Loan Review Best Practices: Key to Combatting Credit Risk

Written by

Despite current benign credit metrics, there’s a growing industry-wide sentiment that credit stress looms ahead.

There’s a proven correlation between early detection of emerging credit risk and reduced losses. Effective and efficient loan reviews can help your institution better understand the portfolio and identify potential risk exposures. Now is the time for banks to ensure their loan review, either in-house or external, can proactively identify potential credit weaknesses, gain deep knowledge about the subsegments of the portfolio, learn where the vulnerabilities exist and act to mitigate risk at the earliest opportunity. It’s time to emulate a whole new set of loan review best practices:

1. Trust your reviews to professionals with deep credit experience — not just junior CPAs.
Your reviewers should be seasoned experts that are skilled in the qualitative and quantitative axioms of credit, with hands-on experience in lending and risk management. Because their experience will drive better reviews and deliverables, it’s a good idea to ask for biographies of people assigned to your institution.

2. Confirm your review includes paralegal professionals to conduct separate documentation reviews.
It is essential that your loan reviews include specialists with technical expertise in regulatory and legal compliance, lending policy adherence, policies, collateral conveyances, servicing rules, among others — working in tandem with seasoned credit professionals.

3. Insist on smart, informed sampling.
To uncover vulnerabilities in specific segments of the portfolio, rely on a selection process that helps you choose very informed samples indicating possible emerging risk.

4. Quantify both pre- and cleared documentation, credit and policy exceptions.
In the best of times, many loan reviews show almost no bottom-line degradation in loan quality for the portfolio as a whole. On close examination, you may find significant numbers of technical and credit exceptions indicating that the quality of your lending process itself may need to be tweaked.

5. Understand your own bank’s DNA.
In this complex economic environment, it is imperative for institutions to analyze their own idiosyncratic loan data. Arm your loan review team with the ability to automatically drill down into the portfolio and easily examine trends and borrower types to inform risk gradings, assess industry and concentration risk, along with other variables. Seasoned reviewers will be incredibly valuable in this area.

6. Observe pricing based on risk grades, collateral valuations and loan vintages.
Loans originating around the same time and credits that tend to migrate as a group tend to share common risk characteristics. Isolating and analyzing those credits can answer the important question, “Are you being paid for the risk you’re taking?”

7. Pair loan reviews with companion stress testing.
Regulators are encouraging stress tests as a way for banks to learn where their risk may be embedded. Companioning the tests with loan reviews is a productive way to gain this knowledge. Start at the portfolio level and do loan-level tests where indicated.

8. Transparently report and clear exceptions in real time.
Banks can benefit from using fintech’s efficiency to remove huge amounts of time, team meetings and staff intrusions from the traditional process of reviewing loans. An online loan review solution gives teams a way to see exception activities and clearances as they happen.

9. Comply with workout plan requirements prescribed by interagency regulators.
Banks typically design workout plans to rehabilitate a troubled credit or to maximize the collected repayment. Regulators now require institutions to examine these plans independently as a standard loan review procedure that reflects a healthy degree of objectivity.

10. Deliver comprehensive management reports and appropriate high-level board reports with public/peer data.
Management should receive prompt and thorough loan review reports; board members should receive high-level reports with appropriate, but less detailed, information. Public data or analyses of your institution’s performance as compared to peers should accompany this reporting.

11. Conduct loan reviews as a highly collaborative and consultative exercise — counter to “just another audit.”
An effective loan review is not an internal audit experience. It’s an advisory process, and this approach is extremely important to its ultimate success. Substantive dialogue among participants with differences of opinion is key to favorable outcomes for the institution.

12. Take advantage of a technology platform to automate every possible aspect of the loan review process.
Best practices call for the efficiency that comes with automating the loan review process to the maximum extent possible, without sacrificing substance or quality. Technology enables faster and more complete early detection of vulnerabilities.

Loan reviews are critical to an institution’s risk-management strategy. It’s a one-two punch: Deeply qualified reviewers combined with automated technology that delivers a more efficient, less intrusive loan review process that will help combat the looming credit stress ahead.

Banking’s March Madness Postgame

Written by

After every significant banking crisis, it becomes clear what transpired and how it could have been avoided.

There are two key takeaways from the March bank failures that directors and their senior management team should capitalize on. They should put on a new set of lens and take a fresh look at:

  1. Enterprise risk management practices.
  2. Liquidity risk measurement and management.

What happened in March resulted mainly from a breakdown in management and governance. It is a reminder that risk management is highly interconnected among liquidity, interest rate, credit, capital and reputation risks. Risk management must be a mindset that permeates the entire institution, is owned by the c-suite and is understood by the board.

Here are a few things for directors to ponder while revisiting enterprise risk management governance:

  • Be realistic about potential risks. Listen to, and address, data-driven model outcomes. Refrain from influencing results to reflect a preferred narrative.
  • Understand key assumptions and their sensitivities. Assumptions matter.
  • Bring data to the surface and breathe life into it; value data analytics.
  • Accept that the days of “set it and forget it” policy limits and assumptions are over.
  • Revisit attitudes regarding validating risk management processes and models: Are they a check the box “exercise” or a strategically important activity?
  • Ask what could go wrong and what should we monitor? How thorough and realistic are preemptive and contingency strategies?
  • Acknowledge that stress testing is not for bad times — by then, it’s too late.
  • Cultivate an environment of productive, effective challenge.

Banks and their asset/liability management committees are under stronger regulatory microscopes. They will be asked to defend risk management culture, processes, risk assessments, strategies and overall risk governance. Be prepared.

Telling Your Liquidity Management Story
The March bank failures accentuated the critical importance of an effective liquidity management process — not just in theory, but in readiness practice. Your institution’s liquidity story matters.

Start with your liquidity definition. Most define liquidity by stating a few key ratios they monitor – but that’s not expressing one’s liquidity philosophy. Bankers struggle to put their liquidity definition into words, which can lead to an inadvertent focus on ratios that conflict with actual philosophy. This can result in suboptimal outcomes and unintended consequences. One definition banks could adopt is: “Liquidity is my bank’s ability to generate cash quickly, at a reasonable cost, without having to take losses.”

A bank can readily construct a productive framework around a meaningful definition. Given the notoriety around unrealized losses on assets and potentially volatile deposits, be clear that how the bank manages its liquidity does not depend on selling assets.

Construct a liquidity framework that supports this notion with four elements:

  1. Funding diversification.
  2. Concentration and policy limits.
  3. Collateral management.
  4. Stress testing and contingency planning.

Funding diversification should consider Federal Home Loan Bank, Federal Reserve programs, repurchase agreements (repos), brokered and listing service deposits and fed funds lines. The ability to manage larger relationships with insured deposit programs, such as reciprocal and one-way, FHLB letters of credit and customer repos is also an integral part of funding diversification. Make sure your institution tests all sources periodically and understand settlement timelines.

Funding concentrations must be on your radar. The board and executives need to establish policy limits for all wholesale deposit and borrowing sources, by type and in aggregate. There should also be limits that apply to specific customer deposit types such as public, specialty/niche, reciprocal and others. The bank should track and monitor uninsured deposits, especially those that are tied to broader, larger relationships, and reflect that in operating and contingency liquidity plans. Take a deep dive into your bank’s deposit data; there is a significant difference between doing a core deposit study and studying your deposits.

Collateral doesn’t matter unless it is readily available for use. Ensure all available qualifying loan and security collateral are pledged to the FHLB and Fed. Determine funding availability from each reliable source and monitor capacity relative to uninsured deposits, especially the aggregate of “whale” accounts.

Also, understand how each funding source could become restricted. Ensure your contingency liquidity management process captures this with well-defined stress tests that simulate how quickly, and to what degree, a liquidity crisis could materialize. Understand what it would take to break the bank’s liquidity, and ensure that key elements fueling this event are monitored and preemptive strategies are clearly identified.

Step back and look at your institution’s risk management policies, keeping in mind that they can become unnecessarily restrictive, despite good intentions. Avoid using “if, then” statements that force specific actions versus a thoughtful consideration of alternative actions. Your bank needs appropriately flexible policies with guardrails, not straightjackets.

The conversation on risk management and related governance at banks needs to change. Start with a fresh set of lens and a willingness to challenge established collective wisdom. Dividends will accrue to banks with the strongest risk management cultures and frameworks, with an appreciation for the important role of assumption sensitivity and overall stress testing. Ensure that clarity drives strategy — not fear.

Dusting Off Your Asset/Liability Management Policies

Written by

Directors reviewing their bank’s asset/liability management policy in the wake of recent bank failures should avoid merely reacting to the latest crisis.

Managing the balance sheet has come under a microscope since a run on deposits brought down Silicon Valley Bank, the banking subsidiary of SVB Financial Group, and Signature Bank, leading regulators to close the two large institutions. While most community banks do not have the same deposit concentrations that caused these banks to fail, bank boards should ask their own questions about their organization’s asset/liability strategies.

A bank’s asset/liability management policy spells out how it will manage a mismatch between its assets and liabilities that could arise from changing interest rates or liquidity requirements. It essentially provides the bank with guidelines for managing interest rate risk and liquidity risk, and it should be reviewed by the board on an annual basis.

“With both Silicon Valley Bank and Signature Bank, you had business models that were totally different from a regular bank, whether it’s a community bank, or a regional or even a super regional, the composition of their asset portfolios, the composition of their funding sources, were really different,” says Frank “Rusty” Conner, a partner at the law firm Covington & Burling. “Anytime you have a semi-crisis or crisis like we’ve had, you’re going to reassess things.”

Conner identifies three key flaws at play today that mirror the savings and loan crisis of the 1980s and 90s: an over-concentration in certain assets, a mismatch between the maturities of assets and liabilities, and waiting too long to recognize losses.

Those are all lessons that directors should consider when they revisit their bank’s asset/liability management policies and programs, he says.“Is there any vulnerability in our policies that relates to concentration or mismatch, or failing to address losses early?”

In order to do that, directors need to understand their bank’s policies well enough to ask intelligent and challenging questions of the bank’s management. The board may or may not have that particular subject matter expertise on its risk, audit or asset/liability committee, or in general, says Brian Nappi, a managing director with Crowe LLP.

“I don’t think there’s a deficiency in policies per se,” he adds. “It’s the execution.”

Nappi recommends that boards seek to “connect the dots” between their company’s business strategy and how that could fare in a changing interest rate environment.

Conner raises a similar point, questioning why some banks had so much money invested in government securities when the Federal Reserve was telegraphing its intent to eventually raise interest rates.

“That whole issue just looks so clear in hindsight now, and maybe that’s unfair,” he says. “But why is it that we didn’t anticipate that, and are we in a better position today to anticipate similar types of developments in the future?”

Boards could consider bringing in an outside expert to review the asset/liability management policy, says Brandon Koeser, a senior analyst with RSM US. A fresh set of eyes, such as an accounting firm, consultant or even a law firm, can help the board understand if its framework is generally in line with other institutions of its size and whether it’s keeping pace with changes in the broader economy.

“You also want to think about the [asset/liability management] program itself, separate from the policy, and how often you’re actually going through and reviewing to make sure that it’s keeping pace with change,” Koeser adds.

Steps to Take: Revisiting the Asset/Liability Management Policy

  • Establish and understand risk limits.
  • Consider how to handle policy exceptions.
  • Define executive authority for interest rate risk management.
  • Outline reports the board needs to monitor interest rate risk.
  • Establish the frequency for receiving those reports.
  • Evaluate liquidity risk exposure to adverse scenarios.
  • Understand key assumptions in liquidity stress testing models.
  • Review guidelines around the composition of assets and liabilities.
  • Monitor investment activities and performance of securities.
  • Review contingency funding plans.

Directors should also ask management about any liquidity stress testing the bank may be engaging in. Do directors fully understand the key assumptions in the bank’s stress testing models, and do they grasp how those key assumptions could change potential outcomes?

And if executives tell the board that the bank’s balance sheet can withstand a 30% run off of deposits in a short period of time, directors shouldn’t be satisfied with that answer, says Matt Pieniazek, CEO of Darling Consulting Group, a firm that specializes in asset/liability management. The board should press management to understand exactly how bad losses would need to be to break the bank.

“Directors don’t know enough to ask the question sometimes. They’re afraid to show their stress testing breaking the bank,” he says. “They need to have the opposite mindset. You need to understand exactly what it would take to break the bank. What would it take to create a liquidity crisis? How bad would it have to get?”

Sometimes policies tend to be too rigid or not descriptive enough, adds Pieniazek.

“The purpose of policies is not to put straighBtjackets around people,” he says. “If you have to look to policies for guidance, you want to make sure that they have an appropriate amount of flexibility and not too much unnecessary restrictiveness.”

Many banks’ policy limits concerning the use of wholesale funding — such as Federal Home Loan Bank advances and brokered deposits — are too strict and unnecessarily constrained, Pieniazek says. “A lot of them will have limits, but they’re inadequate or the limits are not sufficient, both individually and in the aggregate.”

An example of this might be a policy that stipulates the bank can tap FHLB funding for up to 25% of its assets and the Federal Reserve discount window for up to 15% but restricts the bank from going above 35% in the aggregate.

Along those lines, directors should make sure management can identify all qualifying collateral the bank might use to borrow from the Federal Reserve or FHLB, taking into account collateral that may have been pledged elsewhere. And directors should revisit any overly rigid policies that could tie executives’ arms in a liquidity crunch. A policy stipulating that a bank will sell securities first may prove too inflexible if it means having to sell those securities at a loss, for instance.

A board will also want to understand whether its asset/liability management plan considers the life cycle of a possible bank run. In that kind of scenario, how much would the bank depend upon selling assets in order to meet those liquidity needs? And what’s the plan if some of its securities are underwater when that happens?

While the most recent banking crisis doesn’t necessarily mean bank boards need to overhaul their asset/liability management policies, they should at least review those policies with some key questions and lessons in mind.

“If your regulator comes in, and they see dust on the cover of the ALM policy,” says Koeser, “and they see that the liquidity stress test or scenario analysis aren’t appropriately incorporating shocks or stressors, it could be a difficult conversation to have with your regulator on why there weren’t changes.”

Additional Resources
Bank Director’s Board Structure Guidelines include a resource focused on ALCO Committee Structure. The Online Training Series includes units on managing interest rate risk and model validation. For more about stress testing to incorporate liquidity, read “Bank Failures Reveal Stress Testing Gaps.”

Bank Failures Reveal Stress Testing Gaps

Written by

Within days of Silicon Valley Bank’s failure on March 10, Democratic lawmakers quickly pointed out that the bank’s holding company, $212 billion SVB Financial Group, and $110 billion Signature Bank, which failed days later, weren’t subject to regular stress tests mandated for the largest banks under the Dodd-Frank Act. The requirement for mid-sized banks, between $50 billion and $250 billion in assets, had been rolled back in 2018.  

But the stress test scenarios developed by the Federal Reserve largely focused on adverse impacts on credit and declining interest rates. In contrast, SVB’s failure had its roots in a rising rate environment that led to an unprecedented deposit run; the Fed’s Vice Chair for Supervision, Michael Barr, testified on March 28 that customers were set to withdraw $142 billion in deposits over two days — roughly 82% of the bank’s total deposits.  

“When we think of stress testing, the key word is stress,” says Brandon Koeser, senior manager and financial services industry senior analyst at RSM US. “When you think of true stress and how that impacts the organization as a whole, it can be credit — but it should also hit liquidity, it should hit capital, and then look at earnings and profitability.” 

Internal stress testing is a regular practice for community banks, according to Bank Director’s 2023 Risk Survey. More than three-quarters of executives and directors say their institution conducts an annual stress test. This can be a valuable exercise that helps boards and leadership teams understand the impact of adverse events on their organization. 

Members of the Bank Services Program can access the complete results to all Bank Director surveys, by asset size and other attributes.

“Banks have enough resources, even small banks, to do some simple stress testing and put pen to paper,” says Patrick Hanchey, a Dallas-based partner at Alston & Bird. The results should be shared with the board, with the discussion reflected in the meeting minutes. “You can take small steps to show that you’ve been thoughtful,” he says. “That’s all the stress test is — thinking about, ‘What if x happens? What do we do, and how does it affect us?’”

Banks should build scenarios that consider account types and depositor behavior, says Sean Statz, a senior manager at Baker Tilly. “We’ve been doing data analytics on the loan portfolio forever,” he says. “Data analytics around the deposit portfolio is going to be a big focus to better understand what [the] portfolio is made up of [and] what could happen [so banks can] start applying some assumptions.” It’s easier to forecast behavior around assets, due to set terms around investments, borrowings and loans. Industry-level assumptions around deposit activity can help fill in some gaps.

The recent bank failures spotlight a key area of risk: deposit concentrations within particular sectors or industries. While much has been made of uninsured deposits, Hanchey cautions that these aren’t necessarily bad if they’re managed safely and soundly. Deposits from municipalities, for example, can be quite stable. Decision-makers should understand how those deposits are concentrated.

Hanchey adds that regulators within the Texas Department of Banking acted quickly to compare levels of uninsured deposits to the availability of other funding sources in a crunch, such as lines of credit from the Federal Home Loan Banks or correspondent banks. “Stress testing your FHLB advance capabilities, lines of credit from your correspondent banking relationships, access to the Fed [discount] window, all those traditional sources of liquidity that have always been important,” says Hanchey. “It’s a new focus on the interplay between those sources of liquidity and [a bank’s] ability to cover uninsured deposits.”

Scenarios should take multiple factors — credit, interest rates, liquidity — into account, helping decision-makers build a narrative that they can use to discuss and assess the impact on the organization, says Joe Sergienko, a client relationship executive at Treliant. They can then come up with a playbook for each scenario — essentially a decision tree that examines how leadership could react in different situations. “No scenario is going to play out exactly the way you forecast,” he says, “but it gives you [a] road map to say, ‘Here’s how we should manage our bank or our process through this.’”

And executives and boards should prepare for the absolute worst: the seemingly low-probability event that could break the bank, like massive outflows in deposits such as those that caused SVB and Signature Bank to fail. This reverse stress testing process provides clues to help leaders avert a disaster. At what point does the bank lose so much liquidity that it can no longer operate? How quickly could that occur?

Stress testing should help foster a larger conversation around risk, and strengthen risk management governance and policies, says Koeser. Scenarios and models should consider the bank’s size, geography and other factors relevant to the business, like concentrations on either side of the balance sheet.

Examiner scrutiny on risk management promises to get more onerous in the year ahead. “We should all expect the pendulum to swing toward heavy, heavy oversight and strict regulation of very discrete issues,” says Hanchey. “Banks should be prepared and have their answers ready when the regulators come in and ask them about things like deposit concentration, interest rate risk, stress tests, rising rate environments. The more proactive banks can be on the front end, the more pleasant their examination experiences will be.”

2023 Risk Survey Results: Deposit Pressures Dominate

Written by

In 2023, the overarching question on bank leaders’ minds is how their organization will fare in the next crisis.

That manifested in increased concerns around interest rates, liquidity, credit and consumer risk, and other issues gauged in Bank Director’s 2023 Risk Survey, sponsored by Moss Adams LLP. The survey was fielded in January, before a run on deposits imperiled several institutions and regulators began closing banks in March, including $209 billion SVB Financial Corp.’s Silicon Valley Bank.

Well before this turmoil, bank executives and board members were feeling the pressure as the Federal Open Market Committee raised rates, leading bankers to selectively raise deposit rates and control their cost of funds. Over the past year, respondent concerns about interest rate risk (91%), credit risk (77%) and liquidity (71%) all increased markedly. Executives and directors also identify cybersecurity (84%) and compliance (70%) as areas where their concerns have increased, but managing the balance sheet has become, by and large, their first priority.

Bank leaders name deposit pricing (51%) and talent retention (50%) among the top strategic challenges their organization faces in 2023. Sixty-one percent say their bank has experienced some deposit loss, with minimal to moderate impacts on their funding base, and another 11% say that deposit outflows had a significant impact on their funding base.

Net interest margins improved for a majority (53%) of bank leaders taking part in the survey, but respondents are mixed about whether their bank’s NIM will expand or contract over 2023.

Three-quarters of bank executives and board members report that business clients remain strong in spite of inflation and economic pressures, although some are pausing growth plans. As commercial clients face increasing costs of materials and labor, talent pressures and shrinking revenues, that’s having an impact on commercial loan demand, some bankers say. And as the Federal Reserve continues to battle inflation against an uncertain macroeconomic backdrop, half of respondents say their concerns around consumer risk have increased, a significant shift from last year’s survey.

Key Findings

Deposit Pressures
Asked about what steps they might take to manage liquidity, 73% of executives and directors say they would raise interest rates offered on deposits, and 62% say they would borrow funds from a Federal Home Loan Bank. Less favored options include raising brokered deposits (30%), the use of participation loans (28%), tightening credit standards (22%) and using incentives to entice depositors (20%). Respondents say they would be comfortable maintaining a median loan-to-deposit ratio of 70% at the low end and 90% at the high end.

Strategic Challenges Vary
While the majority of respondents identify deposit pricing and/or talent retention as significant strategic challenges, 31% cite slowing credit demand, followed by liquidity management (29%), evolving regulatory and compliance requirements (28%) and CEO or senior management succession (20%).

Continued Vigilance on Cybersecurity
Eighty-seven percent of respondents say their bank has completed a cybersecurity assessment, with most banks using the tool offered by the Federal Financial Institutions Examination Council. Respondents cite detection technology, training for bank staff and internal communications as the most common areas where they have made changes after completing their assessment. Respondents report a median of $250,000 budgeted for cybersecurity-related expenses.

Stress On Fees
A little over a third (36%) of respondents say their bank has adjusted its fee structure in anticipation of regulatory pressure, while a minority (8%) did so in response to direct prodding by regulators. More than half of banks over $10 billion in assets say they adjusted their fee structure, either in response to direct regulatory pressure or anticipated regulatory pressure.

Climate Discussions Pick Up
The proportion of bank leaders who say their board discusses climate change at least annually increased over the past year to 21%, from 16% in 2022. Sixty-one percent of respondents say they do not focus on environmental, social and governance issues in a comprehensive manner, but the proportion of public banks that disclose their progress on ESG goals grew to 15%, from 10% last year.

Stress Testing Adjustments
Just over three-quarters of respondents say their bank conducts an annual stress test. In comments, offered before the Federal Reserve added a new component to its stress testing for the largest banks, many bank leaders described the ways that they’ve changed their approach to stress testing in anticipation of a downturn. One respondent described adding a liquidity stress test in response to increased deposit pricing and unrealized losses in the securities portfolio.

To view the high-level findings, click here.

Bank Services members can access a deeper exploration of the survey results. Members can click here to view the complete results, broken out by asset category and other relevant attributes. If you want to find out how your bank can gain access to this exclusive report, contact [email protected].

2023 Risk Survey: Complete Results

Written by

Bank Director’s 2023 Risk Survey, sponsored by Moss Adams LLP, finds interest rates and liquidity risk dominating bank leaders’ minds in 2023.

The survey, which explores several key risk areas, was conducted in January, before a run on deposits imperiled several institutions, including $209 billion SVB Financial Corp., which regulators closed in March. Bank executives and board members were feeling pressure on deposit costs well before that turmoil, as the Federal Open Market Committee raised the federal funds rate through 2022 and into 2023.

Over the past year, respondent concerns about interest rate risk (91%), credit risk (77%) and liquidity (71%) all increased markedly. Executives and directors also identify cybersecurity and compliance as areas where their concerns have increased, but managing the balance sheet has become, by and large, their first priority.

Bank leaders name deposit pricing as the top strategic challenge their organization faces in 2023, and a majority say their bank has experienced some deposit loss, with minimal to significant impacts on their funding base. Most respondents say their No. 1 liquidity management strategy would be to raise the rates they pay on deposits, followed by increasing their borrowings from a Federal Home Loan Bank.

While SVB operated a unique business model that featured a high level of uninsured deposits and a pronounced concentration in the tech industry, many banks are facing tension as deposits reprice faster than the loans on their books.

Net interest margins improved for a majority of bank leaders taking part in the survey, but respondents are mixed about whether their bank’s NIM will expand or contract over 2023.

Click here to view the complete results.

Key Findings

Deposit Pressures
Asked about what steps they might take to manage liquidity, 73% of executives and directors say they would raise interest rates offered on deposits, and 62% say they would borrow funds from a Federal Home Loan Bank. Less favored options include raising brokered deposits (30%), the use of participation loans (28%), tightening credit standards (22%) and using incentives to entice depositors (20%). Respondents say they would be comfortable maintaining a median loan-to-deposit ratio of 70% at the low end and 90% at the high end.

Strategic Challenges Vary
While the majority of respondents identify deposit pricing and/or talent retention as significant strategic challenges, 31% cite slowing credit demand, followed by liquidity management (29%), evolving regulatory and compliance requirements (28%) and CEO or senior management succession (20%).

Continued Vigilance on Cybersecurity
Eighty-seven percent of respondents say their bank has completed a cybersecurity assessment, with most banks using the tool offered by the Federal Financial Institutions Examination Council. Respondents cite detection technology, training for bank staff and internal communications as the most common areas where they have made changes after completing their assessment. Respondents report a median of $250,000 budgeted for cybersecurity-related expenses.

Stress On Fees
A little over a third (36%) of respondents say their bank has adjusted its fee structure in anticipation of regulatory pressure, while a minority (8%) did so in response to direct prodding by regulators. More than half of banks over $10 billion in assets say they adjusted their fee structure, either in response to direct regulatory pressure or anticipated regulatory pressure.

Climate Discussions Pick Up
The proportion of bank leaders who say their board discusses climate change at least annually increased over the past year to 21%, from 16% in 2022. Sixty-one percent of respondents say they do not focus on environmental, social and governance issues in a comprehensive manner, but the proportion of public banks that disclose their progress on ESG goals grew to 15%, from 10% last year.

Stress Testing Adjustments
Just over three-quarters of respondents say their bank conducts an annual stress test. In comments, offered before the Federal Reserve added a new component to its stress testing for the largest banks, many bank leaders described the ways that they’ve changed their approach to stress testing in anticipation of a downturn. One respondent described adding a liquidity stress test in response to increased deposit pricing and unrealized losses in the securities portfolio.

CECL Model Validation Benefits Beyond Compliance

Written by

The current expected credit loss (CECL) adoption deadline of Jan. 1, 2023 has many financial institutions evaluating various models and assumptions. Many financial institutions haven’t had sufficient time to evaluate their CECL model performance under various stress scenarios that could provide a more forward-looking view, taking the model beyond just a compliance or accounting exercise.

One critical element of CECL adoption is model validation. The process of validating a model is not only an expectation of bank regulators as part of the CECL process — it can also yield advantages for institutions by providing crucial insights into how their credit risk profile would be impacted by uncertain conditions.

In the current economic environment, financial institutions need to thoroughly understand what an economic downturn, no matter how mild or severe, could do to their organization. While these outcomes really depend on what assumptions they are using, modeling out different scenarios using more severe assumptions will help these institutions see how prepared they may or may not be.

Often vendors have hundreds of clients and use general economic assumptions on them. Validation gives management a deeper dive into assumptions specific to their institution, creating an opportunity to assess their relevance to their facts and circumstances. When doing a validation, there are three main pillars: data and assumptions, modeling and stress testing.

Data and assumptions: Using your own clean and correct data is a fundamental part of CECL. Bank-specific data is key, as opposed to using industry data that might not be applicable to your bank. Validation allows for back-testing of what assumptions the bank is using for its specific data in order to confirm that those assumptions are accurate or identify other data fields or sources that may be better applied.

Modeling (black box): When you put data into a model, it does some evaluating and gives you an answer. That evaluation period is often referred to as the “black box.” Data and assumptions go into the model and returns a CECL estimate as the output. These models are becoming more sophisticated and complex, requiring many years of historical data and future economic projections to determine the CECL estimate. As a result of these complexities, we believe that financial institutions should perform a full replication of their CECL model. Leveraging this best practice when conducting a validation will assure the management team and the board that the model the bank has chosen is estimating its CECL estimate accurately and also providing further insight into its credit risk profile. By stripping the model and its assumptions down and rebuilding them, we can uncover potential risks and model limitations that may otherwise be unknown to the user.

Validations should give financial institutions confidence in how their model works and what is happening. Being familiar with the annual validation process for CECL compliance will better prepare an institution to answer all types of questions from regulators, auditors and other parties. Furthermore, it’s a valuable tool for management to be able to predict future information that will help them plan for how their institution will react to stressful situations, while also aiding them in future capital and budgeting discussions.

Stress testing: In the current climate of huge capital market swings, dislocations and interest rate increases, stress testing is vital. No one knows exactly where the economy is going. Once the model has been validated, the next step is for banks to understand how the model will behave in a worst-case scenario. It is important to run a severe stress test to uncover where the institution will be affected by those assumptions most. Management can use the information from this exercise to see the connections between changes and the expected impact to the bank, and how the bank could react. From here, management can gain a clearer picture of how changes in the major assumptions impact its CECL estimate, so there are no surprises in the future.

Tips to Navigate Top Risk Factors for Banks in 2021

Written by

Risk is always a prominent factor for banks. Their ability to strategically navigate change proved to be crucial in a year of unprecedented challenges caused by the Covid-19 pandemic.

Moss Adams partnered with Bank Director to conduct the 2021 Risk Survey that explored key risks facing the industry — and forecast how banks will emerge from the pandemic. Below is a summary of top insights from the survey, as well as considerations that bank leadership should keep front of mind as they go into the second half of the year.

Rising Credit Risk Concerns

Unsurprisingly, concerns around credit risk increased in 2020.

Two-thirds of bank respondents worry about concentrations in their loan portfolio, particularly around industries significantly strained during the pandemic, including commercial real estate and hospitality. Almost all respondents modified loans in second and third quarters of 2020 to aid their customers during the initial wave; some of these modifications extended into the fourth quarter.

Evaluation Metrics and Portfolio Concerns

Two separate metrics are now in play for regulators’ evaluations. As a result, it’s important to remember that just because your bank’s loan portfolio doesn’t receive a favorable rating doesn’t mean your bank or management won’t be evaluated favorably.

Regulators might downgrade a portfolio rating as some credits went into deferrals due to business shutdowns and borrowers being unable to make payments. However, bank management could receive a strong rating because of actions they took to keep the bank running and support customers.

While modifications reflect current realities, they don’t diminish the fact that portfolios are degrading from a stability standpoint. Forty-three percent of respondents tightened underwriting standards during the pandemic, while roughly half are unsure if they’ll adjust standards in 2021 and 2022.

Banks that have good governance will loosen their underwriting standards and will be strategic about to whom they lend money. In addition, they will assess which loans they’ll permit to be in delinquent status without taking action, and which they’ll defer.

Increases in Stress Testing

While annual stress tests are common for banks, 60% of respondents expanded the quantity or depth of economic scenarios in response to the pandemic. This is despite regulators’ previous increase of the asset cap threshold for required testing.

Most institutions focus not just on interest rate stress testing — they test the whole portfolio. This is driving more stress testing on the viability of collateral for loans and liquidity. Institutions know they’ll face increased allowance provisions and write-offs, so they’re stress testing the capital resiliency of their organization and see how they would shoulder that burden.

Looking forward, banks may want to focus on concentrated risks within the portfolio. They may also want to apply different, more specific stress testing criteria to various segments such as multifamily real estate, hospitality and mortgages, knowing certain areas may pose greater risk.

Improved Plans for Continuity and Disaster Recovery

The pandemic placed a renewed focus on continuity and disaster recovery. While most organizations had a pandemic provision in their plans following guidance from the Federal Financial Institutions Examination Council (FFIEC), they had been considered only hypothetical exercises. When an actual pandemic hit, many organizations had to react quickly, focus and learn how to adapt during the experience. Most banks will enhance their business continuity plans as a result of the pandemic: 84% of respondents say they’ve made or plan to make changes to their plans.

Key improvement areas include plans to:

  • Formalize remote work procedures.
  • Educate and train employees.
  • Provide the right tools to staff.
  • Ensure the bank’s IT infrastructure can adapt in a crisis.

Cybersecurity and Remote Work Setups

Three-quarters of respondents plan for at least some employees to work remotely after the pandemic abates. This makes cybersecurity a significant concern that boards need to further explore and implement additional precautions around.

Previously, with employees working in one space, there was only one entry point of attack for cybercriminals. Suddenly, with employees working from potentially hundreds of different locations, hundreds of entry points could exist.

Factoring in employees’ mental states is also a crucial vulnerability. It’s easier for cybercriminals to take advantage of or deceive employees that are navigating the difficulties of working from home and the general stresses of the pandemic. Increased staff training, as well as technology improvements, can help better detect and deter cyberthreats and intrusions.

Looking Forward

Though many respondents noted the resilience of the industry, it’s important to not get complacent. Banks certainly weathered the hard times, but the biggest impacts of the past year likely won’t be fully visible until the pandemic subsides.

Once that occurs, some businesses will reopen but may need more capital. Others may still close permanently, leaving banks to determine which loans won’t get repaid, engage bankruptcy courts, take cents on the dollars for the loan and charge write-offs.

So while this past year has been a major learning experience, the lesson likely won’t be concluded until early 2022.

 

Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory services offered through Moss Adams Wealth Advisors LLC.

Strengthening Stress Tests After Covid-19

Written by

Banks below $50 billion in assets aren’t required to conduct an annual stress test, following regulatory relief passed by Congress in May 2018. But most banks still conduct one or more annual tests, according to Bank Director’s 2021 Risk Survey.

A stress test determines whether a bank would have adequate capital or liquidity to survive an adverse event, based on historical or hypothetical scenarios. Financial institutions found value in the practice through the Covid-19 pandemic and related economic events, which created significant uncertainty around credit — particularly around commercial real estate loans and loans made to the hospitality sector, which includes hotels and restaurants.

“It gives you a peace of mind that we are prepared for some pretty big disasters,” says Craig Dwight, chair and CEO at $5.9 billion Horizon Bancorp, based in Michigan City, Indiana. Horizon disclosed its stress test results in third quarter 2020 to reassure its investors, as well as regulators, customers and its communities, about the safety and soundness of the bank. “We were well-capitalized, even under two-times the worst-case scenario,” he says. “[T]hat was an important message to deliver.”

Horizon Bancorp has been stress testing for years now. The two-times worst case scenario he mentions refers to loss history data from the Office of the Comptroller of the Currency; the bank examines the worst losses in that data, and then doubles those losses in a separate analysis. Horizon also looks at its own loan loss history.

The bank includes other data sets, as well. Dwight’s a big fan of the national and Midwest leading indicators provided by the Federal Reserve Bank of Chicago; each of those include roughly 18 indicators. “It takes into consideration unemployment, bankruptcy trends, the money supply and the velocity of money,” he says.

It’s a credit to the widespread adoption of stress testing in the years following the financial crisis of 2008-09. “All the infrastructure’s in place, so [bank management teams] can turn on their thinking fairly quickly, and [they] aren’t disconnected [from] what’s happening in the world,” says Steve Turner, managing director at Empyrean Solutions, a technology provider focused on financial risk management.

However, Covid-19 revealed the deficiencies of an exercise that relies on historical data and economic models that didn’t have the unexpected — like a global pandemic — in mind. In response, 60% of survey respondents whose bank conducts an annual stress test say they’ve expanded the quantity and/or depth of economic scenarios examined in this analysis.

“We have tested pandemics, but we really haven’t tested a shutdown of the economy,” says Dwight. “This pandemic was unforeseen by us.”

Getting Granular
The specific pain points felt by the pandemic — which injured some industries and left others thriving — had banks getting more granular about their loan portfolios. This should continue, says Craig Sanders, a partner at Moss Adams LLP. Moss Adams sponsored Bank Director’s 2021 Risk Survey.

Sanders and Turner offer several suggestions of how to strengthen stress testing in the wake of the pandemic. “[D]issect the portfolio … and understand where the risks are based on lending type or lending category,” says Sanders. “It’s going to require the banks to partner a little more closely with their clients and understand their business, and be an advisor to them and apply some data analytics to the client’s business model.” How will shifting behaviors affect the viability of the business? How does the business need to adjust in response?

He recommends an annual analysis of the entire portfolio, but then stratifying it based on the level of risk. High risk areas should be examined more frequently. “You’re focusing that time, energy and capital on the higher-risk areas of the bank,” says Sanders.

The survey finds two-thirds of respondents concerned about overconcentrations in their bank’s loan portfolio, and 43% of respondents worried specifically about commercial real estate loan concentrations. This represents a sharp — but expected — increase from the prior year, which found 78% expressing no concerns about portfolio concentrations.

We’re still not out of the woods yet. Many companies are now discussing what their workplace looks like in the new environment, which could have them reducing office spaces to accommodate remote workers. If a bank’s client has a loan on an office space, which they then rent to other businesses, will they be able to fill the building with new tenants?

If this leads to defaults in 2021-22, then banks need to understand the value of any loan collateral, says Sanders. “Is the collateral still worth what we think it was worth when we wrote the loan?”

It’s hard to predict the future, but Sanders says executives and boards need to evaluate and discuss other long-term effects of the pandemic on the loan portfolio. Today’s underlying issues may rise to the surface in the next couple of years.

Knowing What Will Break Your Bank
Stress testing doesn’t tend to focus on low-probability events — like the pandemic, which (we hope) will prove to be a once-in-a-lifetime occurrence. Turners says bank leaders need to bring a broader, more strategic focus to events that could “break” their bank. That could have been the pandemic, without the passage of government support like the CARES Act.

It’s a practice called reverse stress testing.

“Reverse stress testing helps to explore so-called ‘break the bank’ situations, allowing a banking organization to set aside the issue of estimating the likelihood of severe events and to focus more on what kinds of events could threaten the viability of the banking organization,” according to guidance issued by the Federal Reserve, Federal Deposit Insurance Corp. and OCC in 2012. The practice “helps a banking organization evaluate the combined effect of several types of extreme events and circumstances that might threaten the survival of the banking organization, even if in isolation each of the effects might be manageable.”

Statistical models that rely on historical norms are less useful in an unforeseen event, says Turner. “[I]f someone told you in February of 2020 that you should be running a stress test where the entire economy shuts down, you’d say, ‘Nah!’” he says. “What are the events, what are the scenarios that could happen that will break me? And that way I don’t have to rely on my statistical models to explore that space.”

Testing for black swan events that are rare but can have devastating consequences adds another layer to a bank’s stress testing approach, says Turner. These discussions deal in hypotheticals, but they should be data driven. And they shouldn’t replace statistical modeling around the impact of more statistically normal events on the balance sheet. “It’s not, ‘what do we replace,’” says Turner, “but, ‘what do we add?’”

With stress testing, less isn’t more. “My advice is to run multiple scenarios, not just one stress test. For me, it’s gotta be the worst-case stress test,” says Dwight. And stress testing can’t simply check a box. “Can you sleep at night with that worst case scenario, or do you have a plan?”

Bank Director’s 2021 Risk Survey, sponsored by Moss Adams LLP, 188 independent directors, chief executive officers, chief risk officers and other senior executives of U.S. banks below $50 billion in assets. The survey was conducted in January 2021, and focuses on the key risks facing the industry today and how banks will emerge from the pandemic environment.

Bank Director has published several recent articles and videos about stress testing, including an Online Training Series unit on stress testing. You may also consider reading “Recalibrating Bank Stress Tests to a New Reality.”