E3
Quality control operations

The Borrower Is Not in the Room When the File Is Checked

Shailesh Bhujbal·5 min read·Published 7 September 2026·Last reviewed 8 September 2026


Quality control is described, almost universally, as an investor-protection function. It exists because loans are sold, and buyers of loans require assurance that what they bought matches what was represented.

FIGURE 1One defect, two descriptionsPost-closing QC examines the completed file after every incentive to close has been discharged.One defect in the fileTHE INVESTOR'S DESCRIPTIONA representation-and-warranty breach.A repurchase demand at an estimated$32,288 per loan.A well-developed vocabulary existsfor this description.THE BORROWER'S DESCRIPTIONIncome assessed incorrectly.A disclosure that arrived late.A loan that should not have closedon those terms.Almost no vocabulary exists for it.Framed only as investor protection, the function is funded against a cyclical loss, so coverage falls when standards are loosest.Repurchase cost: National Mortgage News, drawing on STRATMOR Group analysis.
Figure 1 One defect, two descriptions

That description is accurate. It is also incomplete in a way that shapes how the function is resourced, and the omission is worth naming.

Who is in the room when a file is checked

Consider who has reviewed a loan file by the time it closes, and on whose behalf.

The loan officer works the file toward closing. Processing assembles it. Underwriting assesses whether it meets guidelines: on behalf of the lender, and by extension the investor. Closing executes the documents. Every one of these steps has an owner with an interest in the transaction completing.

The borrower has read a stack of disclosures under time pressure, most of which describe terms rather than verify facts. They are the party whose income was calculated, whose debts were counted, whose property was valued, and whose thirty years are being committed. They are also the only party with no practical means of checking whether any of that was done correctly.

Post-closing quality control is the first review in the entire process performed by someone with no interest in the transaction having closed.

That is an unusual position, and it is what makes the function structurally important beyond its stated purpose.

The same defect, described from two ends

A defect in a loan file has two descriptions depending on where you stand.

From the investor's end it is a representation-and-warranty breach, arriving as a repurchase demand at an estimated average cost of $32,288 per loan. [2]

From the borrower's end the same defect is an income figure calculated incorrectly, a debt that was not counted, a disclosure that arrived after the window it was required in, or a loan approved on terms the borrower did not in fact qualify for. Occasionally it is a loan that should not have closed at all.

These are not two categories of defect. They are one defect, and the industry has a well-developed vocabulary for one description of it and almost none for the other.

This is why the composition of defect data repays attention. In Q4 2025, Legal, Regulatory and Compliance returned as the top defect category at 24.66%, up roughly 30% and rising for a third consecutive quarter, with Income and Employment at 21.52%. [1] Both categories are, from the borrower's side, about whether the loan they received was assessed accurately and disclosed properly.

What the aggregate rate hides

The industry's critical defect rate was 1.50% for calendar year 2025 against 1.52% the year before: effectively flat. [1]

Inside that stability, Borrower and Mortgage Eligibility rose 291.58% across the year, and Credit rose 166.13%. [1]

A flat rate covering movement of that size is not a system in equilibrium. It is a system whose detection method is not tracking where failure is moving. And because review is sampled, a defect concentrated in one channel, one product or one underwriter can be systematic within that slice while remaining statistically invisible in the aggregate.

Whoever is inside that slice experiences a defect rate nothing like 1.50%.

Why the framing affects the resourcing

Functions are funded in proportion to the losses they visibly prevent.

Framed purely as investor protection, quality control's value is bounded by repurchase exposure, and repurchase exposure is cyclical. When demands are low, the case for the function weakens, and coverage gets reduced at precisely the point in the cycle when origination standards are loosest, which is when the defects being created will surface two or three years later.

Framed as the point where the file is verified on behalf of everyone carrying risk in it, including the borrower, who cannot verify it themselves, the function's value does not disappear when repurchase demands fall. The loans are still being made. Somebody is still living in the house.

This is not an argument for sentiment in a risk function. It is an argument that the narrower framing produces a procyclical resourcing pattern, and procyclical resourcing of a control function is a known way to accumulate problems.

What follows operationally

Post-closing quality control is not the only control in the process: prefunding QC, compliance testing, investor review and internal audit all operate, and several run earlier where a finding is cheaper to act on. What is distinctive about post-closing review is its position: it looks at the completed file, after every participant's incentive to close has been discharged, which makes it the point where a borrower-affecting error is most likely to be seen for what it is.

Given that position, three properties matter more than they would for a purely commercial control.

Coverage should not be the variable that absorbs volume. [3] When volume rises faster than headcount, the sample shrinks, and sample size is the one lever with no accounting consequence. Whatever else changes under pressure, coverage is the wrong thing to let move silently.

Findings should be reproducible against the standard in force at the time. A review that cannot say which version of a rule it applied cannot be defended once that rule changes, and every historical review silently re-anchors to today's standard.

The absence of a finding should be distinguishable from a check that did not run. These look identical in a summary and mean opposite things. In segments where programmes are numerous and bespoke, the difference between them is the difference between a review and the appearance of one.

None of these three requires any particular technology. They are properties any quality control programme can be assessed against, including an entirely manual one.

They are worth assessing against, because the function is doing something more consequential than protecting a buyer's position, and it is the only part of the process built to do it.

Sources

  1. ACES Quality Management, Mortgage QC Industry Trends Report, Q4 and CY 2025. Critical defect rate 1.50% for CY 2025 against 1.52% for CY 2024. Category figures are shares of critical defects, not defect incidence, and are drawn from the report's sample of reviewed loans.
  2. STRATMOR Group, Unpacking the drivers and costs of GSE repurchase demands, reported by National Mortgage News. The $32,288 figure is a study estimate of cost per repurchase demand, not per completed repurchase; income and appraisal together account for 57% of demands in that study. A category share does not establish that those demands were preventable.
  3. Fannie Mae Selling Guide, D1-3-01, Lender Post-Closing Quality Control Review Process. Requires both random and discretionary selection; discretionary reviews supplement the random sample rather than replace it.

See a finding taken apart.

See how each value was read, which rule was applied, and what the record looks like later.