Focusing on what matters most for credit risk review
From this, our core mandates for loan review become clear:
- Ensure risk ratings tell the truth
Are loans rated accurately, and does the rating system itself allow the institution to understand the level and direction of risk? A simple litmus test: if more than 20–25% of portfolio exposure concentrates in a single risk grade, the framework isn’t properly calibrated. In my experience, when a single grade carries more than a quarter of the exposure, it’s usually a sign that the scale isn’t distinguishing risk effectively. The loan review function must call that out and insist on a structure that distinguishes risk, not hides it.
- Evaluate policy adequacy, not just adherence
Loan review teams often fixate on exceptions—sometimes obsessively. But the more important question is whether credit policies and guidelines are adequate for how the institution actually operates. If there’s a disconnect between the stated guardrails and day-to-day practice, that’s a policy adequacy problem, and no amount of exception tracking compensates for it.
For example, from a policy perspective, unsecured lending is considered undesirable and should only be made on an exception basis. Yet, a review of an institution’s portfolio indicates that a third of loans are unsecured. Further analysis indicates 95% of exposure is risk rated “4” (assuming a six-point pass scale with 4 as Average) or better, so there is no real concern on credit quality. Yet, this institution has created a rash of exceptions (a third of the portfolio!), which are unnecessary and do nothing more than create noise. The policy needs to be revisited.
If anything, labeling unsecured lending as an exception should only apply to loans risk rated 5 or worse. More appropriately however, it’s not a policy issue at all. It’s simply a portfolio segment to monitor and perhaps apply a capital allocation. It’s harder to make this kind of a call, but it’s the one that truly matters.
- Assess whether people are doing their jobs
Years ago, I reviewed a small market where the four largest loans were nonaccrual with partial charge-offs. Management had been replaced, and the new folks had worked tirelessly to stabilize them. By our mechanical scoring system, however, the overall examination rating would have been “Unsatisfactory.” That was unfair. I overrode the score and argued for a more reasonable rating.
Too often, examinations elevate process over substance. The real question is whether people—lenders, managers, and the oversight function (i.e. credit)—are doing their jobs. Today, as more institutions adopt automated scoring and workflow tools, this principle matters even more. Technology can support judgment, but it can’t replace the need to understand when people are doing the right work for the right reasons. As financial institutions’ loan review software tools get more sophisticated, the discipline to challenge them—not just follow them—will be what separates effective institutions from merely compliant ones.
- Communicate clearly to the board and executives
Your audience does not want a 25-page tome of charts and grids that says nothing. Keep the credit risk review report to 3–5 pages and make sure to:
- State the overall portfolio condition and its trajectory
- Highlight risk ratings, policy adequacy, and personnel performance
- Identify action items, expected outcomes, and agreed-upon timelines
Everything else—scorecards, detail schedules, loan-level grids—belongs in an appendix.
In my early career, a boss distinguished between the “regulatory” and the “righteous.” Regulatory meant required. Righteous meant it made sense. Everything above falls into the righteous category. Even if agencies evolve or priorities shift, these fundamentals remain essential to institutional safety and soundness.
