KPMG Portrait Report Word Template Full Cover Option 1

122 Pages·2017·12.07 MB·English

by  Patwardhan, Aditya

ANZ.800.321.0092
^
_ LuL

ADI Targeted Review for 2016/17

Accuracy of data used in home loan underwriting

Date 28 April 2017

kpmg.com.au
ANZ.800.321.0093
Jennifer Evans
CRO Australia
Australia and New Zealand Banking Group Limited
ANZ Centre Melbourne
Level 9, 833 Collins Street
Docklands VIC 3008
28 April 2017
Dear Jennifer,
Reasonable assurance engagement in relation to Australia and New Zealand Banking Group
Limited's Home Loan Underwriting Process
At the Australian Prudential Regulatory Authority's ("APRA") request, we have performed a
reasonable assurance engagement over Australia and New Zealand Banking Group Limited's
("ANZ") policies, procedures and controls to ensure that borrower financial information
received and captured as part of the Home Loan Underwriting process is complete and
accurate in ANZ's systems. The engagement was performed in accordance with ASAE 3150
Assurance Engagements on Controls issued by the Auditing and Assurance Standards Board
with respect to reasonable assurance engagements and covered home loans throughout the
period of 1 October 2015 to 30 September 2016. We are pleased to enclose a copy of our
report.
Please contact me if you have any questions or require further information regarding our
engagement or this report.
Yours sincerely,
Martin Wardle
Partner
cc: Brendan Scarra (APRA)

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0094
Or^
■Q
s
u LU
1. Executive summary 1
2. Scope and Approach 17
3. Process and control assessment and detailed results 22
4. Other matters 66
Appendices 70
Glossary 118

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0095
xecutive summary

ntroduction
At the Australian Prudential Regulatory Authority's ("APRA") request, we have undertaken a
reasonable assurance engagement over the policies, procedures and controls Australia and
New Zealand Banking Group Limited ("ANZ" or "the Bank" or "the ADI") has in place to
ensure that borrower financial information captured during the home loan underwriting
process is complete and accurate. Our work included assessing the design and operating
effectiveness of relevant controls throughout the period of 1 October 2015 to 30 September
2016.
Specifically, our review has covered the completeness and accuracy of data used in the
serviceability calculation for residential mortgage loans originating in Australia. The detailed
scope of our review was contained in APRA's letter to ADIs dated 12 October 2016 (refer
Appendix 1). Our scope and approach is set out on pages 17 to 21 of this report.
This report has been prepared for the Directors of ANZ and APRA for the purpose of
providing an assurance conclusion on the controls subject to assurance and may not be
suitable for another purpose. We disclaim any assumption of responsibility for any reliance
on this report, to any person other than the Directors of ANZ or APRA, or for any other
purpose than that for which it was prepared. Our prior written consent is required before our
name is quoted in any material published by ANZ or APRA.
1 Summary of findings

1.1 Exceptions and findings

As part of our testing of the operating effectiveness of controls, we undertook a detailed
review of a sample of 418 loan files. We had 138 separate observations from our file
reviews. 68 of these observations relate to incomplete or incorrect borrower financial
information used in the Bank's assessment of the home loan, with 24 of the 68 due to
incomplete borrower income being recorded as a result of the Bank's practice of only
verifying income to the extent necessary to demonstrate that uncommitted monthly income
(UMI) is positive. In 10 of the 68 cases there would have been negative UMI had the correct
financial information been used (in the absence of further income being verified), potentially
indicating that the borrower's income would be insufficient to meet their expenses and loan
repayments.
Other findings from our file reviews included three files which could not be provided to us
and a number of other observations, including missing documentation, the use of credit
approval discretion (CAD) to approve loans without standard income verification documents,
conditions precedent not being met at fulfilment, data keying errors and observations on
systems and processes.

KPMG | 1

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0096
In addition to our loan file reviews, we assessed the design and operating effectiveness of
controls by undertaking walkthroughs of processes with ANZ staff, and tested a number of
manual and IT system controls.
We have summarised our findings from loan file reviews and assessment of the bank's
processes and controls into 12 key findings. These include control weaknesses, thematic
root causes of the errors we found and systems limitations. These 12 findings and our
recommendations are included below in section 1.4 of this executive summary. We have
rated our findings A, B or C depending on our assessment of the impact they have on the
relevant control's ability to meet the control objective. Rating A is for findings that have the
least impact and rating C is for findings that have the most impact. KPMG Audit Issues
Ratings are defined in Appendix 8. We have summarised the categories of findings in the
table below. Full details of the results of our file testing are set out in section 3.5 Testing
Results of the main body of this report and Appendix 5.
Category Rating A Rating B Ratin
Observations on the design and operating effectiveness of controls 1 6
Thematic observations arising from individual loan file testing 3
Other observations and current systems limitations 2
A key driver of the number of findings on individual loan files is the highly manual nature of
the systems and loan assessment process, which makes it prone to error. There are three
loan origination systems. CAP and RLS are used to capture and process loans originated
through the Bank's Proprietary channel and MOS is used for broker and mobile originated
loans. Other than for a proportion of loans originated through branches which are auto-
approved or auto-declined, information must be re-keyed during the approval process, with
loan assessors using a number of off-system tools. There are also a number of systems
limitations which require manual workarounds.
In addition to the 12 key findings, we have identified three efficiency observations in the
home loan application process which relate to systems limitation or process duplication.
More specifically, there are a number of quality assurance processes over the completeness
and accuracy of loan files and compliance with policy. Three of the files in which we found
errors had been subject to quality control review, which had failed to identify the errors. This
indicates that there is an opportunity to streamline the reviews and improve their focus and
effectiveness. Our efficiency observations are in section 4.2.
1.2 Reasonable assurance opinion

As noted above, our review was structured as a reasonable assurance engagement. As a
result of the number of exceptions noted during our detailed review of loan files, we have
qualified our opinion for the key controls in place to achieve the following objectives:
• The income and expenses declared by a mortgage borrower and required by the ADI's
serviceability assessment is accurately stated; and
• The assets and liabilities declared by a mortgage borrower and required by the ADI's
serviceability assessment are accurately stated.
Our qualified opinion is included in Appendix 6.

KPMG | 2

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0097
1.3 Benchmarking to best practice

During our assessment of ANZ's processes and controls, it was clear that there are a
number of inherent challenges in banks verifying customers' financial information. To
establish current and emerging best practice in addressing these challenges, we spoke to
other KPMG teams in Australia and overseas. It is important to understand that these
practices have often evolved in very different regulatory, social and legal frameworks and
certain aspects may not be appropriate for the Australian market.
General observations
International practice varies considerably and the industry is in transition from manual and
paper based application processes to online, digital processes. However progress made and
the approach taken in each country and institution differ. The motivation for change is driven
by a range of factors,including a desire to improve the customer experience, reduce
processing time and cost, and improve decision making and credit quality. We have also
observed that banks design their home loan application processes to fit their particular
business profile and risk appetite, and as such there is no one size fits all model. Many
banks will have more stringent verification processes for higher risk loans, or at least those
outside their main target profile.
The degree to which regulators provide guidance or mandate certain aspects of the loan
underwriting process also varies. For example, in Singapore, the MAS mandates certain
affordability ratios, haircuts to be applied against certain types of income and minimum
documentation to be obtained to support income. In the UK, whilst the regulation does not
mandate how income should be verified, there appears to be an expectation from the FCA
that banks check income to paper documents.
The clear trend, however, is towards sharing of customer transactional data between
institutions to enable verification and modelling of income and expenditure electronically.
This obviously requires an industry wide solution and raises questions and challenges around
customer privacy, permission and authentication. The degree to which other bodies, such as
tax authorities and employers, contribute to data sharing varies and this is to a degree driven
by what the public deem to be appropriate and acceptable in each market. In the US, third
party providers are able to aggregate employment information, information from the IRS and
bank transactional data. In the European Union, the Second Banking Payments Services
Directive (PSD 2) will facilitate the sharing of banks' transactional data by requiring banks to
allow secure access to consented third parties who need to access information from a
customer's account.
ANZ has recognised the challenges in verifying customer financial information and the need
to automate the credit assessment process and digitise and improve customer experience.
There are a number of projects which are at various stages of consideration/ development.
Two of the key initiatives are:
• Common Decision Platform (CDP) - a new automated credit decisioning platform across
retail products, with improved information and stronger control over system based rules;
and
• Standardised Statement of Position - this will have greater granularity and consistently
defined fields, with more sophisticated use of transaction data for ANZ customers and
potentially for non-ANZ customers through access to shared customer transactional data
subject to industry-wide initiatives being adopted.

KPMG | 3

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0098
The table below summarises our main observations on ANZ's current practice, a comparison
with best practice, and recommendations. Some of these recommendations will require an
industry level response and strategic solutions. Where these solutions cannot be achieved
within a reasonable timeframe, we recommend that the Bank implement temporary
solutions pending the implementation of sophisticated technology or industry wide
solutions. We have provided some example tactical solutions. These should be given careful
consideration taking into account the balance of improved control compared with the cost
and operational challenges, together with the risk of diverting resources from developing
longer term solutions.
Income
ANZ Policy Currently, to verify a customer's employment income ANZ generally requires a customer
to provide one payslip that evidences a minimum of three months continuous pay unless
they are an ANZ customer who has their income paid into an ANZ account. For these
customers ANZ relies on the salary credit as evidence of income.
Best Practice From our inquiries, best practice is that the controls over the verification of income
should be designed to cover two main objectives:
- to determine that income has been stable over a reasonable period, which will
enable the Bank to understand the nature and potential variability of the income;
and
to confirm that the customer is still employed at the date of application, which
should address the risk of the customer providing fraudulent evidence.
In the US, customers are required to demonstrate income stability over a period of
two years and in the UK customers provide payslips covering the previous three
months. In the US, banks will obtain confirmation of employment and salary directly
from a customer's employer and it is also becoming standard for banks to confirm
income directly with the IRS. As discussed above, third party providers are also acting
as aggregators to obtain information from employers, the IRS, and transaction data
from other banks.
In the UK, some banks obtain direct confirmation from employers for certain loans,
although we understand this practice has been declining. The trend is for banks to
seek to verify income electronically through access to shared current account data.
We understand that for this to be the sole method of verification without sight of
payslips and tax returns, there would need to be a change in regulator expectations.
Banks in a number of countries surveyed routinely ask customers to provide tax
returns and employer provided annual income summaries, which are produced for tax
purposes.
KPMG Industry level:
Recommendation
• An industry-wide response should be encouraged. This could be based on sharing of
bank transactional data for current accounts to enable salary credits to be verified
electronically. Although the risk will be reduced, consideration will still need to be
given to the challenge of whether this could sufficiently address the risk of whether
an applicant is still employed. This risk could be reduced by allowing employers to
contribute data with a customer's permission or by requiring separate confirmation.
There will be an inevitable risk/cost/customer experience trade-off, which should be
considered at an industry level.
• Even where banks are able to verify salary credits electronically, they will need to
develop policies and procedures on how to respond to identified variability or other
unusual trends.

KPMG | 4

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0099
Income
KPMG ANZ Specific:
Recommendation
If an industry level solution is unable to be achieved within a reasonable time, the Bank
(Continued)
could consider developing an appropriate interim solution. In our view a reasonable
interim solution could involve the following activities:
ANZ could consider asking all home loan applicants, including existing customers, to
provide payslips covering at least the last three months as well as annual employer
income summaries and tax returns for, say, the previous two or three years.
Employer income summaries and tax returns help to corroborate payslips, potentially
reducing fraud risk, and also provide insight into employment history.
ANZ could ask applicants to provide recent bank statements for their main transaction
accounts and agree salary credits from payslips to these statements
We recognise that none of the above procedures provide proof of continual
employment. Additional guidance could be provided to loan assessors to require them
to review recent current account activity to identify cases where salary credits have
reduced or ceased.
Other Comments:
• In our findings we note that ANZ only verify sufficient income to ensure UMI is
positive. In our view, this is sufficient for serviceability purposes. We note that due to
the scope of our targeted review being to assess that controls are designed to ensure
the completeness of income, we have had to conclude that the design of this control
is ineffective to meet the objective. We do not make recommendations in this regard.
Liabilities
ANZ Policy Loan applicants are required to provide details of existing credit commitments on a
statement of financial position. For ANZ liabilities, the bank is able to check the
accuracy and completeness to its systems. However, for non-ANZ liabilities, there is
an inherent difficulty in verifying this information and the bank is reliant on the
customer.
Best Practice It is clear that Australia is an outlier in not having positive data Credit Bureaus. Overseas
best practice is for banks to undertake searches with all available Credit Bureaus to obtain
a complete picture of a customer's liabilities.
KPMG Industry level:
Recommendation
• An industry-wide response is required to share positive credit data so banks can get
complete and accurate information on a customer's credit liabilities.
• We note that with the implementation of ANZ's new decisioning system, CDP, for
ANZ customers the system will be able to identify transactions through ANZ accounts
which may indicate the existence of other liabilities. These will then be referred to the
loan assessor or frontline lender for further investigation.
ANZ Specific:
If ANZ's strategic initiatives and/or an industry level solution is unable to be achieved
within a reasonable time, the Bank could consider developing an appropriate interim
solution. In our view a reasonable interim solution could involve the following activities:

KPMG | 5

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0100
Liabilities
KPMG For non-ANZ liabilities stated on the statement of position, customers could be
Recommendation required to provide documentary evidence of the balance, such as a recent
(Continued) statement.
In order to address the risk that a customer has under-stated their liabilities, in the
absence of positive data sharing, ANZ could ask customers to provide statements for
their bank transaction accounts and credit cards. Branch staff and/or loan assessors
could then review these for any payments to finance companies which might indicate
the existence of additional liabilities. Any such payments could be referred to obtain
clarification and evidence from the customer.
We note that this would not provide absolute assurance, however would go some
way to mitigating the risk of customers understating liabilities.
Expenses
ANZ Policy Loan applicants are required to state their monthly expenses on the statement of
financial position. Monthly expenses are broken down as follows: Credit
commitments, rent/board, insurances, child maintenance, general living expenses,
and 'other'.
Credit commitments are verified for ANZ liabilities but are subject to the same
limitations for non-ANZ liabilities, as outlined above. Other expenses such as
rent/board and insurance are not verified to external evidence.
"Other" general living expenses are not further broken down. They are not verified as
such, but are compared with an income-linked Household Expenditure Measure
("HEM"), and ANZ adopts the higher of the two amounts. A key determinant of the
HEM is the number of dependants a customer has,

We note that ANZ is in the process of establishing a standardised statement of
position with greater granularity and consistently defined fields. The Bank is also
investigating the sharing of transactional data with other banks to enable them to
model customers' expenditure.
Best Practice In a number of countries, including the US, banks do not seek to verify or estimate
living expenses as a matter of course. Instead, banks verify all credit-related monthly
commitments including mortgage repayments, and these must then be less than a
certain percentage of a customer's gross income.
In Singapore, this ratio is set by the regulator and in the US through underwriting
standards required by the mortgage securitisation bodies.
In the UK, the traditional approach has been to obtain a more detailed breakdown
from the customer and to agree this to supporting evidence. It is common practice to
obtain bank statements from customers. In fact we understand that mortgage
application forms in the UK are lengthy, with many more data fields captured than in
Australia, enabling banks to seek to detect undesirable risk profiles for further
investigation. They also adopt a HEM-like measure based on government provided
data as a means of identifying where expenses fall outside a reasonable range.
The clear trend, however, is towards the use of automated tools to model expenses
from current account and credit card transactional data. In the US, banks are
developing these tools to support the methodology outlined above, and banks are
sharing data to enable third party providers to provide them with this analysis. In the
UK, we are aware of one bank using shared transactional data provided by Experian to
model expenses and others are trialling this.

KPMG | 6

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential
ANZ.800.321.0101
Expenses
KPMG Industry level:
Recommendation
• We support ANZ's initiatives to develop a more granular standardised statement of
position and modelling of customer expenses from shared transactional data, and this
should be encouraged across the industry.
ANZ Specific:
If ANZ's strategic initiatives and/or an industry level solution is unable to be achieved
within a reasonable time, the Bank could consider developing an appropriate interim
solution. In our view a reasonable interim solution could involve the following activities:
ANZ could ask customers to provide a more detailed breakdown of expenses. This
would provide ANZ with greater insight, and assist customers in ensuring stated
expenses are complete and accurate.
ANZ could ask customers to provide documentary evidence of their major expenses.
A policy would need to be developed as to which expenses could be verified, but
these might reasonably include rent/board, insurance, child maintenance, school fees,
essential travel, non-essential travel, childcare and TV subscriptions. Evidence could
include, for example, receipts or transactions evidenced on bank statements.
In order to address the risk that customers fail to disclose major items of expenditure,
ANZ could ask customers to supply bank statements for their main transaction
accounts as well as credit card statements. Bank staff could undertake a high level
review with the aim of identifying undisclosed major expenses or credit
commitments.
Bank statements could also be reviewed for general account conduct to identify
where there are any obvious inconsistencies between a customer's stated expenses
and transaction history, or any general indicators of financial stress.

KPMG | 7

©2017KPMG,anAustralianpartnershipandamemberfirmoftheKPMGnetworkofindependentmemberfirmsaffiliatedwithKPMGInternationalCooperative

("KPMGInternational"),aSwissentity.Allrightsreserved.TheKPMGnameandlogoareregisteredtrademarksortrademarksofKPMGInternational.

LiabilitylimitedbyaschemeapprovedunderProfessionalStandardsLegislation.

DocumentClassification:KPMGConfidential