and how it is governed and monitored.
Ongoing Exclusionary Re Screening. Re screen vendors at a defined cadence and upon key events, and retain evidence to support audits and reviews.
Emerging Risk Areas
AI Governance
AI governance is now required. If AI/ML is used, organizations must maintain full lifecycle controls and vendor oversight, including for embedded AI in vendor tools.
Freddie Mac was the first to issue AI governance expectations, with Fannie Mae recently releasing its own guidance. Because this is a relatively new area, vendor management, compliance, risk, and information security teams need to be aligned and take stock of vendors that may be leveraging AI or machine learning.
Vendors with AI in their business name are easy to identify, but the larger risk may sit below the waterline with vendors using AI enabled capabilities inside otherwise familiar tools. Where data goes, how it is used, and how it is governed can quickly open a Pandora’s box.
Key source references (keep handy for audits). Freddie Mac Single Family Seller/Servicer Guide, Section 1302.8 (Use of artificial intelligence and machine learning). Fannie Mae Lender Letter LL-2026-04 (Governance framework on use of artificial intelligence and machine learning). Also note FHFA Advisory Bulletin AB 2018-08 (Oversight of Third Party Provider Relationships) as the overarching baseline for third party oversight expectations.
Location, Location, Location
Where you do business matters, and who you do business with and where that business is conducted matters too. In MORA and CORE reviews, agencies may ask for the city and country for offshore, nearshore, and onshore vendors.
Geographic location risk is another pillar of vendor management. Ask a vendor in a weather-prone state how it operates during hurricane season and you will quickly see how delicate service levels and business continuity plans can be.
Multiply that exposure across vendors in the same location and you have identified geographic concentration risk. This may not be a common consideration during vendor selection, but it is worth reviewing when a vendor is critical to day to day operations.
Those fourth parties and sub processors matter as well. Knowing who they are is important; knowing where they operate can also help when you are in front of an auditor.
Note that location is equally important when it comes to data privacy. There are numerous data privacy laws in effect and with the industry adopting a somewhat global workforce, data privacy and competing regulatory requirements are also important for consideration.
Read the Documentation
We are all in this together. Vendors want to do a good job, and clients want to protect their data while achieving best in class service from their vendor panels.
The biggest betrayal in vendor management today is asking for documentation from a vendor, using it as a check the box exercise, and never actually reading it.
Sooner or later, an auditor will ask for evidence of review. If findings are skipped over, the vendor management program will be weakened no matter how compliant the policy looks. Worse, unaddressed risk may become a larger issue affecting operations and business reputation.
Summary
As stated, vendor management is a fluid discipline, for every new product or service being released to the market there are likely other risks attached to it that aren’t immediately front and center. Shiny objects do that after all! After building out a vendor management program, review often and keep up to date with the seller guidelines around third-party oversight, specifically the Fannie Mae Selling Guide and the Freddie Mac Single Family Seller/Servicer Guide, because they are a gold mine of enforceable expectations and audit language. As Fannie and Freddie issue industry wide findings of gaps, these can be used to review and update your existing program. Vendor Management works best with a proactive, curious and risk-based mindset.
Anything less will keep you on the backfoot.
If you missed Part 1 of this series, it covers what Fannie and Freddie expect from a vendor management program, the most common MORA/CORE findings, and the table stakes documentation and contract protections every program needs — read it here: Vendor Management: Leveraging Audit Findings to Strengthen Your Third-Party Risk Program – Part 1 – Media – Stellar Innovations.
STEVEN GREENFIELD, CMB
SVP – Mortgage Solutions
Stellar Innovations
Steven.Greenfield@stellaripl.com