# Mortgage Quality Control Plan: What It Must Include - Author: TrueBankFlow (https://truebankflow.com) - Published: 2026-10-17 - Category: Loan desk operations - Canonical: https://truebankflow.com/blog/mortgage-quality-control-plan > What a mortgage quality control plan must include: sampling, prefunding and post-closing reviews, findings tracking and income and asset checks. A mortgage quality control plan is the written program a lender uses to test its own loans for defects. It must state standards and risks, a sampling method that mixes random and targeted files, prefunding and post-closing review steps, re-verification of income and assets, monthly reporting of findings to management, corrective action and record retention. ## What must a mortgage quality control plan include? A mortgage quality control plan must describe what the lender checks, how it picks loans to check, who checks them, how findings are reported and how problems get fixed. Fannie Mae's Selling Guide section on [lender quality control programs, plans and processes](https://selling-guide.fanniemae.com/sel/d1-1-01/lender-quality-control-programs-plans-and-processes) is a widely used reference, and the checklist below follows its list. That section asks for these components in writing. Each item below adds a plain note on what it means in practice. - [ ] **Quality standards and measures.** The plan's purpose, the risks it targets and how the QC function stays independent of production. - [ ] **Procedures for staff.** Instructions for everyone who takes part in, or is affected by, a QC review. - [ ] **File review process.** How a reviewer tests a loan against investor guides, the lender contract and the law. - [ ] **Sample selection.** Random and discretionary selection, covering every underwriting method, channel and product. - [ ] **Reporting.** How often results go to management and how loan-level findings are shared. - [ ] **Corrective action.** What happens when a trend appears. - [ ] **Vendor review.** How the lender oversees any QC work it outsources. - [ ] **Record retention.** QC records kept for at least three years under the Fannie Mae section. - [ ] **Audit.** A check that the plan itself is followed the same way every month. A plan that covers every line can still be thin. The test is whether a new QC analyst could run a month of reviews from the document alone, without asking how things are usually done. ## Sampling rules in a mortgage quality control plan Sampling is how a mortgage quality control plan chooses which loans get a review. Fannie Mae expects two kinds of selection: a random sample that gives an honest defect rate across all production, and a discretionary sample aimed at loans with known risk. Random post-closing selections must get a full-file review. Many plans aim the review of a discretionary selection at the risk that put the loan in the sample. ### Random selection The random sample answers one question: across everything the lender closed, how often is a loan defective? It must be truly random. Letting a manager swap out a loan because it "looks fine" breaks the measure. Fannie Mae also asks lenders to set a target defect rate from this random sample, measure against it at least quarterly and review the target each year. ### Discretionary selection The discretionary sample is where a lender's judgment belongs. Typical targets include: - New loan officers, processors or underwriters in their first months. - Files with exceptions or manual underwriting. - Self-employed borrowers qualified on bank statements. - Branches or brokers with a rising defect rate. - Loans with early payment default. ### Third-party originations Lenders that buy or fund loans from brokers and correspondents carry an extra rule. The same Fannie Mae section asks for a stratified random sample of third-party loans, selected for full-file review at least monthly, with an exemption for lenders that take in 100 or fewer such loans a year. Stratifying means sampling by originator so one large broker does not hide the results of small ones. ## Prefunding reviews versus post-closing reviews in mortgage QC A prefunding review checks a loan before it closes, while there is still time to fix it. A post-closing review checks a loan after funding, to measure quality and find patterns. Both belong in a mortgage QC plan. Prefunding catches individual errors. Post-closing tells management whether the process that made the loan is sound. ### What prefunding review catches Prefunding reviews look at a sample of loans before closing, or before purchase for loans from third parties. They are fast and narrow. A reviewer confirms the income math, the asset sourcing, the appraisal and the key disclosures, then sends findings back to the file owner while the loan can still change. The detailed process belongs to [pre-funding quality control](/blog/pre-funding-quality-control), and the QC plan needs only to define the sample, the scope and who signs off. ### What post-closing review measures Post-closing reviews re-underwrite a closed loan from scratch. The reviewer reorders credit, re-verifies employment and deposits, reviews the appraisal and rates every finding by severity. Because the loan has already funded, the goal is less about this loan and more about the next hundred. A pattern of missed debts across one branch matters more than any single miss. ### Timing between the two The two reviews should not test the same loans the same way. A prefunding sample that already examined a file's income gives a post-closing reviewer nothing new if that file is pulled again for income only. Many plans let post-closing samples include prefunded loans but require the full-file scope, so the second look is independent. ## How should a mortgage QC plan check income and assets from bank statements? A mortgage QC plan should tell the reviewer to rebuild income and asset figures from the statements themselves, not to re-read the underwriter's worksheet. That means obtaining statements directly or through verification, confirming every page and month is present, recomputing deposit averages, and checking that large deposits were sourced and excluded or counted as the program requires. ### Re-verification steps 1. Request statements or a verification of deposit directly from the institution where the plan requires it. 2. Compare the statements in the file to the re-verified ones. Look for different balances, missing pages or changed fonts. 3. Recalculate eligible deposits month by month and compare the average to the qualifying figure. 4. Trace every large deposit to its source document. 5. Confirm reserves and funds to close against the final closing figures. When the reviewer needs more paper from a borrower after closing, the request should be specific and dated. [A document request letter to a borrower](/blog/document-request-letter-to-borrower) shows how to ask for exactly the missing months or explanations. ### Asset sources QC should test Down payment money is where many asset defects hide. A deposit that looks like savings may be a loan from a relative or a cash advance. [How lenders treat borrowed funds for a down payment](/blog/borrowed-funds-for-down-payment) covers which borrowed money is allowed and how it must be shown, and a QC reviewer should test the file against that rule rather than accept the gift letter at face value. ### A recalculation that leaves a trail The reviewer's recalculation is only useful if someone else can check it. [TrueBankFlow](/) lines up statements month by month, flags large or out-of-pattern deposits and links each total to its statement lines, so a QC analyst can compare a fresh deposit average to the underwriter's and see where they part. ## Defect tracking and corrective action in the mortgage QC plan Defect tracking turns individual review results into decisions. A mortgage quality control plan should rate each finding by severity, log it with the loan and the responsible role, report the totals to management at least monthly, and require a written action plan with a timeline when a trend appears. Fannie Mae's section sets that monthly reporting floor. ### Example monthly findings log The log below is a made-up illustration of one month's post-closing results. The categories and counts are examples, not benchmarks. | Loan (example) | Area | Finding | Severity | Owner | Action | | --- | --- | --- | --- | --- | --- | | 2026-0412 | Income | Deposit average used 13 months, program allows 12 | Moderate | Underwriting | Retrain on lookback, recheck open files | | 2026-0419 | Assets | Large deposit sourced by letter only | Significant | Processing | Add source-document step to checklist | | 2026-0433 | Credit | Debt on credit supplement missed in DTI | Significant | Underwriting | Second review on supplements for 60 days | | 2026-0447 | Disclosures | Revised disclosure sent one day late | Moderate | Closing | Review timing report daily | | 2026-0451 | Appraisal | Comparable adjustment not explained | Minor | Appraisal desk | Note to appraiser panel | ### From finding to fix One finding is a mistake. Three of the same finding in a quarter is a process problem. The action plan should name the change, the person who owns it, the date it takes effect and how the next month's sample will test it. Tie the fix to the production workflow. If the asset finding above keeps returning, add the step where files are assembled, and watch it through [loan pipeline management](/blog/loan-pipeline-management) reports so open loans get the same treatment before they close. ## When a mortgage quality control plan exists only on paper A mortgage quality control plan fails in practice when the written program and the monthly work drift apart. Common signs are samples that were never random, reviews done by the same people who made the loans, findings reported but never acted on, and a plan document that has not been updated since the last investor audit. ### Warning signs to check - **Hand-picked samples.** If someone in production can influence which loans are reviewed, the defect rate is not real. - **No independence.** An underwriter reviewing loans from their own desk will miss their own habits. - **Reports without decisions.** A findings report that goes to management every month with no minutes or action items is a record of inaction. - **Stale scope.** A plan written before the lender added bank statement or non-QM programs will not sample them on purpose. - **Missing vendor oversight.** Outsourced QC still needs the lender to check the vendor's work. ### Keeping the plan current Review the plan whenever the business changes: a new product, a new channel, a new system or a jump in volume. Date each version and keep the old ones. An investor or auditor will ask what the plan said at the time a loan was reviewed, not only what it says today. If your QC team rebuilds deposit averages by hand on every sampled bank statement file, you can [request early access to TrueBankFlow](/get-started) and test it on files from last month's sample.