The ability to identify and manage credit risk is a critical part of a bank’s overall risk management program. Banks with sound credit risk management programs are well-positioned to proactively modify policies and underwriting practices to respond to emerging risks. A key component of an effective risk management program is a strong credit management information system (MIS), which uses loan-related data to develop timely and meaningful reporting for a bank’s board of directors and senior management. Credit MIS reports are used by senior management and board members to oversee lending activities and support strategic decision making. The complexity of credit reporting may vary based on the size of the institution and the nature of the lending activities, but the principles of sound credit MIS apply to all institutions.
The FDIC conducted an analysis of the credit MIS programs at 24 large state nonmember banks1 representing a range of lending activities and geographic markets. Typically, these credit MIS programs did a good job tracking loan delinquencies, charge- offs, and other measures of current loan portfolio performance. Such metrics tend to be “lagging” indica- tors of risk, in the sense that they provide after-the-fact evidence of a credit-quality issue. Many of the credit MIS programs in our review had significantly less coverage of “forward- looking” risk indicators, which can be indicative of future performance and should be the focus of a sound credit MIS program to proactively identify and mitigate risk exposure. This article illustrates how banks can strengthen credit MIS by incorporating forward- looking risk indicators and establishing a sound governance framework. The article is intended as an informational resource for interested persons. It does not create new requirements or super- visory expectations and is not required reading for any banker.
Forward-looking and Lagging Risk Indicators
Performance metrics — such as charge-off rates, delinquency ratios, nonaccrual loans, and restructured loans — are an integral part of a credit MIS program. The board and senior management can use these ratios to help assess the bank’s current asset quality and overall financial condi- tion. Management often will establish thresholds for these ratios to help define the institution’s risk appetite.2 However, once these ratios fall outside risk thresholds, it can be difficult for senior management to prevent further deterioration in asset quality. Regu- lar review of more forward-looking indicators can help management to proactively assess risks that drive these performance ratios. The follow- ing scenario describes how a credit MIS program that relies too heavily on performance-based, lagging risk indica- tors can result in inadequate risk iden- tification, and lead to decisions based on an incomplete understanding of the risks facing the institution.
These examples are intended to suggest the importance of forward- looking risk indicators as part of credit MIS programs in driving strategic decisions regarding lending. Bank A’s board and senior management did not consider what was driving loan growth (e.g., underwriting quality), or how it potentially skewed the Bank’s performance metrics. Poor underwriting practices can take time to manifest in performance ratios, particularly when growth inflates the denominator of those ratios. Effective risk management practices were lacking in Bank A. The board should have understood what was fueling the Bank’s loan growth before making strategic decisions.
Forward-Looking MIS Considerations
The federal bank regulatory agencies have communicated the importance of forward-looking MIS reporting. Part 364 of the FDIC’s Rules and Regulations – Standards for Safety and Soundness states that an institution should provide periodic asset reports with adequate information for management and the board of directors to assess the level of asset risk.3 For commercial loans, useful forward-looking information that often is tracked by effective credit MIS programs includes portfolio stratification by loan-to-value (LTV) for loans secured by real-estate, debt service coverage ratio (DSCR) policy exceptions, and loan grade migrations. For retail loans, effective credit MIS programs often track production and portfolio trends by product, credit score, LTV, debt-to-income (DTI) ratio, lien position, market, and property type as applicable. The table on page 6 provides an overview of selected metrics that credit MIS programs can track to provide useful, forward-looking risk information that supports strategic decisions regarding banks’ lending programs.4
Report Type | FORWARD-LOOKING CREDIT METRICS | |||
|---|---|---|---|---|
| Purpose | Wholesale Metrics | Retail Metrics | Effective Practices | |
| Loan Policy Exceptions | Monitor compliance with board approved policies. Evaluate changes to policies and/or practices based on results. |
|
|
|
| Underwriting Trends | Track trends in key underwriting metrics to help assess level and direction of portfolio credit risk. |
|
|
|
| Loan Grading | Analyze distribution of loan grades and migrations over time. |
|
|
|
| Concentrations | Track large credit exposures in relation to capital. |
|
|
|
| Risk Appetite | Monitor performance and risk indicators against policy limits and risk appetite statement. |
|
|
|
In summary, the Effective Practices highlighted in the table share a common theme: the need for reporting that effectively identifies and analyzes existing and potential risks. For example, looking at the Concentrations category, it is not uncommon for banks to simply list the concentration limit and the outstanding exposure, without providing additional information. An institution relying on this type of reporting may not have an adequate basis for considering whether that limit continues to be appropriate, and if new risks are emerging. As illustrated in the table, Effective Practices include analyzing the risks within those exposures, including the distribution of internal loan grades that comprise that concentration and what stage of the economic cycle that particular industry is in. Simply put, credit MIS should provide a meaningful tool for the board and management to effectively address the inherent and emerging risks facing the bank.
There is no “one size fits all” approach to determining the content and format of credit MIS, and track- ing all the items described above may not be necessary for some institutions. For any institution, however, credit MIS reports that track forward-looking metrics of risk in the loan portfolio (that is, that go beyond tracking lagging risk measures such as delinquencies and charge-offs) can enhance manage- ment’s ability to make sound decisions about the strategic direction of the lending function.
Governance
An effective governance frame- work consists of sound policies and processes that provide a strong control environment and support strategic decisions. The formality and structure of a governance program can vary greatly depending on the size and complexity of an institution. However, governance as it relates to credit MIS is straightforward: the board and senior management should receive timely, meaningful, and accurate reporting in a format that clearly identifies risks and this information should be considered by management as it makes strategic decisions about the lending function. Consideration of a few basic questions can help ensure effective governance of a bank’s credit MIS programs.
- Are credit MIS reports being used to inform decision-making as an integral part of the risk management process, and does adequate documentation exist to support this process?
The FDIC has observed that often, board or committee minutes will simply state with regard to credit MIS, “reports reviewed and approved as presented,” with no further discussion. Credit risk reporting is most effective when it assists bank management in monitoring risks, setting risk limits, and providing support for strategic decisions. For larger institutions, bank supervisors typically expect such reporting and metrics should be developed and analyzed as part of the bank’s independent risk management process. - Are the reports being received in a timely manner, allowing sufficient time for review and discussion before important decisions are made?
Committee and board packets are often lengthy. If the board or committee members receive the reports shortly before a meeting, there may be insufficient time for thoughtful review of the materials which is critical for informed decision-making. - Is the complexity and detail of the reporting adjusted for different levels within the organization?
Reporting is most effective when it is tailored to the specific audience. Although it may be appropriate for a line of business to have detailed reports, that level of reporting may not be helpful to board or senior management committee members. A more high-level report that succinctly describes key risks may be more suitable for this audience. - Is ad hoc reporting effectively used?
Assessing credit risk is a dynamic process. As new risks emerge, an effective credit MIS program is suffi- ciently flexible to expand or develop new reporting to assess the effect those risks may have on the institu- tion’s operations. - Does reporting include appropriate trend analysis?
Generally speaking, credit MIS reporting is likely to be most useful when it encompasses trend analysis looking back several years. A report that tracks the volume of loan policy exceptions only over recent quarters may suggest a rather nominal excep- tion rate; however, when measured over the longer term, those excep- tion rates may be material. - Does reporting overly rely on the use of averages?
Credit MIS reports that rely heavily on averages to capture the level of risk may miss important aspects of the risks facing banks. For example, using the average DSCR to conclude that a bank’s loans have strong repayment capacity ignores the fact that an average may include loans with inadequate DSCRs that pose direct risk of loss to the bank.
Preserving data integrity also falls under the governance framework. To be useful for decision-making, credit MIS reports should be based on accu- rate and timely data. For larger institu- tions, the process may include the use of a data warehouse and a centralized reporting group. Challenges may occur when a bank converts to a new data processing system, or acquires another institution that that may have different data management and reporting capa- bilities. Developing and maintaining a strong data integrity function would typically involve:
- Coordinating with the institution’s data service provider or internal Information Technology (IT) depart- ment to determine reporting options and the use of data fields.
- Developing a method to internally track and retain important loan- related data (LTV, net operating income (NOI), credit bureau scores, DSCR, etc.).
- Ensuring consistency of data use and calculations. For example, are the DSCRs used in reporting based on the most recent loan presen- tation, independent loan review report, or calculation provided by the applicable loan officer?
- Incorporating a review of data integ- rity within the internal or external audit scope.
Data availability and integrity chal- lenges may vary between large and small banks; however, the quality of information used in credit MIS reports that support strategic decisions about lending is a topic of relevance to all institutions.
Conclusion
Credit risk management is a dynamic process that, to be effective, requires the use of meaningful reporting within a strong governance structure. An effective credit MIS program provides a bank’s board of directors and senior management with critical information to identify and proactively respond to emerging risks and support strategic decisions. Strengthening credit MIS to reflect a more forward-looking view of credit risk may enhance an institu- tion’s risk management framework and contribute positively to its long- term success.
Michael McGarvey
Senior Large Financial Institution Analys
Division of Risk Management Supervision
mmcgarvey@fdic.gov
1 The analysis included state nonmember banks with over $10 billion in total assets.
2 A risk appetite statement defines the types and levels of risks that the bank is willing to accept in key areas in order to achieve its strategic goals.
3 Section 39 of the Federal Deposit Insurance Act requires the federal banking agencies to prescribe, by regulation or guidelines, standards for safety-and-soundness that include, in relevant part for purposes of this article, standards regarding information systems, internal controls and credit underwriting. The FDIC codified these standards as guidelines in Appendix A of Part 364 of its rules and regulations.
4 Further discussion and recommendations regarding credit MIS systems are contained in the interagency releases, “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices,” 71 Federal Register 74580–74588, December 12, 2006, https://www.federalregister.gov/documents/2006/12/12/06-9630/concentrations-in-commercial-real-estate-lending-sound-risk-management-practices, and “Home Equity Lending: Credit Risk Management Guidance,” FDIC FIL-45-2005, May 24, 2005.
5 An interest reserve allows a lender to periodically advance loan funds to make interest payments on the borrower’s debt. Improper use of interest reserves can result in the masking of delinquencies and the failure to identify and report problem loans.
6 Appendix A to Part 365 of the FDIC’s Rules and Regulations requires that real estate loans originated in excess of Supervisory LTV Guidelines be identified in the institution’s records, and their aggregate amount reported at least quarterly to the institution’s board of directors. The aggregate amount of all loans in excess of the supervisory loan-to-value limits should not exceed 100 percent of total capital. Moreover, within the aggregate limit, total loans for all commercial, agricultural, multifamily or other non-1-to-4 family residential properties should not exceed 30 percent of total capital. An institution will come under increased supervisory scrutiny as the total of such loans approaches these levels.
7 A roll-rate report uses historical delinquency and default data to analyze the migration of delinquent loans. For example, a bank may track monthly delinquency volume to determine what percentage of retail borrowers that become 30 days delinquent typically become 60 days elinquent, and what percentage of those 60 day delinquencies result in defaults. This analysis is beneficial in analyzing delinquency trends, as well as providing support for allocations to the ALLL.