We’re going to take a little break from the numbers for a moment to talk a bit about third and fourth party liability.  Vendor management.  By now, most lenders understand that the CFPB has proclaimed it’s holding them accountable for the actions of their “service providers.” It’s probably why your vetting and oversight policy manual has quintupled in size in the last year.  (Wait.  You don’t have a manual…?  That’s a blog for another day.)  We’re going to assume that at least most of you have tightened up the process for choosing a title company well beyond the days of the single question qualifier—“Do you serve the market where the property in question is?”

The next step in this discussion is one that’s, by now, likely familiar to you.  We’re confident you’ve got your scorecards in place.  Perhaps you conduct site visits from time to time, checking traffic patterns, server locations, clean desk policies and the like. You undoubtedly ensure that your service provider has escrow reconciliation procedures in place to prevent fraud and theft. 

But do you ask that service provider what it does to vet and oversee its contractors?  Do you know how comprehensive its policies are?  When a contractor breaks policy, what does your service provider do about it?  Does it even know the breach happened?

We’ve hopefully already established here that the actions of your title and closing professionals have a direct impact on what your borrowers think of you.  So why, in this day and age of extreme oversight and accountability, would anyone trust a customer to the vendor of a vendor without knowing something about that fourth party?  Or maybe A LOT about that fourth party?

There are a number of things a third-party service provider (in this case, the title agency) should be doing to vet and manage a fourth party service provider (here, the notary or closing professional) on behalf of its lender client.  First and foremost, having a dedicated employee or team to manage and execute that process (rather than making it a part-time endeavor for someone with other responsibilities) is highly recommended.  The requirements of the fourth party provider should also be crystal clear (training, written procedures and requirements and so forth).

In fact, documentation is a critical element of management and oversight.  Document your policies.  Document the consequences if policies aren’t followed.  Document each and every deviation from policy and what remedial action was taken.  Similarly, how the third-party service provider identifies mistakes or deviations from the fourth party requirements is critical, too.  It’s not enough to assume that the dedicated team will take action if they happen upon an error.  Instead, there should be procedures in place (reporting, QC, etc.) that systematically red flag each and every instance in which a fourth party provider fails to operate within guidelines as well as proscribed actions to be taken when such red flags go up. 

If your third-party service providers aren’t following a similar protocol anywhere there might be risk, ask why.  There may be a good reason, or there may be a good reason to terminate them. Just remember, when it comes to vendor oversight, ignorance is anything but bliss!