Every credit loss a lender ever takes was approved by someone, on some day, against some policy, and the underwriting process is where that decision was made. Portfolio reviews, allowance models and problem-loan workouts all happen downstream; underwriting is upstream, and an audit that finds the control weaknesses there finds them before they become charge-offs. Auditing underwriting means testing whether the written credit policy is what actually happens at the desk: whether applications are analyzed the way the policy says, whether exceptions are identified, mitigated and approved by the right people, whether collateral is valued independently, whether the approval authority structure is respected rather than circumvented, and whether the data the bank collects about its own underwriting is reliable enough to manage by. The same questions apply, with different vocabulary, to any organization that extends significant credit: a bank’s commercial and consumer books, a captive finance company, a trade creditor with a large receivable, a fintech lender with a decisioning model.
This guide explains how to audit the process: why underwriting is where credit risk is born, the regulatory frame, the control points from application to funding, how to test policy against practice, the exception and override machinery, approval authority and the structuring red flags, collateral and appraisals, covenants and monitoring, consumer and model-driven decisioning, the analytics that make the engagement efficient, a worked engagement at Lakeshore Bancorp, the failures that recur, and how to report. It builds on the credit risk guide and the PD, LGD and EAD explainer, and it is the origination half of a pair with the allowance and portfolio work described in the internal audit in banking guide.
In this guide
- Why underwriting is where credit risk is born
- The regulatory frame
- Control points from application to funding
- Testing policy against practice
- Exceptions and overrides: the machinery and its analytics
- Approval authority and the structuring red flags
- Collateral valuation and appraisal independence
- Covenants, conditions and what happens after closing
- Consumer and automated decisioning
- The analytics that make the audit efficient
- A test-by-test program
- A worked engagement: Lakeshore Bancorp’s FY26 underwriting audit
- Failures that recur
- Reporting underwriting findings
- Questions about auditing underwriting
- Related guides
Why underwriting is where credit risk is born
Credit risk is the risk that a borrower or counterparty fails to pay, and three things determine how much of it a lender carries: whom it lends to, on what terms, and against what protection. All three are set at underwriting. The probability of default is largely fixed by borrower selection and structure (cash flow coverage, leverage, guarantor strength, industry); the loss given default by collateral, lien position and covenants; the exposure by the commitment size and the advance rate. Everything that follows (monitoring, risk rating migration, the allowance, workout) manages a risk that already exists. That is why examiners spend so much time on underwriting, why the allowance under CECL depends on the quality of the data collected at origination (the parameter explainer shows how), and why a lender whose policy is sound on paper and loose in practice discovers the gap in the next downturn rather than the next audit. The pattern of every credit cycle is the same: competition erodes standards gradually (looser covenants, higher advance rates, more exceptions, more reliance on collateral and less on cash flow), each individual loan looks defensible, and the aggregate drift is visible only to someone who measures it. Internal audit’s job is to be that someone between examinations, and to measure the drift with the bank’s own data rather than wait for losses to reveal it.
The regulatory frame
| Requirement or guidance (US banks unless noted) | What it requires of underwriting | Internal audit’s test |
|---|---|---|
| Interagency Guidelines for Real Estate Lending Policies (1992; 12 CFR 34 subpart D, Regulation H and 12 CFR 365 appendices) | A written real estate lending policy approved by the board; supervisory loan-to-value limits (raw land 65 percent, land development 75, commercial and multifamily construction 80, one-to-four family residential construction and improved property 85, no limit for owner-occupied one-to-four family and home equity, with insurance or other support expected above 90); loans above the limits tracked, capped at 100 percent of total capital in aggregate (30 percent for non-one-to-four-family), and reported to the board at least quarterly | Policy currency and board approval; identification of loans exceeding the limits; completeness of the quarterly report; the aggregate against capital |
| Interagency Appraisal and Evaluation Guidelines (2010) and the appraisal rules (thresholds: $500,000 for commercial real estate since 2018, $400,000 for residential since 2019) | Appraisals by state-licensed or certified appraisers above the thresholds, evaluations below; independence of the appraisal function from loan production; review of appraisals; appraisal management company oversight | Appraisal versus evaluation decisions against the thresholds; independence of ordering and review; review quality |
| Concentrations in Commercial Real Estate Lending (2006 interagency guidance) | Heightened risk management where construction and land loans reach 100 percent of total capital, or total CRE reaches 300 percent with growth of 50 percent or more over 36 months | Concentration measurement; whether underwriting standards tightened as concentrations approached limits |
| Interagency Guidance on Leveraged Lending (2013) | Definition of leveraged lending, underwriting standards (repayment capacity, leverage, enterprise value), pipeline and hold limits, risk rating of leveraged loans | Identification of leveraged loans; adherence to the standards; underwriting of enterprise-value-dependent credits |
| Uniform Retail Credit Classification and Account Management Policy (2000) | Charge-off timing for consumer credit (closed-end 120 days past due, open-end 180), re-aging and extension limits | Downstream of underwriting, but the re-aging rules test the same discipline |
| Fair lending: Equal Credit Opportunity Act and Regulation B; Fair Housing Act; HMDA; the CFPB’s small business lending data rule under Section 1071 (compliance dates pushed into 2026 and 2027 and the rule itself under revision; verify status) | No discrimination on a prohibited basis; adverse action notices; data collection and reporting; consistent treatment in exceptions and pricing | Exception and pricing analytics by protected class proxies (with compliance); adverse action timeliness; HMDA data integrity |
| Ability-to-repay and qualified mortgage rules (Regulation Z) | Reasonable, good-faith determination of ability to repay using verified income, assets and debts; the price-based general QM definition (mandatory since October 2022) | Verification documentation; QM status determinations; DTI and residual income support |
| Model risk management guidance (SR 26-2 and OCC 2026-13, replacing SR 11-7 in April 2026) | Validation and governance of scorecards, automated decisioning and pricing models used in underwriting | Inventory completeness; validation currency; override monitoring; the SR 26-2 explainer |
| Allowance (CECL, ASC 326) and risk rating systems | Origination data (ratings, collateral values, terms) feeding the allowance and the rating system accurately | Data integrity from origination to the loan system; rating assignment at origination |
| Non-bank equivalents: state licensing and usury; FTC and CFPB consumer rules; Basel standards and national supervisors outside the US (the EBA’s loan origination and monitoring guidelines in the EU, applying since 2021) | Analogous policy, documentation and valuation expectations | Same program with the local frame substituted |
Control points from application to funding
Underwriting is a sequence of decisions, each with a control. Application and eligibility: the product, borrower type, purpose and amount fit the policy’s lending box (what the bank will and will not lend on), and prohibited purposes and ineligible borrowers are screened out. Information gathering and verification: financial statements, tax returns, bank statements, rent rolls, appraisals, credit reports and searches obtained and verified against sources rather than taken from the borrower’s summary. Analysis: spreads of financial statements, cash flow and debt service coverage, global cash flow across related entities and guarantors, sensitivity to rate and rent changes, collateral valuation and advance rates, guarantor analysis, industry and management assessment, and a risk rating assigned under the bank’s methodology. Structure: amount, term, amortization, pricing, covenants, collateral, guarantees and conditions that fit the risk. Exceptions: any departure from policy identified, mitigated and approved at the required level. Approval: by an officer or committee with authority for the amount and risk, documented with the analysis that supported it. Documentation and closing: legal documents matching the approval, liens perfected, insurance in place, conditions precedent met before funding. Booking: terms entered into the loan system match the documents, the risk rating and collateral data flow to the systems the allowance and reporting depend on. The audit walks a sample of credits through each step and tests the step’s control, and it tests the governance around the steps (the policy itself, its approval and currency, the exception reporting, the quality control function, the training). The walkthrough versus test of controls guide covers the distinction; underwriting needs both.
Testing policy against practice
The core of the engagement is a file test: a sample of credits originated in the period, selected to cover the products, officers, regions and risk ratings that matter, each tested against the policy in force when it was approved. The attributes are the policy’s own requirements translated into yes-or-no questions: was the debt service coverage ratio at or above the minimum for the product (and computed correctly, with the right definition of cash flow and debt service)? Was leverage within the limit? Was the loan-to-value within policy and within the supervisory limit? Was the appraisal or evaluation obtained before approval, from an independent process, and reviewed? Were the financial statements current (within the policy’s age limit) and of the required quality (audited, reviewed, compiled, tax returns)? Was global cash flow analyzed where the borrower has related entities? Were guarantors analyzed and their guarantees documented? Was the risk rating supported by the methodology’s factors? Were covenants set where policy requires them? Was every exception identified, mitigated and approved at the right level? Did the approval authority match the amount and total relationship exposure? Did the closing documents match the approval? Were conditions precedent satisfied before funding? The sample design follows the sample sizes and attribute sampling guides: a statistical sample across the population for the conclusion, plus targeted selections for the risky corners (the largest credits, the officers with high exception rates, the products growing fastest, the loans approved on the last days of a quarter). The recomputation of coverage ratios and loan-to-value from source documents is the step that distinguishes an audit from a checklist review; underwriters’ spreads contain errors, and the direction of the errors is informative.
Exceptions and overrides: the machinery and its analytics
Exceptions are where underwriting discipline is really tested. A policy exception is a loan approved outside a written standard (coverage below the minimum, amortization longer than allowed, loan-to-value above policy, missing guarantor); an override is a decision that reverses a model or scorecard outcome (approving a declined applicant, declining an approved one, pricing off the grid). Both are legitimate in moderation, and both are the channel through which standards erode. The controls are identification (every exception captured, not only the ones the officer chooses to disclose), mitigation (a documented reason and compensating factor), approval at an elevated level, aggregation (exception rates tracked by officer, product, region and type and reported to credit committee and the board), and performance tracking (do excepted loans perform worse, and by how much). Internal audit tests the identification control by re-underwriting the sample independently and comparing the exceptions it finds with the ones the bank recorded (the gap is the headline finding in most underwriting audits), tests mitigation and approval on the recorded exceptions, and runs analytics on the whole population: exception rate by officer and by product against policy tolerances, trends over time, the share of exceptions with substantive mitigants versus boilerplate, override rates against ceilings, and the delinquency and default performance of excepted and overridden loans compared with the rest. A bank whose exceptions run at 25 percent of originations with a 10 percent tolerance has a different policy from the one its board approved; a bank whose overrides default at twice the rate of model-approved loans has an override process that is adding risk rather than judgment. The vendor model validation and model risk management guides cover the override monitoring the model guidance expects.
| Analytic | Computation | What a result means |
|---|---|---|
| Exception rate by officer | Excepted originations ÷ total originations per officer, by exception type | Officers far above peers are either in a riskier market or not following policy; both need explanation |
| Unrecorded exception rate | Exceptions found by audit re-underwriting ÷ sample, versus exceptions the bank recorded on the same loans | The identification control’s reliability; the board sees only recorded exceptions |
| Exception performance | Delinquency, downgrade and default rates of excepted loans versus non-excepted, by vintage | Whether exceptions are priced and mitigated or simply riskier |
| Override rate and performance | Overrides ÷ model decisions, by direction; default rate of overridden approvals versus model approvals | Judgment adding value, or pressure defeating the model |
| Approval authority concentration | Loans approved at the top of an officer’s authority; related loans to one borrower group approved separately by the same officer within a short window | Structuring to avoid committee |
| Quarter-end timing | Originations and exceptions in the last five business days of quarters versus the rest | Volume pressure on standards |
| Appraisal and evaluation choice | Loans above the thresholds supported by evaluations; appraisals ordered after approval; appraisers with high repeat rates per officer | Independence and compliance failures |
| Financial statement age | Days between statement date and approval, by product | Stale information underwriting |
| Coverage recomputation variance | Audit-computed DSCR minus underwriter DSCR, direction and size | Systematic optimism in spreads |
| Covenant compliance tracking | Covenants due ÷ compliance certificates on file; breaches ÷ waivers documented | Monitoring after closing |
Approval authority and the structuring red flags
Approval authority is a tiered structure: individual officers up to an amount that depends on their title and track record, joint authorities, regional or senior credit officers, a loan committee, and the board or its committee for the largest credits, with authority usually measured on total relationship exposure rather than the single loan. The structure fails in predictable ways: authority measured on the loan rather than the relationship (so a borrower group with four $2 million loans never reaches the committee that would see an $8 million exposure), related borrowers not identified as a group (common ownership, guarantor overlap, shared collateral), loans split or sequenced to stay under a threshold, approvals signed after funding, committee approvals recorded without the dissent or the conditions the minutes show, and authorities not reduced when an officer’s portfolio deteriorates. Internal audit tests the authority matrix against the approvals in the sample, tests the relationship aggregation logic in the loan system (does it capture guarantors and common ownership?), runs the structuring analytics (same officer, same borrower group, short window, amounts near the threshold), reads committee minutes against the approval documents, and checks that delegated authorities are reviewed and adjusted. Structuring to avoid committee is a fraud indicator as well as a control failure, and the fraud red flags and fraud risk assessment guides apply; lending fraud (fictitious borrowers, inflated appraisals, straw buyers, insider loans) runs through underwriting and the BSA/AML intersection (source of repayment, beneficial ownership) belongs in the program too.
Collateral valuation and appraisal independence
Collateral is the second way out, and its value at origination determines the loan-to-value, the advance rate and the loss given default assumption. The controls are independence (appraisals ordered and reviewed by a function separate from loan production, with no communication of a target value), competence (licensed or certified appraisers above the thresholds, qualified evaluators below, with an approved appraiser list and rotation), review (every appraisal reviewed for compliance and reasonableness, with a deeper technical review for larger or complex properties), currency (appraisals refreshed per policy and on triggering events), and consistency between the valuation used in the approval and the one in the file. For non-real-estate collateral (receivables, inventory, equipment, securities, deposits), the controls are the advance rates in policy, borrowing base certificates and field examinations for asset-based lending, marketable security margining, and perfection of liens (UCC filings, control agreements, title). Internal audit tests the ordering and review process for independence, samples appraisals for review quality (were the comparables defensible, were cap rates and vacancy assumptions reasonable, did the reviewer challenge anything), tests the threshold decisions, tests lien perfection on a sample (the filing exists, is correct and is first where the approval assumed first), and checks that collateral values in the loan system match the appraisals; the construction audit guide covers the draw and inspection controls of construction lending, where collateral comes into existence during the loan.
Covenants, conditions and what happens after closing
Underwriting sets covenants and conditions; the controls that follow determine whether they mean anything. Financial covenants (coverage, leverage, liquidity, net worth) require periodic compliance certificates and financial statements, tracked in a system with due dates, tested by the bank against the definitions in the loan agreement, with breaches escalated to a decision (waive, amend, reserve, exit) and waivers approved at the appropriate authority and tracked as the exceptions they are. Reporting covenants require the documents to arrive and be reviewed. Conditions subsequent (a lease to be signed, insurance to be assigned, a guaranty to be executed post-closing) require a tickler and a sign-off. Annual reviews re-underwrite the relationship, refresh the risk rating and test covenants. Internal audit tests the tracking system’s completeness against the loan agreements in the sample (are all covenants loaded, with the right definitions and dates?), tests compliance certificate receipt and the bank’s compliance calculations, tests breach handling and waiver approvals, tests condition subsequent clearance, and reads annual reviews for substance; a book with 30 percent of covenants untracked is a book whose early-warning system is off. The KRI program guide’s logic applies: covenant breaches, late financials and waivers are the leading indicators the credit function should report.
Consumer and automated decisioning
Consumer underwriting (cards, auto, mortgage, personal loans, small business scored lending) replaces judgment with scorecards, decision rules and pricing grids, and the controls move to the model and its operation. The tests: the decision strategy in production matches the approved strategy (rule configuration testing, a strategy change control), the scorecard and any pricing or income models are validated and monitored under the model guidance (population stability, characteristic analysis, performance by vintage, with the model risk guide’s program), overrides are limited, reasoned and performance-tracked, income and identity verification happen where the strategy requires them (stated-income approvals within the allowed band, document verification quality, synthetic identity controls), adverse action notices are accurate and timely with the correct reasons (a fair lending and a Regulation B requirement, complicated by machine learning models whose reasons are not obvious), fair lending monitoring exists for approvals, pricing and exceptions, and the data that feeds the model is accurate (an error in the bureau pull or the income field changes the decision). For indirect lending through dealers, add dealer reserve and markup controls, dealer-level performance monitoring and fraud detection (the telecom guide’s dealer analytics transfer directly), and for mortgages the ability-to-repay documentation and QM determinations. Where generative or agentic AI is entering the decision chain (document extraction, income calculation, chat-based applications), the AI governance and agentic AI guides cover the additional tests.
The analytics that make the audit efficient
A file test of 60 to 90 credits answers the control question; analytics on the whole population tell the auditor where to look and turn a sample finding into a population statement. The data: the origination file (all loans booked in the period with officer, product, amount, rating, pricing, collateral type and value, LTV, DSCR, exceptions recorded, approval level and date, funding date), the application pipeline (applications, declines and withdrawals, for override and fair lending analysis), the appraisal log, the covenant tracking extract, the delinquency and charge-off history by vintage, and the policy parameters as data (limits by product). The analytics in the table above run in a spreadsheet or SQL (the SQL for auditors guide covers the joins), and three of them deserve attention every time: the unrecorded exception rate (because it measures the control the board relies on), the relationship aggregation check (join loans to borrower groups by guarantor and ownership and recompute total exposure against the approval level), and vintage performance of excepted and overridden loans (because it converts a process finding into a loss statement management cannot dismiss). The journal entry analytics and AP analytics guides show the same approach applied elsewhere; underwriting analytics are no harder, and the data is better.
A test-by-test program
| Area | Test | Evidence |
|---|---|---|
| Governance | Credit policy approved by the board within the required cycle; lending box, limits, exception process and authority matrix defined; policy changes approved and communicated; exception and concentration reporting to the board complete and accurate | Policy, board minutes, reports reconciled to source data |
| Eligibility and information | Sample loans within the lending box; required documents obtained and verified; financial statements within age limits | Credit files; verification evidence |
| Analysis | Recompute DSCR, leverage, LTV and global cash flow from source; assess rating support; sensitivity analysis performed where required | Spreads, tax returns, rent rolls, appraisals; audit recomputation |
| Exceptions | Compare audit-identified exceptions with recorded; mitigation documented; approval at required level; aggregate reporting | Exception log, approval documents, board reports |
| Authority | Approval level versus authority matrix on relationship exposure; related-borrower aggregation; structuring analytics; committee minutes versus approvals | Authority matrix, approvals, minutes, origination data |
| Collateral | Appraisal or evaluation obtained independently before approval and reviewed; threshold compliance; lien perfection; system values match | Appraisal log, reviews, UCC and title searches, loan system |
| Closing and booking | Documents match approval; conditions precedent cleared before funding; booked terms match documents | Closing checklists, loan documents, system records |
| Covenants and monitoring | Covenants loaded; certificates received; compliance tested; breaches escalated and waivers approved; annual reviews substantive | Tracking system, certificates, waivers, reviews |
| Consumer and models | Strategy configuration; model validation and monitoring; override limits and performance; verification; adverse action; fair lending monitoring | Strategy documents, validation reports, override logs, notices, monitoring reports |
| Data and reporting | Origination data integrity to the loan system and the allowance; exception and concentration reporting reconciles | Reconciliations, data tests |
| Quality control | The bank’s own post-closing quality control function: coverage, findings, remediation | QC reports and trend analysis |
A worked engagement: Lakeshore Bancorp’s FY26 underwriting audit
Lakeshore Bancorp is the $9 billion community bank used in the banking examples on this site: 60 branches, a loan book led by commercial real estate (318 percent of total capital against a 330 percent internal limit) and commercial and industrial lending, with indirect auto, home equity and residential mortgage on the consumer side. The FY26 plan carried a 520-hour underwriting audit covering commercial originations (CRE and C&I) and indirect auto, with mortgage underwriting tested separately under the compliance program. The team pulled the origination file for the twelve months to 30 June 2026 (1,140 commercial loans, $1.9 billion; 9,400 indirect auto loans, $310 million), ran the analytics first, then selected 85 commercial credits (a statistical sample of 60 across products and officers plus 25 targeted: the largest originations, the three officers with the highest recorded exception rates, loans approved in the last five business days of quarters, and loans to borrower groups with multiple approvals) and 60 indirect auto loans weighted to overrides and stated-income approvals.
| Test | Result | Rating and outcome |
|---|---|---|
| Policy exceptions, commercial | The bank recorded exceptions on 14 percent of commercial originations against a 15 percent tolerance; audit re-underwriting of the 85-loan sample found exceptions on 23 percent, the difference being coverage computed on unadjusted EBITDA, amortization beyond policy for the collateral type and missing global cash flow where guarantors had other debt; 41 percent of recorded exceptions carried mitigants that restated the structure (“strong guarantor”) without analysis | High. Exception identification rebuilt into the spreading template (coverage definitions locked, policy parameters as fields); exception reporting to the board restated for the year; mitigant standards issued |
| Supervisory loan-to-value reporting | Seven loans in the sample exceeded the supervisory LTV limits (construction at 83 to 88 percent) and were not flagged in the loan system, so the quarterly board report understated loans above the limits by about $38 million; the aggregate remained within the 100 percent of capital cap | High. System flag logic corrected (it keyed on the policy limit, not the supervisory limit); report restated; board informed |
| Approval authority and structuring | Three related loans to a borrower group totalling $7.4 million approved by one senior lender under a $3 million individual authority within nine days, the group not linked in the system because the common owner appeared only as guarantor; committee minutes for two credits showed conditions not carried into approval documents | High. Relationship aggregation extended to guarantor overlap; the three loans re-presented to committee (approved with added covenants); minutes-to-approval reconciliation added to credit administration |
| Coverage recomputation | Audit DSCR differed from the underwriter’s by more than 0.10x on 9 of 85 credits, overstated in 6 (add-backs for one-time expenses accepted without support) | Medium. Add-back standards tightened |
| Appraisals and evaluations | Four loans above $500,000 supported by evaluations rather than appraisals; appraisal ordering independent in all cases; two appraisals in the sample reviewed by a reviewer who had communicated with the lender about value before the report | High for the threshold breaches (a compliance matter); appraisals obtained retroactively; review independence protocol reissued |
| Covenant tracking | 31 percent of financial covenants in the sample’s loan agreements were not loaded in the tracking system; of those loaded, 18 percent were past due for compliance certificates with no follow-up; four breaches had been waived by the originating officer without the approval the policy required | High. Covenant load reconciliation across the book (completed for the 400 largest relationships within 90 days); waiver authority enforced |
| Indirect auto overrides | Override rate 14 percent against a 10 percent ceiling; overridden approvals defaulted at 2.4 times the rate of model approvals over the prior two vintages; stated-income approvals exceeded the allowed band at 11 dealers, and income verification was skipped on 7 of 22 loans that required it | High. Override authority re-centralized; the 11 dealers placed on verification requirements; model monitoring report extended to override performance |
| Fair lending monitoring | Monitoring of pricing exceptions by prohibited-basis proxy performed annually by compliance; no issues in the period | Low |
| Data integrity | Collateral values in the loan system matched appraisals in 81 of 85 credits; four carried the purchase price rather than the appraised value, affecting LTV reporting | Medium. Booking checklist fixed |
The report rated the commercial underwriting process Needs Improvement, with the unrecorded exception rate, the supervisory LTV reporting and the covenant tracking as the findings that mattered most, and framed the issue for the board as information quality: the board had been approving a policy and reading reports that described a tighter book than the one being originated. Management’s corrective actions were tracked under the bank’s issue management process with validation scheduled for FY27, the covenant reconciliation and the exception template rebuild first; the evidence standards for closure guide describes what validation will require. The banking pillar and the universe example place this audit among Lakeshore’s other credit engagements (allowance, problem loans, CRE concentration), and the MRA explainer describes what the same findings look like when an examiner writes them.
Failures that recur
| Failure | How it shows | What the audit should do |
|---|---|---|
| Exceptions self-reported | Recorded exception rate flatters the book; board reports understate risk | Independent re-underwriting of a sample; report the gap as the finding |
| Mitigants as boilerplate | “Strong guarantor,” “long relationship” on every exception | Test mitigants for analysis; set standards |
| Authority on the loan, not the relationship | Borrower groups never reach committee | Aggregation logic and structuring analytics |
| Coverage computed generously | Add-backs unsupported; debt service omits balloon refinancing risk | Recompute from source; lock definitions in the template |
| Appraisal independence eroded | Lenders talking to appraisers and reviewers about value | Test communications and ordering; rotation and review protocols |
| Covenants set and forgotten | Tracking incomplete; certificates not chased; waivers informal | Reconcile agreements to the tracking system; test breach handling |
| Overrides as a sales tool | Override rate above ceiling; overridden loans default faster | Vintage performance analytics; authority centralization |
| Stale information | Financial statements 18 months old at approval | Statement age analytics against policy |
| Quarter-end acceleration | Exceptions cluster in the last week of quarters | Timing analytics; incentive review |
| Data that lies downstream | Loan system LTVs and ratings wrong, so the allowance and concentration reports are wrong | Origination-to-system reconciliation in every underwriting audit |
Reporting underwriting findings
Underwriting findings land hardest when they are stated as information the board did not have: not “exceptions were not always identified” but “the board’s exception report showed 14 percent; the book is at 23 percent, and the difference is coverage computed on unadjusted earnings.” Each finding follows the five Cs with a quantified condition (rates, dollars, counts from the population analytics, not only the sample), a cause that names the mechanism (the template, the authority logic, the incentive), and a consequence in credit terms (what the excepted loans are doing, what the examiner will say, what the allowance may be missing). Ratings follow the severity guide, and the management responses guide covers the predictable response that each individual loan was a good decision: the audit’s point is the aggregate, and the analytics carry it. The board risk reporting guide shows where the restated exception and concentration figures belong in the risk pack.
Questions about auditing underwriting
What does an underwriting audit test?
Whether the written credit policy is what happens in practice: eligibility, verification and analysis of a sample of credits recomputed from source documents, exception identification and approval, approval authority on relationship exposure, collateral valuation independence and appraisal compliance, closing and booking accuracy, covenant tracking after closing, and the governance and reporting around all of it, supported by analytics on the whole origination population.
What are the supervisory loan-to-value limits?
Under the interagency real estate lending guidelines: 65 percent for raw land, 75 for land development, 80 for commercial, multifamily and other non-residential construction, 85 for one-to-four family residential construction and for improved property, and no limit for owner-occupied one-to-four family and home equity loans (with support expected above 90). Loans exceeding the limits are tracked, capped at 100 percent of total capital in aggregate and reported to the board at least quarterly.
How do you test policy exceptions?
Re-underwrite a sample independently, compare the exceptions found with those the bank recorded (the gap measures the identification control), test the mitigation and approval of recorded exceptions, and run population analytics: exception rates by officer and product against tolerances, trends, and the performance of excepted loans against the rest by vintage.
What is loan structuring and why does it matter?
Splitting or sequencing loans to a borrower group so that each stays under an officer’s approval authority and the aggregate never reaches committee. It defeats the authority structure, hides concentration and is a fraud indicator; the test joins loans to borrower groups through ownership and guarantors and recomputes exposure against the approval level.
How does model risk apply to underwriting?
Scorecards, automated decisioning, income and pricing models are models under the model risk guidance (SR 26-2 and OCC 2026-13 since April 2026) and need inventory, validation, performance monitoring and override controls; the audit tests that the strategy in production matches the approved one, that validation is current, and that overrides are limited and performance-tracked.
How large a sample is needed?
A statistical sample across the population for the control conclusion (typically 40 to 60 for a monthly or more frequent control population under the common sampling tables), plus targeted selections for the risky corners (largest credits, high-exception officers, quarter-end approvals, related-borrower groups), with population analytics turning sample results into statements about the book.
Related guides
- Credit risk: a comprehensive guide — the risk underwriting creates.
- PD, LGD and EAD explained — how origination decisions become loss parameters.
- Credit risk fundamentals for internal auditors — the vocabulary.
- Internal audit in banking — where the underwriting audit sits in the plan.
- Bank internal audit universe: a worked example — Lakeshore’s credit entities.
- How to audit model risk management — scorecards and decisioning models.
- SR 11-7 and SR 26-2 explained — the model guidance.
- Vendor model validation — third-party scorecards.
- Audit sample sizes — sizing the file test.
- Attribute sampling — the method.
- Walkthrough vs test of controls — both are needed.
- Fraud red flags — structuring and lending fraud.
- Fraud risk assessment — the method.
- BSA/AML independent testing — the intersection at origination.
- KRI program — covenant breaches as leading indicators.
- MRAs, MRIAs and consent orders explained — the examiner’s version of these findings.
- The five Cs of audit findings — writing them up.
- Finding severity ratings — rating them.
- Evidence standards for issue closure — what validation will require.
Leave a Reply