The Gap in the Three Lines of Credit Risk Management Defense

I started my banking career in the credit management training program of a regional bank, where I later became the head of corporate banking. Subsequently, I became a chief credit officer and, ultimately, the CEO and board chairman of a community bank. This experience, coupled with 30 years of providing credit risk management services for banks from de novos to one of the 10 largest financial institutions in the world, has allowed me to see many changes in the way banks’ credit risk management (CRM) identifies, measures, monitors, controls and reports credit risk. There have been some very good improvements – along with some activities that miss the mark on best practices.

Strategy without execution is ineffective at best. Whether it is football or banking, execution is the key to success. Execution of strategy for CRM’s three lines of defense requires that each line must perform its job and communicate with the other two lines for the “team” to win.

What I have observed for many years now is that the members of the first line – like client-facing loan officers and relationship and portfolio managers – are often too focused on production and minimize their role as the first line of defense as it relates to credit risk issues and red flags. Communication with borrowers is often lacking or reactive, and isn’t documented, except in a sales capacity. This became more apparent during the early stages of the Covid-19 pandemic, when banks critically needed more information on their borrowers and the first line was often unprepared.

How can the second line of credit risk management defense – like credit officers, credit departments and loan approvers – do their job properly without up-to-date information? How can the third line – loan review, internal audit and compliance – do their job without up-to-date information? Quite simply, they can’t. If the key link in the chain does not perform to best practices, the chain breaks.

I once made a presentation to a bank board and a director took issue with my mentioning that the bank was not receiving borrower financial statements promptly and analyzing them. He told me that the bank was doing great, with no delinquencies or charge offs, and that getting financial statements was merely paperwork without any value. What he did not understand, of course, was that delinquencies and charge-offs were lagging indicators; the financial statements – or lack thereof – were leading indicators. This principle remains true today: Banks have better results in problem loan situations when they can detect problems early and deal with them before it is too late to effectively negotiate with the borrower.

For the safety and soundness of a bank’s asset quality, and the protection of all constituencies, better monitoring of borrowing relationships and their risk profiles by the first line makes all three lines more effective. This ultimately improves a bank’s portfolio performance, profitability and asset quality and can be accomplished without harming production, since additional borrower contact can also present new opportunities for sales. Bank management can promote this mindset with more focus on matching job descriptions and performance reviews to incentive compensation, with a significant component tied to continuous monitoring of borrowers. The now-frequently unused practice of a regular customer calling program, with documented call reports on substantive credit issues, could substantially improve the first line’s performance.

Now is the time for banks to act. The board and management team must emphasize and focus on this priority to all three lines, rather than waiting for the shoe to drop. Many borrowers may be under their institution’s radar, due to deferrals and Paycheck Protection Program loans masking their true operational and financial position. Every bank’s portfolio contains borrowers at risk as the economy continues reflecting the challenges of the past several years and deferrals expire. The first line can mitigate the potential damage through more intensive customer contact to detect issues of concern.