A practical checklist for banks and credit unions

CECL exam preparation

Introduction

A CECL examination or audit often follows the chain from governance to data, from assumptions to calculations, and from reported results back to actual portfolio outcomes. This CECL exam checklist is designed to help a bank or credit union assemble that chain before the request arrives. It can also serve as a CECL audit checklist to organize the evidence an external auditor may request.

Use this checklist as a planning aid. Mark each item as ready, in progress, not applicable, or needing management judgment. Keep a short explanation and the supporting file with every "not applicable" or unresolved item. For every checklist item, preserve the version used for the period under review. An examiner or auditor should be able to trace the item from policy to implementation, from implementation to calculation, and from calculation to the general ledger and financial statements. A well-organized evidence trail makes it easier to explain a reasonable, supportable estimate; it does not guarantee a particular exam or audit result.

This checklist is intended as a planning resource. Banks and credit unions should adapt it to their policies and applicable guidance.

1. Governance and board oversight

Across FASB, OCC, and NCUA guidance, regulators consistently expect board and management oversight of ACL, supported by approved policies, clear documentation, explainable estimates, strong internal controls, and up-to-date communication between the board and auditors.

Confirm the board or appropriate committee approved the current CECL/ACL policy, methodology, material changes, and any documented exceptions.

Identify who owns the estimate, who prepares it, who reviews it, who challenges it, and who approves the reported amount. Document segregation of duties where roles overlap.

Keep minutes, committee packets, management presentations, challenge questions, decisions, and follow-up actions for the periods under review.

Show how the board or committee receives information about portfolio risk, forecast changes, Q-factor movements, backtesting, validation, and open findings.

Prepare a one-page explanation of why the allowance increased or decreased from the prior period, including the most important drivers by portfolio.

Document training or briefing materials used to help directors and senior management understand the life-of-loan concept, methodology limitations, and material judgments.

2. CECL policy and methodology documentation

Document the method selected for each portfolio, why it is appropriate, how it is applied, and what judgment is used. The interagency statement does not prescribe one loss-estimation method; the NCUA methodology guide likewise says credit unions may use an appropriate method and should scale it to asset size and complexity.

Maintain the policy, procedure, methodology document, model document, and calculation instructions as a controlled set with effective dates and version history.

Document treatment of accrued interest, fees and costs, purchased or originated credit-deteriorated assets, modifications, collateral-dependent assets, unfunded commitments, and other relevant exposures.

Define when loans or other financial assets are evaluated individually rather than in pools, including loans to borrowers experiencing financial difficulty when applicable.

For each in-scope asset type and off-balance-sheet exposure, state the measurement method, unit of account, segmentation basis, data sources, forecast treatment, reversion method, Q-factor process, and approval path.

Describe nonaccrual, charge-off, recovery, and write-off policies and demonstrate that the CECL calculation uses consistent definitions.

Record limitations, compensating controls, manual adjustments, and situations in which management judgment supplements or overrides a system output,

3. Portfolio segmentation and data integrity

Segmentation should reflect similar risk characteristics and remain understandable to management. The guidance emphasizes reliable, relevant data and controls over completeness and accuracy.

Show the segment hierarchy from source systems to reporting pools and explain why each pool shares risk characteristics.

Document when a segment was added, removed, split, merged, or reclassified and how the change affected the allowance.

Reconcile loan balances, commitments, accrued interest, chargeoffs, recoveries, delinquency, nonaccrual, risk grades, collateral, and other key fields to authoritative systems.

Confirm that data retained for the period under review can be reproduced without relying on a current-period extract that may have changed.

Test completeness and accuracy of model inputs, including account counts, balances, dates, contractual terms, payment status, prepayment information, and segment assignments.

Review data extraction logic, query changes, transformation steps, mapping tables, overrides, missing-value treatment, duplicate handling, and file-transfer controls.

Retain an exception report for every material reconciliation break, along with the resolution, reviewer, date, and conclusion about whether the allowance was affected.

4. Historical loss information

Historical loss information is an anchor for the estimate and requires context. Record the period, population, definitions, and adjustments used to make historical experience relevant to the current portfolio.

State the historical lookback period and why it captures relevant loss behavior for each segment.

Define chargeoffs, recoveries, defaults, prepayments, exposure at default, and the denominator used in each loss-rate calculation.

Reconcile historical loss totals to the general ledger, regulatory reports, servicing records, or another authoritative source as appropriate.

Explain how mergers, acquisitions, portfolio sales, servicing transfers, system conversions, new products, or data gaps affect comparability.

Document the use of internal history, external history, peer information, or proxies, including why the data is relevant and what limitations remain.

Separate historical experience from adjustments for current conditions and reasonable and supportable forecasts; identify any overlap or double counting.

Retain the historical data file, calculation, review evidence, and the management conclusion for each period used.

5. Forecasts, reversion, and qualitative adjustments

Forecasts, reversion, and qualitative adjustments are common areas for questions because they connect observable information to management judgment. Institutions should document a reasonable, supportable, and consistently applied approach.

Identify the forecast horizon, variables, scenarios, sources, refresh date, and owner for each forecast used in the estimate.

Explain why the forecast is reasonable and supportable for the portfolio, including how management considered adverse or changing conditions.

Document the reversion method used beyond the forecast period, the historical information or proxy used, and why the transition is systematic and rational.

Show how forecast and reversion assumptions flow into each segment and how the approach remains consistent period to period.

List every qualitative factor, its cause-and-effect relationship to expected loss, direction and magnitude, data source, owner, approval, and effective period.

Demonstrate that Q factors respond to conditions not already captured in historical loss data, forecast variables, risk grades, or other model inputs.

Retain sensitivity or scenario analysis for material judgments and explain why management selected the reported conclusion.

Review whether a factor should be removed, reduced, or revised as underlying conditions change.

6. Calculations, reconciliations, and disclosures

A reviewer should be able to follow balances and assumptions, reconcile the result to the ledger and reporting package, and tie disclosures to the same definitions used in the allowance process.

Reperform key calculations for selected segments and confirm loss rates, exposures, contractual terms, prepayments, discounting, and adjustments are applied as documented.

Trace disclosures to source schedules and verify that the narrative explains significant changes, methods, assumptions, credit-quality information, and other applicable CECL disclosures.

Explain all differences between the model output, management adjustments, booked ACL, and disclosed amounts.

Reconcile the calculated allowance and provision to the general ledger, financial statements, regulatory reports, and management reporting, as applicable.

Check beginning balance, provision, chargeoffs, recoveries, transfers, acquisitions, ending balance, and other roll-forward components for internal consistency.

Review controls over spreadsheet formulas, code, macros, interfaces, manual entries, access, approvals, and reporting extracts.

Confirm that review evidence demonstrates mathematical accuracy as well as reasonableness of assumptions and results.

7. Third party and vendor oversight

Interagency third party guidance emphasizes risk-based oversight, due diligence, ongoing monitoring, and clear accountability. The guidance calls for the evaluation of third party models before use.

List every third party that supplies data, software, methodology, validation, consulting, forecast inputs, or operational support to the CECL process.

Retain due diligence, contract and scope, service-level terms, data-use rights, security review, business-continuity plans, and conflict-of-interest checks.

Obtain and evaluate relevant SOC reports, independent assurance, release notes, known limitations, and control exceptions; determine what bank- or credit-union-specific testing is necessary.

Document the institution's own configuration, overrides, data mapping, assumptions, custom code, and approval of vendor changes.

Monitor vendor performance, data quality, incidents, model changes, support tickets, service issues, and unresolved findings.

Maintain a contingency plan for unavailable data, platform interruption, or vendor failure. Be ready to explain which conclusions management independently owns rather than accepting a vendor report without challenge.

8. Model validation, outcomes analysis, and change management

Model validation should cover spreadsheets, statistical models, vendor platforms, loss-rate methods, and management overlays, and remain independent of ACL calculation, credit approval, and day-to-day ownership. Use a risk-based approach to set the scope, depth, documentation, and review frequency

Maintain an inventory of each methodology and model, including its owner, purpose, inputs/outputs, dependencies, materiality, and next review trigger.

Complete an initial review before first use or material deployment, then set a risk-based cadence based on size, complexity, exposure, materiality, methodology, and model dependence.

Evaluate conceptual soundness, including methodology, assumptions, segmentation, loss definitions, forecasts, reversion, Q factors, data selection, expert judgment, limitations, vendor customizations, and fit for purpose.

Trace and test the process end-to-end—from source data through segmentation, calculation, adjustments, approval, booking, and disclosures.

Compare expected losses with realized charge offs, recoveries, defaults, or other outcomes at appropriate aggregate and segment levels.

Retain reports, workpapers, management responses, approvals, and explanations for unusual volatility or differences between expected and realized outcomes.

9. Audit findings, remediation, and management responses

Open findings are easier to discuss when management can show ownership, risk assessment, interim controls, and a credible path to closure.

Inventory findings by source, period, portfolio, severity, root cause, accountable owner, target date, status, and related risk.

Write a management response that addresses the condition, agrees or disagrees with the finding, explains the risk, and states the specific corrective action.

Document interim or compensating controls when permanent remediation is not yet complete. Attach evidence for each completed action and obtain independent closure or validation where appropriate.

Escalate overdue, repeat, high-risk, or cross-functional issues to the appropriate committee and retain the escalation decision.

Show how remediation changed policy, data, code, configuration, training, vendor oversight, or review procedures.

Prepare a candid summary of what remains open, what has changed since the prior review, and what management will do next.

10. Common examiner and auditor questions

These are representative questions, not a guaranteed request list. Assign an owner to each answer and keep the answer tied to the period-specific evidence.

Why did you select this CECL method for each portfolio? Be ready with the method-selection rationale, portfolio characteristics, available data, term and prepayment considerations, limitations, alternatives considered, and approval.
Why are the segments reasonable, and how do you know the segments still share similar risk? Show segment definitions, risk-characteristic analysis, migration or mix monitoring, portfolio changes, and the process for adding, splitting, merging, or retiring pools.
How do you know the data is complete and accurate? Walk through authoritative sources, extraction logic, reconciliations, field-level checks, exception resolution, period archiving, and independent review.
What historical period or proxy did you use, and why is it relevant? Explain the lookback, definitions, data limitations, mergers or system changes, external sources, and how historical information is distinguished from current-condition and forecast adjustments.
How did the forecast and reversion affect the estimate? Identify the forecast horizon, variables, scenarios, sources, reversion method, historical anchor, sensitivity, approval, and rationale for the selected approach.
What is driving the Q factors, and how did you avoid double-counting? Trace each factor to a documented condition, source, cause-and-effect relationship, direction, magnitude, period, owner, approval, and review of overlap with model inputs.
Why did the allowance move from the prior period? Use an attribution that separates volume, credit quality, charge offs, forecast, reversion, Q factors, segmentation, methodology, and data or system changes.
How did prior estimates compare with actual outcomes? Present backtesting or outcomes analysis at useful portfolio levels, explain material differences and timing effects, and show what management changed or why it retained the approach.
Who validated the process, and how was independence addressed? Describe the validator's role, expertise, reporting line, scope, timing, limitations, findings, management responses, and closure or monitoring.
What has changed since the last examination or audit? Use the change log to cover new products, portfolio composition, data sources, code, software releases, assumptions, forecasts, reversion, Q factors, vendors, findings, and control changes.
How does the booked allowance reconcile to the calculation and disclosures? Show the calculation-to-GL tie-out, provision entry, roll-forward, regulatory-report or financial-statement reconciliation, disclosure support, and review sign-offs.
Which third parties support the estimate, and how do you oversee them? Provide the third party inventory, due diligence, contract scope, assurance reports, customization and configuration, performance monitoring, findings, and contingency plan.

11. CECL audit checklist: document-request readiness

The best time to assemble these materials is before the first request. Keep a period-specific index with file name, owner, date, version, sensitivity classification, and the answer or question the file supports.

Documents to organize

Current and prior CECL/ACL policies; board and committee minutes; ACL approval memos; organization chart; roles; training; management challenge and attribution.

Methodology narrative; method-selection rationale; model or spreadsheet documentation; segment definitions; scope matrix; definitions; limitations; manual adjustment policy.

Source extracts; data dictionary; mapping and query logic; segment population; data-quality tests; reconciliation files; exception log; archived inputs.

Charge offs, recoveries, defaults, exposure and loss-rate schedules; historical data reconciliation; external data; proxies; merger or system-conversion analysis.

Forecast package; scenario files; economic variables; forecast horizon; reversion analysis; sensitivity; approval; historical anchor; change log.

Q-factor memo; factor roll-forward; supporting metrics; cause-and-effect analysis; magnitude calculation; double-counting review; approval and challenge.

Calculation package; output files; allowance roll-forward; provision entry; GL tie-out; regulatory-report and financial-statement reconciliation; disclosures.

Validation plan and report; independence statement; conceptual soundness review; process tests; benchmarking; backtesting; outcome analysis; sensitivity analysis; findings and remediation.

Model and methodology version history; code/configuration changes; vendor release notes; data-source changes; assumptions; new products; implementation testing; approvals.

Third party inventory; due diligence; contracts; SOC or assurance reports; vendor model documentation; configuration; monitoring; incidents; contingency plan.

Prior exam, audit, internal-audit, loan-review, consultant, and validation reports; management responses; action plans; closure evidence; auditor communications to the board or audit committee.

Ready when:

Approvals, challenges, and decisions can be traced to the reported period.

A new reviewer can reproduce the "why" and "how" without relying on oral history.

Inputs tie to authoritative sources and exceptions have documented resolutions.

Definitions, periods, denominators, and adjustments are clear for every segment.

Management can explain the forecast, the transition beyond it, and what changed.

Each factor has a source, owner, amount, period, rationale, and conclusion.

Reported amounts agree across systems or differences are explained and approved.

The reviewer can see scope, evidence, limitations, conclusions, and closure status.

Changes since the last review are complete, dated, risk-assessed, and traceable.

Management can explain what the vendor does, what it does not do, and how the institution challenges it.

Open items, repeat issues, and completed remediation are summarized in one tracker.

Clear, credible output you can trust. Get a complimentary calculation from Abrigo experts.

Learn more

This blog was written with the assistance of ChatGPT, an AI large language model, and was reviewed and revised by the subject-matter expert. The information, content and materials provided through this website are for informational purposes only and are not intended to constitute legal advice. Customers should consult with their legal counsel regarding the application of laws and regulations to their specific circumstances.

Looking for 360 View?