Mortgage quality control, explained.

Checking your own loans after promising they are good: mortgage QC in plain words

The life of one sold mortgage, in five steps

1. The loan is underwritten and closedThe Dorseys' purchase closes on Thursday, September 24, at 80% of the $516,000 price.
2. The closing package is completeAll 1,412 pages are in by Friday, October 9: note, deed, disclosures, income and asset papers, appraisal.
3. Quality control reads the fileBefore the sale, if the lender chooses; otherwise only if the loan lands in the monthly sample. This is where the 51.2% debt ratio is found, or missed.
4. The loan is delivered into a poolThe pool settles Wednesday, October 21; the lender's cut-off is the Friday before.
5. The investor may review it tooFannie Mae and Freddie Mac sample purchased loans. A significant defect found then means a repurchase or a costly alternative.

Step 3 is the subject of this guide. The lender, borrowers and figures in this example are fictional.

Four surprises about the post-closing QC sample

Defect, critical defect, post-closing sample, repurchase

Fourteen terms are defined in the one-page summary.

Prefunding reviews, post-closing samples and early defaults: the three places QC meets a loan

In shortAgency QC has two required reviews. A prefunding review checks a sample of loans before closing so production can fix them. A post-closing review re-underwrites a monthly sample after closing to measure quality and report it. Early payment defaults, loans that go seriously late in their first months, get extra attention because they are the likeliest to hide a defect. None of the three is required to cover every loan before it is sold.

Full-file reviews and component reviews

A full-file review re-underwrites the whole loan: the application and the automated underwriting data, income and employment, assets, credit, the appraisal, insurance and occupancy. Fannie Mae requires full-file reviews for the post-closing random sample, and full-file reviews in every prefunding plan.3,5 A component review checks one element, such as income or assets, on more loans than a full review could cover. Fannie Mae describes component reviews as useful for high-risk areas and for testing a new control.5

Random and discretionary selections

Re-verification: asking the sources again

For loans in the random sample, the lender asks the original sources again: employers, banks, the IRS, the credit bureaus, a second appraiser. Fannie Mae lists income, employment, assets, liabilities, valuation and occupancy, and states the consequence plainly: if the answers differ from what underwriting used, "the lender must re-underwrite the loan to confirm its eligibility for delivery to Fannie Mae".7

Some data never needs asking twice. Income or assets validated through Fannie Mae's own validation service, or obtained electronically from an approved vendor, do not have to be re-verified.7 Since April 2026 Fannie Mae has also dropped re-verification for discretionary reviews and for duplicate automated data.8

Five agency rulebooks for one QC plan, and the three that changed in 2026

In shortEvery agency that buys or insures a loan asks for a written QC plan, and each writes its own details. Fannie Mae's Selling Guide chapter D1 is the most detailed; Freddie Mac's is chapter 3402 of its Guide; FHA's is section V.A of HUD Handbook 4000.1; VA and Ginnie Mae ask for a QC system and plan. 2026 brought lighter re-verification at Fannie Mae, lighter appraisal reviews at FHA, and AI governance rules at both GSEs.

How the rulebooks line up

What a 10% random sample can tell you about your defect rate, and what it will miss

In shortA 10% sample is a fair estimate of how often a lender makes bad loans, with a wide margin when defects are rare. It finds only the defective loans it happens to draw. In a month with 14 seriously defective loans among 1,186, a 119-loan sample would most often contain one or two of them, and almost a quarter of the time none at all.

Fannie Mae lets a lender choose between 10% of each month's loans and a statistically valid sample. The statistical route must use "a 95% confidence level with a 2% precision rate" and a six-month statistical statement.3 FHA allows the statistical route only above 3,500 FHA loans a year, and requires the assumed defect rate to come from loans the lender recently reviewed.6

HUD's inspector general has audited exactly that: in March 2025 it found loanDepot's FHA QC program insufficient and recommended up to 1,190 additional post-closing reviews to meet the sample size and composition rules.18

The arithmetic, on one month

Take the fictional Halden Ridge Home Loans: 1,186 loans closed in September, 14 of them with a significant defect, so the true rate is 1.18%. A random 10% sample is 119 loans. How many of the 14 it contains is a matter of chance, and the chances can be calculated exactly.

Suppose the draw is typical and the sample holds two defective loans. The measured rate is 2 in 119, or 1.68%. The 95% confidence interval around that, the range the true rate probably sits in (by the standard Wilson method), runs from about 0.46% to 5.92%: wide enough to include a lender far better or far worse than Halden Ridge really is.

A sample three times as large (357 loans, 30% of the month) holding four defective loans narrows it only to about 0.44% to 2.85%. These are our calculations on the example's figures; the method is standard for a proportion.

Three rules keep that rate honest. Count loans, so a loan with two significant defects counts once. Leave discretionary selections out of both sides, because they were picked for risk. And grade the defect as it stood at delivery, whatever was fixed later.

Where mortgage defects come from: compliance, income, debts, assets and the property

In shortACES' industry benchmark put the critical defect rate between 1.31% and 1.79% of the loans lenders reviewed in each quarter of 2025, with a jump to 1.71% in early 2026 as refinances surged. Compliance defects lead the count; income, debts and assets follow. On loans Freddie Mac actually repurchases, income and the property's condition lead.

The industry's critical defect rate, quarter by quarter

The first-quarter 2026 rise came with a refinance wave. Rates dipped below 6% in February, refinances reached almost 46% of originations, and their share of defects rose to 38.57%.4 ACES' researchers put it this way: "In a lean operating environment, low-frequency procedural steps are precisely the ones most likely to be missed."4 Refinances' share of defects had already more than doubled, from 15.3% in 2024 to 32.2% in 2025, and FHA loans were 30.8% of 2025's defects.20

Which categories the defects fall in

What sends loans back to Freddie Mac

Twelve defects QC teams find again and again

Grading a defect by severity, worked through on one two-unit purchase

In shortA severity scale sorts defects by what they do to the loan's eligibility. Recalculating the Dorsey loan shows how two small-looking choices, counting all of one unit's rent and a deferred student loan at zero, push the debt ratio from 44.8% to 51.2% and make the loan ineligible as delivered. A fee error and a missing gift transfer show the other grades.

Significant, moderate and minor defects

The debt ratio, recalculated

The Dorseys bought a two-unit home and live in one unit. Fannie Mae counts rental income from the subject property at 75% of the gross rent; the other 25% covers vacancy and upkeep.22 For a student loan in deferment with no payment on the credit report, it counts either 1% of the balance or a fully amortizing payment on the documented terms.23

The Dorseys' fees, rechecked against TRID tolerances

Under the TRID rule, fees the lender controls and services the borrower cannot shop for may not rise at all without a valid changed circumstance, re-disclosed within three business days. Recording fees and some third-party services may rise by up to 10% in total. An excess must be refunded no later than 60 days after consummation.17

The Dorsey file also holds an $18,500 deposit backed by a gift letter from Elena's father, with nothing showing the money leaving his account. Fannie Mae requires evidence of the transfer, such as the donor's withdrawal and the borrower's deposit.24 Without the gift, verified assets are $104,880 against $112,940 needed to close: $8,060 short. That is a second significant defect. The $213 fee excess is moderate, because a refund fixes it and the loan stays eligible. The fourth finding, an initial application the loan originator never signed, is minor.

Self-reports, repurchase demands and Freddie Mac's fee pilot: what a defect costs once the loan is sold

In shortA lender that finds an ineligible loan after selling it must tell the agency. The agency can then demand a repurchase or offer an alternative such as a price adjustment, indemnification or a make-whole payment. Freddie Mac closed repurchases of 613 loans, $200 million of unpaid balance, in the second quarter of 2026, fewer than a year earlier, and for sellers in its pilot it charges a quarterly fee in place of buybacks of most performing loans.

Thirty days to self-report a significant defect

Fannie Mae requires a self-report within 30 days of the "date of confirmation", defined as the date the lender publishes its monthly post-closing report to management with the loan in it.1 Suspected fraud or misrepresentation has its own clock: notice within 30 days once the lender has a reasonable basis to conclude it occurred.26 FHA requires fraud and material misrepresentation to be reported immediately, and other material findings the lender cannot mitigate within 90 days of the initial findings report.6 VA asks for "cases involving major discrepancies".15

Repurchase demands and the alternatives to them

For loans sold to Fannie Mae from 2016 on, a significant defect can bring a repurchase demand or an alternative: a pricing adjustment, recourse, indemnification, a mortgage insurance stand-in, a make-whole payment, a loss share or loss reimbursement. The lender may appeal in writing within 60 days of the demand, then go to impasse, management escalation and independent dispute resolution.27

How many loans go back

Milliman's model puts the lifetime chance of a repurchase at 0.252% for a Freddie Mac loan and 0.168% for a Fannie Mae loan of the first-quarter 2026 vintage, both slightly lower than the quarter before. Its authors note these are model estimates, and that income-driven defects and collateral issues account for more than half of Freddie Mac's repurchases.29

Freddie Mac's fee in place of a buyback

Under its Performing Loan Repurchase Alternative Pilot, open to approved sellers nationwide since the first quarter of 2025,30 Freddie Mac keeps most performing loans with significant defects from sellers who opt in, and charges a quarterly fee on the seller's total unpaid balance sold that quarter, set by the share of its sampled loans found "Non Acceptable Quality".31 The QC review itself does not change.

When QC findings became evidence: softened grades, missing self-reports and audits of samples

In shortThe largest mortgage False Claims Act settlements of the last decade turned on what lenders' own QC teams had found and what management did with it. Grades were lowered, self-reports were not filed, and the written record proved it. HUD's inspector general still audits QC programs against the handbook, sample size and self-reporting included.

What the cases have in common

Each failure was a decision about a finding that someone else could read later: a grade changed without a reason, a report not sent, a filter that left loans out of a sample. FHA's handbook defines a mitigated finding as one whose deficiencies have been remedied so the decision to approve "is acceptable to FHA", which is why a cure judged on documents the underwriter never had is an audit finding too.6

Mortgage volume, cost per loan and the refinance swings that QC teams have to absorb

In shortUS lenders will close about $2.1 trillion of single-family mortgages in 2026, about 5.3 million loans, and the mix swings with rates. Independent mortgage banks and bank mortgage subsidiaries in the MBA's survey spent $10,936 to produce each loan in the second quarter of 2026. A fixed 10% sample grows and shrinks with that volume, while the QC team stays the same size.

Volume is the problem a sample cannot solve. Freddie Mac's new business rose to $110 billion in the second quarter of 2026 from $94 billion a year earlier, mainly on refinances.21 A refinance wave like February's swells a QC team's monthly sample with little warning, and the reviews still have to finish inside the same 90 days. Fannie Mae requires written notice if a lender's cycle falls more than one 30-day cycle behind.3

What a QC review costs

No public source publishes the cost of a QC review per loan or the hours a full-file review takes. Lenders know theirs: the QC team's payroll, or the vendor's invoice, divided by the loans reviewed. For a proxy, loan officers, the federal occupation that includes loan underwriters, earned a median $76,690 in 2025,37 and wages are about 70% of what employers spend on compensation,38 so a loaded hour costs roughly $53. Treat that as a starting point for your own pay scale.

Software that re-underwrites closed loans: which QC tasks it can take, and the GSE AI rules it must meet

In shortSoftware can read a closing package, compare it with the loan data, recalculate income, debts and fees, and draft findings with the page behind each one. It can do that on every loan the day the package is complete. The grade, the rebuttal, the self-report and the decision to sell stay with people. Since 2026 both GSEs require a governance program for the AI a lender uses, and Fannie Mae's rules reach AI inside vendor tools.

What the rules say about AI in QC

Freddie Mac has argued for years that automated verification lowers defects: in 2023 it wrote that loans from lenders using its automated collateral, asset and income tools had a 2.3% defect rate against 9.6% for loans without them.40 That figure compares lenders, and gives no period or sample size, so read it as Freddie Mac's claim. The test that matters is your own: run the software on loans your auditors have already reviewed in full, and count what each found.

How to know automated QC works: use the random sample as the yardstick

The random sample is drawn without regard to risk, reviewed in full and re-verified at the source by people independent of production. That makes it the fairest test of any automated review. Compare, loan by loan: findings both found, findings only the auditors found, and findings only the software raised that the auditors rejected. Report the counts by quarter with the number of loans, the way the defect rate is reported.

Three limits hold whatever the software:

• Judgment stays with people: whether a deposit is explained, whether an appraisal's comparables hold, whether a borrower's story is plausible.
• Re-verifications still wait on employers, the IRS and appraisers.
• Responsibility for the review stays with the lender that signs it, whoever or whatever did the reading.13

A QC department today: who samples, who re-underwrites, who rebuts, and why a sampled loan takes weeks

In shortA QC manager draws the month's samples, auditors re-underwrite and re-verify each loan, production rebuts the findings, and the manager grades, reports and self-reports. Most of a sampled loan's elapsed time is waiting: for the month to end, for an auditor, for the re-verifications. Many lenders outsource the reviews and keep the accountability.

Who handles a QC finding, from auditor to secondary marketing

A sampled loan's path from month-end to a final grade

Weeks a sampled loan waits before an auditor reads it

A loan that closed on September 24 and was pooled for October 21 has been sold long before day 50.

In-house auditors, an outsourced QC firm or QC software

The Dorsey file on screen: a stop at check 173, four findings and a cure plan signed before the pool cut-off

In shortThis is the example from the top of the page, inside the product. On Monday, October 12, Renée Castellano, the QC manager, opens September with 1,185 of 1,186 loans already reviewed. The last file runs through the script, stops on a significant defect at check 173, shows the pages behind it, and finishes with four findings. Owen Mthethwa, a senior QC auditor, confirms them, and Renée signs a cure plan due a day before the pool's cut-off.

1

Every September loan, beside the 10% a sample would read

Each square is one of the month's 1,186 loans, colored by its worst grade: 1,021 clean, 118 with minor findings only, 33 moderate, 14 significant. The Dorsey loan is the last square still running.

Pressing 10% sample dims every loan a random sample would not have drawn. The panel says what that would mean: 119 loans, reviewed by about day 75, after the October pools settle, holding 2 of the 14 significant loans.

2

The script stops at check 173 of 386

The file is 1,412 pages and 186 documents. The checks run in nine parts, each headed by the agent that runs it, and each row shows the value read and the page it came from. They run green through the note, the credit report and the liabilities until the qualifying ratios turn red: debt-to-income 51.2% recalculated against 44.8% approved.

The stop card shows the arithmetic, income from $13,370 to $12,770 and debts from $5,989.33 to $6,538.23, with a link to the page behind each cause and the grade: significant, not eligible for sale as closed, curable.

3

One click opens the page behind the number

Renée opens the lease for unit B. The rent, $2,400 a month, is highlighted on page 1. The transmittal counted all of it; Fannie Mae counts 75% of gross rent. A second link opens page 4 of the credit report, where Elena's $54,890 student loan is deferred to January 2027 and was counted at $0.

The screens cite the rental-income rule by its former number, B3-3.1-08. Fannie Mae moved it to B3-3.8-02 on September 2, 2026,22 and its revised rental-income policies are required for applications from December 1, 2026;41 both versions count 75% of the gross rent on a purchase.

4

The whole file, graded, waiting for an auditor

Renée continues the script to the end: 386 checks, 375 passed, 9 failed, 2 to review, in 2 minutes 6 seconds of agent time. The loan review shows the six agents' run step by step and four findings: two significant (the debt ratio, and an $18,500 gift with no proof of transfer), one moderate ($213 of fees over tolerance) and one minor (an initial application the loan originator did not sign).

Owen Mthethwa reads each with its evidence and confirms all four. A rebuttal would go back with its reason.

5

A cure plan timed to the pool

With every finding confirmed, Renée signs the cure plan: correct the rental income and re-run the automated underwriting by Wednesday, October 14; refund $213 with a letter and a corrected Closing Disclosure, and get the donor's statement for the gift, by Thursday, October 15. The pool cut-off is Friday, October 16.

Tasks go to Caleb Ruiz in underwriting, Mei-Lin Ostrander in compliance and Brett Sayer, the loan officer. Done on time, the loan goes back into the October 21 pool.

The solution's design targets are every closed loan reviewed before sale, and a graded loan within two days of a complete closing package. They are targets, to be measured on your own loans. In the sample data, the median from complete package to graded loan was 1.4 days.

Eighteen screens behind the QC month: findings, cures, pool holds, re-verifications and the signed report

In shortOne loan is the story. These screens show the rest: the script running and its failures, each finding's evidence and arithmetic, the cures, every loan by category and grade, the auditors' queue, the October pools and their holds, the re-verifications, the trends behind the defects, the monthly report and the lender's own QC plan.

Select a screen to open it larger. The lender, borrowers, people and figures are fictional. Three September loans could not be cured; the delivery screens send two to the portfolio desk and one to fraud review, so none of them goes into an agency pool. The screens cite the rental-income rule by its former number, B3-3.1-08; it is now B3-3.8-02.22

Who reads the file and who signs: six QC agents, an auditor on every finding, a manager on every release

In shortEach agent has one job and limits it does not cross. None of them changes loan data or an underwriting decision, contacts a borrower, sends a cure or releases a loan. A QC auditor confirms or rebuts every finding; the QC manager signs cure plans, releases held loans and signs the monthly report; the agency random sample is still reviewed by people and measures the agents.

Loan file reader, defect grader and four more QC agents

Auditors confirm findings; the QC manager releases and signs

The agency random sample is still drawn, re-verified and reviewed in full by auditors, independent of the agents. On the sample data from July to September, auditors confirmed 97.8% of the agents' findings on it and found two the agents missed, both minor. Agent steps and human decisions are kept apart on the audit trail.

Renée Castellano's QC team in the September sample

The closing packages and QC plan it reads, and the grades, cures, holds and reports it produces

In shortIt reads the closing packages and loan data you already have, under your own QC plan, and leaves behind every loan graded with its findings and pages, cures with owners and dates, the loans held from each pool, defect trends with their causes, and a monthly report ready to sign. Your origination system stays the system of record.

Systems a pre-sale QC review connects to

For each, check whether it has an API, a file feed or only screens, and who owns it.

Three QC rules on finding pages, pool holds and sign-off

What a defect found after the sale costs you, and where your own numbers are hiding

In shortStart from your own data. No public source gives the cost of a QC review or the full cost of a defect found after sale, so the numbers that matter are yours. A few published figures frame them: the industry's defect rate, how many loans Freddie Mac still sends back, and what a loan costs to make in the first place.

Where repurchase losses and late cures hide in your books

Defect costs the QC calculator leaves out

Pricing every-loan review: cures before sale against auditor hours and the software's cost

In shortPut in your own numbers. The calculator starts from the industry's published defect rate and a proxy hourly cost, and asks you for the rest: how many loans you close, how many significant defects could be cured before sale, what a defect left in a sold loan costs you, and what your sample reviews take. Every default marked illustrative is an assumption to replace.

Six ways every-loan QC review pays back

Your return from reviewing every loan before sale

At these defaults the sample alone releases 4,200 auditor hours, worth $222,600, which nearly covers the illustrative software cost before any cure is counted. A lender closing 2,000 loans a year at a 1% defect rate has 20 significant defects to work with, and should model that honestly before buying anything.

Is your QC department ready to review every loan before sale? Score your baseline, holds, plan and AI governance

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What your QC readiness score says to do next

Seventeen questions for a mortgage QC software vendor or outsourced QC firm, and the answers that should worry you

In shortAsk every vendor the same questions, us included. The answers show what the review reads, how it grades, what evidence you keep, whose plan it follows, and how you would measure it on your own loans.

We found no published independent test of any mortgage QC vendor's accuracy, as of October 2026. A side-by-side test on loans your auditors have already reviewed is the fairest comparison, and the same test measures your current process.

A twelve-week QC pilot: back-test a month your auditors already reviewed, then run every loan live

In shortMeasure first, then run every loan in a month alongside your normal QC, then decide with four numbers. Your random sample stays exactly as it is and becomes the yardstick. None of these steps commits you to a vendor.

1. Pull your baseline: four quarters of top-grade defect rates, findings by category and branch, repurchase demands and losses, days to a published report.
2. Agree the hold: with secondary marketing, which findings hold a loan and who releases it.
3. Back-test: run a recent month your auditors already reviewed, blind, and compare the random sample loan by loan.
4. Run live on one month's closings, every loan, with auditors confirming each finding and your sample reviewed as usual.
5. Decide with four numbers: findings both found, missed, rejected; days from package to graded loan; loans cured before sale; auditor hours.

Pilot measures: auditor agreement, missed defects, days to grade

Mortgage QC questions people ask: sampling, defect rates, self-reports and repurchases

In shortThe questions QC teams and buyers search for most, each answered on its own.