A USAP audit is one of the most consistently misunderstood compliance obligations in mortgage banking, and getting it wrong can put agency approvals and warehouse relationships at risk. The Uniform Single Attestation Program for Mortgage Bankers, abbreviated USAP, sets a standardized framework that independent CPAs use to test and report on a mortgage servicer’s compliance with minimum servicing standards. This article explains what a USAP audit covers, which lenders and servicers need one, and how it fits alongside the other financial reporting that agencies and investors expect.
Quick answer: A USAP audit is an annual attestation engagement, performed by an independent CPA under attestation standards, that reports on whether a mortgage servicer complied with the minimum servicing standards defined in the Mortgage Bankers Association’s Uniform Single Attestation Program for Mortgage Bankers. It is most relevant to companies that service mortgage loans for investors, custodial account holders, or agencies, and it is typically delivered together with audited financial statements as part of a servicer’s yearly compliance package.
What the Uniform Single Attestation Program Actually Is
The program traces back to the Mortgage Bankers Association of America, which introduced the original Uniform Single Audit Program for Mortgage Bankers in 1965 and revised it in 1975 and 1983. It was eventually renamed the Uniform Single Attestation Program because the engagement shifted from a traditional audit to an examination performed under the American Institute of CPAs’ Statements on Standards for Attestation Engagements, known as SSAE. The revised program took effect for management assertions made for fiscal periods ending on or after December 15, 1995.
That distinction matters. An attestation engagement means a CPA examines management’s written assertion about its compliance with specific criteria and then issues an opinion on that assertion. The criteria here are the minimum servicing standards spelled out in the USAP document, rather than generally accepted accounting principles.
USAP gives the industry a single, common yardstick. Before standardization, servicers faced a patchwork of investor-specific control reviews, and a uniform program reduced duplicate testing while giving investors and counterparties a consistent report they could rely on.
The result is a report that one engagement can satisfy across many relationships. A servicer that works with several investors does not necessarily have to commission a separate custodial review for each one, because each counterparty recognizes the same standardized attestation. That efficiency is a large part of why the program has endured.
What a USAP Audit Covers
A USAP engagement centers on custodial and escrow controls, because those are the areas where servicers handle money that belongs to borrowers and investors. The CPA examines whether the servicer properly safeguards and reconciles custodial bank accounts that hold principal, interest, taxes, and insurance funds.
The minimum servicing standards examined under USAP generally address areas such as the following:
- Maintenance of custodial accounts at a federally insured depository institution, in trust for the applicable investor
- Reconciliation of custodial and escrow bank accounts to the servicer’s records on a monthly basis, typically completed within 45 days after the cutoff date
- Proper segregation of custodial funds from the servicer’s own operating accounts
- Accurate and timely posting of borrower payments, including principal, interest, and escrow amounts
- Timely remittance of funds owed to investors and timely disbursement of taxes and insurance
- Advancing servicer funds where there is an overdraft in an investor’s or mortgagor’s account
- Adequate documentation supporting the servicer’s compliance assertions
The CPA gathers evidence, tests samples of transactions and reconciliations, and then issues a report stating whether management’s assertion about compliance with these standards is fairly stated in all material respects. A clean report supports the servicer’s standing; exceptions are disclosed and may prompt corrective action.
Because USAP is an attestation rather than a full financial statement audit, it does not opine on the company’s balance sheet or net worth. That work is handled separately through audited financial statements, which is why the two deliverables almost always travel together.
It also helps to understand what the report is not. A USAP attestation is not a guarantee that every transaction was processed flawlessly, and it is not a substitute for the servicer’s own ongoing monitoring. It is point-in-time assurance over the control environment, which is why investors treat it as one input among several when they evaluate a servicing partner.
Who Needs a USAP Audit
The short answer is companies that service residential mortgage loans on behalf of others. If your firm collects payments, manages escrow, and remits funds to investors or holds custodial accounts, a USAP-style attestation is commonly required by the parties relying on your servicing.
Requirements are driven primarily by investors, agencies, and state regulators rather than by a single federal statute. A servicer’s specific obligation depends on whose loans it services and the contracts and guides that govern those relationships. Several common drivers are worth understanding.
State licensing authorities frequently reference USAP in their servicing rules, requiring licensed servicers to submit an annual USAP report alongside audited financials. Investors and warehouse lenders may build USAP attestation into their counterparty agreements as a condition of doing business. Subservicing arrangements add another layer, because a company that relies on a subservicer often wants assurance over the subservicer’s custodial controls.
Size and structure also influence the picture. A small independent servicer that holds custodial accounts for a single investor still owes that investor assurance over how borrower funds are handled, while a larger servicer with multiple agency approvals may face several overlapping requirements at once. The common thread is the presence of custodial funds and the duty to safeguard them.
If your company is weighing whether USAP applies, the controlling documents are your investor agreements, agency guides, and state servicing statutes. Mortgage banking is a heavily regulated vertical, and Pease Bell’s mortgage banking practice works with lenders and servicers to map which attestation and reporting obligations actually apply to their charter and counterparties.
How USAP Fits With Agency Financial Reporting
USAP does not exist in isolation. Agencies impose their own financial reporting and audit obligations that operate alongside or, in some cases, in place of USAP, so it helps to see the full picture.
Fannie Mae requires each seller/servicer to demonstrate financial adequacy by submitting an annual Audited Financial Statement together with an updated Lender Record Information form, Form 582, no later than 90 days after the end of the seller/servicer’s fiscal year, as set out in its Selling Guide. Fannie Mae also requires mortgage banker seller/servicers to file a quarterly Mortgage Bankers’ Financial Reporting Form. These are financial submissions distinct from a USAP custodial controls attestation, though a servicer may need both depending on its activities and the requirements imposed on it.
Ginnie Mae takes a different route for its issuers. Ginnie Mae maintains its own Mortgage-Backed Securities Guide, and its issuer eligibility chapter requires issuers to remain approved lenders in good standing, to meet financial benchmarks, and to submit annual audited financial statements within 90 days of fiscal year end under Ginnie Mae’s own audit framework rather than relying solely on USAP. Those issuer eligibility requirements are published in Chapter 3 of the Ginnie Mae MBS Guide.
The practical takeaway is that a servicer’s annual compliance calendar can include several overlapping deliverables: audited financial statements, agency-specific audit reports, periodic financial filings, and, where applicable, a USAP attestation. Coordinating these so they share evidence and scheduling reduces cost and avoids duplicate testing.
Sequencing matters here too. Because the audited financial statements and the USAP attestation draw on overlapping records, planning both around the same fiscal year close lets a servicer hand over one organized set of reconciliations and supporting schedules. That reduces back-and-forth and keeps each deadline from becoming a separate fire drill.
Preparing for a Smooth USAP Engagement
Preparation is largely about documentation and reconciliation discipline maintained throughout the year, not just at audit time. Servicers that reconcile custodial accounts promptly and retain clear support tend to move through the attestation quickly and with few exceptions.
Before the engagement begins, a servicer should confirm which standards apply, organize custodial bank statements and reconciliations, and document the controls that support each compliance assertion. Clean separation between custodial funds and operating funds is one of the first things a CPA will test, so confirming that segregation is well documented pays off.
Choosing a CPA firm experienced in mortgage servicing matters because the examiner needs to understand custodial mechanics, remittance timing, and agency expectations. Pease Bell’s audit and assurance services team performs attestation engagements with that industry context, which helps servicers anticipate questions and present evidence efficiently.
Finally, treat any prior-year exceptions as a roadmap. Addressing earlier findings before fieldwork begins demonstrates a functioning control environment and shortens the current engagement.
Frequently Asked Questions
Is a USAP audit the same as a financial statement audit?
No. A USAP engagement is an attestation on a servicer’s compliance with minimum servicing standards, focused on custodial and escrow controls, performed under attestation standards. A financial statement audit opines on the fairness of the company’s financial statements under generally accepted accounting principles. Servicers commonly need both, and the two are usually delivered together.
Who requires a USAP audit?
USAP requirements are imposed by the parties that rely on a company’s servicing: investors, warehouse and counterparty lenders, and state servicing regulators that reference the program in their rules. There is no single nationwide mandate, so the controlling sources are your investor agreements, agency guides, and applicable state statutes.
How often is a USAP attestation performed?
It is an annual engagement, typically aligned with the servicer’s fiscal year and delivered alongside the audited financial statements and other required filings. Coordinating the timing with agency deadlines, such as Fannie Mae’s 90-day audited financial statement submission window, keeps the compliance calendar manageable.
Does USAP apply if we only originate loans and do not service them?
Generally no. USAP is built around servicing activities and custodial fund controls, so a pure originator that sells loans servicing-released and never holds custodial funds usually falls outside its scope. If your firm retains servicing, subservices, or holds custodial accounts, USAP or an equivalent attestation typically applies, and you should confirm against your investor and regulatory requirements.
Getting the Scope Right
The hardest part of a USAP audit is usually not the testing itself but determining whether and how it applies to your specific mix of agency approvals, investor relationships, and state licenses. Mapping those obligations correctly prevents both gaps that jeopardize approvals and redundant engagements that waste money.
Working with a CPA firm that understands mortgage servicing turns the USAP attestation from an annual scramble into a predictable, well-coordinated part of your compliance program. The payoff shows up in fewer exceptions, smoother agency renewals, and counterparties who trust the assurance behind your servicing operation.
