Are You Following ALTA Best Practices?

The American Land Title Association (ALTA), the national trade group of the land title insurance industry, recently announced it has expanded the availability of its Best Practices Framework resources to non-members. Title agencies can use the framework to demonstrate compliance to lenders, who need to meet regulatory requirements regarding oversight of their third-party service providers (e.g., title agencies). Law firms that have a title agency and those that are considering adding one in the future should be aware of ALTA Best Practices.

Although the framework is voluntary for title companies and there are currently no financial penalties for non-compliance, title agencies who follow the guidelines may find it easier to retain and grow their lender relationships than those who opt to not follow the recommended framework.

Lenders have to comply with Consumer Financial Protection Bureau (CFPB) and other regulatory requirements regarding oversight of their third-party service providers, which include title companies. In Bulletin 2012-03, the CFPB emphasized its expectation that mortgage lenders manage the risk of their service provider relationships in order to protect consumers from financial harm.  The ALTA Best Practices Framework outlines Assessment Procedures for title agents to help determine and demonstrate their compliance to lenders.

Lenders backing ALTA Best Practices

Some major lenders, including Wells Fargo and SunTrust, have already endorsed the ALTA guidelines as a way for title agencies to show that they have policies and procedures in place to be in compliance with Federal consumer financial law.

SunTrust issued a letter to its settlement service providers earlier this year saying that it will require them to complete an ALTA Best Practice Self-Assessment in order to remain eligible to close loans for the financial institution.

Wells Fargo announced its support of the ALTA Best Practices Framework last year. At that time, the lender encouraged agencies that were not already following the guidelines to put a plan in place for adoption. That plan, the lender said, should include written policies and procedures to document implementation and inspection processes to validate it.

Another mortgage lender, BancorpSouth, addressed a letter to its approved closing attorneys in March announcing that it is now requiring all closing agents to adhere to ALTA Best Practices. What’s more, BancorpSouth is requiring that the agent’s adherence to the ALTA Best Practices is verified by an independent third party, such as a qualified accounting firm.

7 Best Practices Pillars

Completing a readiness assessment or having one performed by an accounting firm can help a title company to initially identify existing deficiencies. If compliance gaps exist, they should be addressed before the company completes a full self-assessment or engages an independent third party to provide an additional level of assurance.

Once the pre-assessment has been completed, the next step for title agencies looking to comply with the ALTA Best Practices Framework is to complete a self-assessment. The Assessment Procedures and related documents are available through the ALTA website.

The ALTA framework focuses on seven key best practices pillars:

1. Licensing: Establish and maintain current license(s) as required to conduct the business of title insurance and settlement services.
2. Escrow Trust Accounting: Adopt and maintain appropriate written procedures and controls for Escrow Trust Accounts allowing for electronic verification of reconciliation.
3. Protecting NPI: Adopt and maintain a written privacy and information security plan to protect Non-Public Personal Information (NPI) as required by local, state and federal law.
4. Settlement Processes: Adopt standard real estate settlement procedures and policies that help ensure compliance with Federal and State Consumer Financial Laws as applicable to the Settlement process.
5. Policy Production: Adopt and maintain written procedures related to title policy production, delivery, reporting and premium remittance.
6. Insurance Coverage: Maintain appropriate professional liability insurance and fidelity coverage.
7. Consumer Complaints: Adopt and maintain written procedures for resolving consumer complaints.

Title companies can assess their compliance with each of these seven best practices, by using the ALTA Best Practices Framework Assessment Procedures. The assessment includes 32 procedures that are marked with an asterisk (*) to indicate that they are required and that a “fail” on that particular assessment procedure will result in a “fail” for that particular best practice. Therefore, careful attention needs to be given to the specific requirements within each of the seven best practice areas.

For example, ALTA Best Practices require that if a title company provides one of its vendors with NPI or access to NPI, the title company needs to obtain evidence that it conducted due diligence procedures in selecting the vendor. That due diligence process should include an assessment of the vendor’s information security controls and security posture. Furthermore, for its established vendors, the title company should have some controls in place to monitor the vendor’s security procedures that are designed to safeguard the company’s customer information. Those controls could include reviewing the results of audits, security reviews or tests, intrusion logs or other evaluations.

Assessing policies and procedures

Implementing ALTA Best Practices requires commitment and, in certain cases, making changes to your operations. In order to comply, title agencies will need to have a set of written policies and procedures that support ALTA Best Practices pillars.

At a minimum, management may want to consider documenting and implementing policies and procedures surrounding the following:

• Escrow trust accounts
• Hiring and training
• Wire transfers
• Real state settlement
• Title policy production, delivery, reporting
• Consumer complaints

One of the main areas of focus in the ALTA assessment is information security. For example, ALTA Best Practices require a documented security risk assessment, which looks at, among other things, the risk ranking of information systems, including vendors who host software systems containing sensitive customer data.

The risk assessment should include locations, systems and methods for storing, processing, transmitting and disposing of customer information. In addition, it should address potential internal and external threats that could result in unauthorized disclosure, misuse, alteration or destruction of NPI or customer information systems as well as assessments of the likelihood and potential damage to the company and its customers from these threats.

Title agencies may want to consider establishing or bolstering their information security program and policies, which may include the following:

• Intrusion detection and protection procedures
• Incident response procedures
• Security breach notification procedures
• Change management procedures
• Backup procedures and business continuity plan
• Vendor management procedures
• Privacy policy and procedures
• Record retention and disposal procedures
• Encryption policy
• Clean desk policy
• Access provisioning
• Physical and environmental security
• Background policy
• User awareness and training
• Testing of the information security controls
• Risk assessment procedures

ALTA Best Practices certification

ALTA has proposed – and some lenders are requiring – that title companies obtain certification by an independent third party, to demonstrate the title company’s compliance with ALTA Best Practices Framework.

Title agents should check with their lenders to see whether the lender will accept a self-assessment or if a third-party certification is required. In many cases, ALTA Best Practices certification will be the next step for title companies who have completed the self-assessment. A qualified accounting and consulting firm with expertise in attestation and review services, which may include internal controls, service organization controls (SOC) reports and risk assessments, can attest to a title agency’s compliance with the framework and provide the certification that the agency can present to its lenders.

Obtaining this certification could help a title company in becoming a preferred service provider with lenders that are looking for that certification or level of due diligence. In addition, there are many other benefits of obtaining ALTA Best Practices Certification.

Certification from an independent third party may help a title agent to:

• Demonstrate to lenders a higher level of assurance than a self-assessment
• Differentiate itself from other title agencies who have not obtained the certification
• Communicate to consumers about the steps the agency has taken to protect their information
• Identify any gaps or issues that might have been overlooked in a self-assessment
• Potentially identify other operational risks beyond the scope of the ALTA Best Practices Framework

A certified public accountant (CPA) can issue two different levels of reports regarding a title agent’s compliance with ALTA Best Practices.

1. Review: This report provides a lower level of assurance than an examination. “Review procedures are generally limited to reading relevant policies and procedures, and making inquiries of appropriate company personnel,” according to the AICPA’s guidelines on the ALTA Best Practices Framework.
2. Examination: This report provides a higher level of assurance. “Examination procedures may include obtaining evidence by reading relevant policies and programs, making inquiries of appropriate company personnel, inspecting documents and records, confirming company assertions with its employees or others, and observing activities,” according to the AICPA’s guidelines.

In addition to a review or examination, title agents may want to engage an accounting firm to provide one or more SOC reports. SOC reports assess a service organization’s operational and/or financial controls and can offer confidence to the organization’s stakeholders, customers and their auditors.

The bottom line

Ultimately, title companies that can demonstrate their compliance with the ALTA Best Practices Framework may be in a better position to maintain their relationships with lenders and establish new lender relationships. Companies who have not already done so should consider contacting a qualified accounting firm that can assist them with compliance.

_____

Steven A. Davis, CPA, is an entrepreneurial services principal in Kaufman Rossin’s Miami office. He can be reached at sdavis@kaufmanrossin.com.

Jorge Rey, CISA, CISM, CGEIT, is a director of information security and compliance at Kaufman Rossin. He can be reached at jrey@kaufmanrossin.com.