Credit risk management & board oversight
This article originally appeared in the April 2017 issue of Wisconsin Banker.
Providing credit is a fundamental component of the banking business model, but as banks (and the financial services industry as whole) have become more complex it can be tempting to let the act of lending diverge from the credit standards that guide the institution. When that happens, the bank’s credit culture can cause financial and reputational risk. “Banking is a unique animal,” said Tom Siska, Associate at Plante Moran. “The greatest source of a bank’s income is also the greatest source of risk: the lending portfolio.”
So how can banks avoid falling into bad habits as credit quality rises? “It starts with the board making credit quality a top priority,” said John Behringer, CPA, Partner at RSM US LLC. Credit loss, and particularly systemic credit loss across multiple loan segments, is a critical risk for every lending institution, so the board must be confident in its ability to oversee the loan portfolio.
“Credit risk management, also called loan portfolio management, is the first line of defense between success and failure in managing the number one risk for a bank,” said Michael Wear, an instructor at WBA’s Commercial Lending School and also a faculty member and Loan Portfolio Management Section Leader at the Graduate School of Banking – Wisconsin. Boards and management can ensure their policy and monitoring processes are sound by first recognizing their level of risk, finding the balance between detail and summary for the board, and then assessing their operations.
Recognize Risk
Effective director oversight of the credit function requires the board to have a comprehensive understanding of the risks present in their institution’s market(s) and of their comfort level with that level of risk. This has become an area of concern for regulators, as well. In the winter issue of its Supervisory Insights publication, the FDIC highlighted credit risk trends in CRE, ag, and oil and gas lending, and reiterated the importance of maintaining strong risk management processes.* The OCC, meanwhile, addressed similar issues in the Spring 2016 issue of its Semiannual Risk Perspective publication, which allocated significant focus to elevated CRE and operational risks, in particular.** “Any time you have a concentration you need to be aware, as a director, of what percentage of your loan portfolio is in that particular concentration and what the overall impact will be if something happens in the economy,” Siska advised.
In addition to their focus on concentrations, regulators have also begun to watch competitive pricing closely. “Appropriate pricing of risk is the principle business of any bank,” said Siska. “The regulatory bodies are starting to get concerned with competition for interest rates, so they’re watching that very carefully. Banks for the most part have been very careful to grant loans on a sound and collectible basis coming out of the recession,” he continued. “Any slippage we see is usually due to competition.”
Of course, the economy is also a major factor in assessing credit risk at a particular institution. “We’ve had good times these past few years, but that’s when bad loans get made,” said Wear. He recommends recognizing and monitoring potential systemic risk causes, augmented with scenario-based stress testing on larger credits and loan loss reserve adequacy in aggregate. “You have to think outside of the box when coming up with the absolute worst-case scenarios and how they might impact you,” he explained. Bank boards are made up of business and community leaders, and management should leverage that expertise. “Boards know their marketplace—along with its intrinsic risks—better than any computer program,” said Wear. Forecasting and stress testing the portfolio for a more difficult economy is essential to prepare the bank for potential issues. “We’re closer to the next recession than we are to the last one,” Behringer said, noting that we’re currently in one of the longest economic expansions in U.S. history. “The more you spring clean now, the better prepared you’ll be for the next downturn.”
Balance Perspective and Detail
In addition to a full understanding of the risks in the loan portfolio, bank directors also need the right balance of detailed loan reporting and summarizations that provide a wide perspective. According to Behringer, the degree of board engagement depends on the bank; for example, an institution with a concentration in high-risk loans––such as CRE––requires more detailed monitoring. “The board should spend time designing their dashboard with management according to what their needs are for indicators,” Behringer recommended, adding that the board must then review that dashboard each month.
Effective monitoring requires watching for trends, both within the bank’s loan portfolio and externally in the local economy. “Directors really need to have their finger on the pulse of the loan portfolio,” said Siska, recommending a period review of peer data as it relates to asset quality. “Every bank has a unique economy,” he explained. “A small town bank in northern Wisconsin is not in the same economy as a large bank in the heart of downtown Chicago, so that’s why peer comparison is important.” That peer data is a reliable source for the board to provide perspective on sector trends, for example. Internally, loan exceptions are one piece of data the board should watch carefully. “Policy exceptions are a great way for the board to track how well employee behavior tracks with the bank’s risk tolerance,” Wear explained.
However, the board also needs to be able to drill down into individual loans, at times. A certain level of detail is required when assessing exceptions to the loan policy, for example. So how can you tell when board reports are in the “sweet spot”? “Successful early identification of weakening conditions of borrowers—before they hit traditional problem loan reports—is a good litmus test that you’ve got the balance between detail and perspective right,” said Wear.
Compare Policy and Operations
The best way for the board to fulfill sound credit oversight is to perform a periodic, comprehensive assessment of the bank’s loan operations to ensure that all policies and procedures match staff practices. “Whoever the institution is, the process is the same,” said Siska.
Define your risk appetite
Since the bank’s comfort with different levels of risk depend greatly on the bank’s strategic goals, Wear says it’s critical for the board to first identify the mission and goals of the institution. “This is the guiding light for everyone in the bank and is usually consistent through good and bad economic times,” he said.
Doing so will help the board to clearly articulate the risk appetite of the bank, which impacts both the written policy and the operational procedures it prescribes. “It’s the board’s job to define the risk appetite of the bank, and the riskiest asset most banks own is their loans,” said Behringer.Compare policy and portfolio
Next, review the loan policy and the bank’s current portfolio; compare the two and identify gaps where they indicate different comfort levels with risk. Examine areas of concentration and loan exceptions, in particular. “Look at the loan policy no less than annually and assess if it still aligns with the risk appetite of the bank,” Behringer advised. “Especially look at exception reporting and concentration reporting relative to capital and the overall portfolio.”Monitor behavior: Loan documentation
Many credit risk reviews stop there, but it is essential that the board also know whether the operational practices of bank employees align with the philosophy set out in the credit policy and visible in the loan portfolio. “When we see errors, it tends not be to in the design of the controls but the operating process,” said Behringer. “The breakdown that leads to the greatest risk is when we approve a structure for a borrower in a certain way, but that doesn’t carry through to the underwriting process or the monitoring process.” A full analysis requires that the bank’s loan documentation procedures are clear and in writing. “Make sure it’s detailed, complete and consistent from loan to loan,” Siska advised. “The process should be one the bank is comfortable with and also gives them all the information they need about each borrower. Anyone should be able to open the file and find what they need.”Monitor behavior: Loan administration
A thorough credit risk review must follow the process from “cradle to grave,” so after reviewing loan documentation practices, the next step is to review the bank’s loan administration practices. “Credit administration is the mortar in the bricks of a good credit culture,” Wear explained. “It has to be consistent.” The bank’s loan administration policy is also designed as an “early warning system,” Behringer explained, allowing the bank to intervene before a customer goes into default. “The sooner you can identify an issue, the sooner the bank can work with the borrower, which is a hallmark of a community bank,” he said. Loan administration can be a positive customer touchpoint when done well, according to Wear. “Past due loan renewals are a customer service failure,” he asserted.Identify your tools
Finally, identify the tools your institution will use to conduct this review on a timely, consistent basis. Some banks will find complex software tools the most applicable to their situations, while others can succeed with Excel spreadsheets. It all depends on the complexity of the bank and its portfolio. Whichever tools you use, however, remember that they are not a panacea. “Sometimes banks tend to view software products as the solution when really they’re just a tool,” Behringer cautioned. “You can have the best technology in the world but your procedures and your people need to be effective as well in order for the process to work.”
In addition, a loan grading system can be helpful for the board, according to Siska. “They should have a loan grading system in place as part of their policy, and the directors should know how to interpret it,” he said. Another option is to categorize all loans, which helps identify concentrations. “I’m a big fan of categorizing the portfolio,” said Wear, suggesting banks use the North American Industry Classification System (NAICS) on both commercial and consumer loans. “Even for consumer loans, know what your biggest source of repayment is, how many customers have the same employer, et cetera,” he said.
Credit risk management is one of the bank board’s most fundamental duties, and developing a careful process to guide that oversight benefits the bank, its shareholders and employees, and the community as a whole. “Directors are responsible for ensuring that overall, lending is done responsibly with a concern for the soundness of the bank, shareholder returns, and meeting the credit needs of the community,” Siska explained. “Scrutiny of the process is important.”
