AL 97-3 Subject: Credit Underwriting Standards and Portfolio Credit Risk Management TO: Chief Executive Officers of all National Banks, Department and Division Heads, and all Examining Personnel. PURPOSE In a speech delivered on December 10, 1996, the Comptroller voiced the OCC's growing concern about trends in underwriting in the syndicated loan market and the easing of commercial underwriting standards in general. Although the syndicated loan market was the focus of the Comptroller's remarks and his immediate concern, the call for heightened discipline and the measures outlined in his speech are applicable to all types of lending and all segments of the loan portfolio. The OCC is issuing this advisory to remind national banks of the effects that changes in loan underwriting standards may have on portfolio credit risk and to highlight the major elements of an effective portfolio credit risk management process. Such a process should enable bank management to identify, measure, monitor, and control loan portfolio credit risk. The concepts discussed in the advisory are meant to assist banks in developing their own processes. The need to formalize the various elements of the process, and the sophistication of the process, will depend on the size of the bank, the complexity of its portfolio, and the credit risks it has assumed. For example, a community bank may be able to implement these concepts in a less formal, less structured manner than a large bank and still have an effective portfolio credit risk management process. BACKGROUND The level of credit risk in most banks is inextricably linked to the business and economic cycle. Because the U.S. economy has been healthy for the past several years, it is not surprising that many banks recently have enjoyed record high levels of earnings and capital. Nonetheless, banks must be prepared for any future deterioration in economic conditions. Most problem credits are the result of lending decisions and assumptions of credit risk that were made during periods of general strength in the economy. Weaknesses in these credits become apparent only during economic downturns. To be most effective, therefore, a bank's risk management should anticipate the impact of future economic problems in managing the bank's credit risk profile. In recent years, banks have experienced high levels of liquidity at the same time that competition to make loans has increased. Continued consolidation in the banking industry has also put greater pressure on bank management to generate sufficient earnings to support higher stock valuations. Because of this environment, some banks have adjusted their credit selections and eased underwriting criteria. For example, in the syndicated loan market, the OCC has noted several factors that have contributed to easing underwriting standards. These include strong investor demand for higher yield paper, increased competition, and the dynamics of the market itself, in which the loan originators may not be permanent investors. The OCC also has seen deterioration in the underwriting of other portfolio segments such as credit cards and other consumer lending. It is understandable that a bank may feel pressured to ease underwriting standards in today's competitive environment. Nonetheless, bank management should keep in mind that, regardless of the current environment, the loans and leases the bank underwrites must be consistent with its long-term strategic portfolio objectives and the level of risk the bank is willing to tolerate over the long run. PORTFOLIO CREDIT RISK MANAGEMENT PROCESSES Banks traditionally have focused on oversight of individual loans in managing their overall credit risk. While that focus is still important, the OCC believes banks should also view risk management in terms of the entire portfolio. An effective loan portfolio credit risk management process enables management to identify, measure, monitor, and control credit risk. The OCC believes that any such process should include the elements listed below: o Assessment of the credit culture o Portfolio objectives and risk tolerance limits o Management information systems o Portfolio segmentation and risk diversification objectives o Analysis of loans originated by other lenders o Aggregate policy and underwriting exception systems Stress testing for portfolios Independent and effective control functions Analysis of portfolio risk/reward tradeoffs The OCC encourages bankers to review these elements to determine the most appropriate way to incorporate the concepts into their own portfolio credit risk management process. ASSESSMENT OF THE CREDIT CULTURE A bank's credit culture, which is the sum of its values, beliefs, and behaviors, should reflect the standards and values of the board of directors and senior management. Every bank has a credit culture, whether articulated or implied. Consistently high performing banks have a credit culture that is clearly understood throughout the organization. Senior management and the board should periodically assess whether employees' understanding of the bank's credit culture, and their resulting behavior, conform with the desired standards and values for the bank. Independent audit and internal loan review functions can help in this assessment. Because the credit culture influences every aspect of the credit process, including credit risk selection and underwriting, a bank's sales strategies must be coordinated with its credit risk management objectives. In addition, compensation systems for the lending area should reward the kind of behavior that is consistent with long-term credit quality objectives. PORTFOLIO OBJECTIVES AND RISK TOLERANCE LIMITS For portfolio management to be effective, management should establish and clearly communicate the bank's strategic objectives. The bank also should consider identifying objectives for every key portfolio segment. A business plan to achieve these objectives should be a part of, and consistent with, the bank's overall planning process. Management should use those objectives to establish risk tolerance limits. As those limits are approached, the risk management process should require that the board of directors and/or senior management review the portfolio to assess the reasons for the increased level of risk and to take appropriate action. Management should periodically evaluate each lending unit's business and marketing plan for consistency with strategic portfolio objectives. Effective risk management also should include a periodic review of lending policies and underwriting criteria. Before implementing any proposed changes to policies or standards, management should estimate their potential effect on the bank's ability to meet its portfolio objectives, on risk tolerance limits, and on the bank's overall risk profile. The accuracy of those estimates should later be tested by comparing them with actual experience. MANAGEMENT INFORMATION SYSTEMS Effective portfolio credit risk management depends on adequate management information systems (MIS). Industry consolidation and the relatively long expansionary phase of the lending cycle have provided some banks with the opportunity to increase their loan portfolios significantly, often by entering new markets and product areas. However, the OCC has observed that the credit MIS capabilities of some banks have not kept pace with this growth. The OCC encourages bank senior management and board members to assess periodically the adequacy of their bank's credit MIS in light of recent loan growth, acquisitions, and changes in the bank's appetite for risk. The maintenance of an adequate credit MIS gives banks the ability to segment their loan portfolios and to assess more accurately key risk characteristics. PORTFOLIO SEGMENTATION AND RISK DIVERSIFICATION OBJECTIVES The selection and management of individual credit transactions remains an important part of managing a bank's credit risk, but portfolio credit risk management also involves looking at entire segments of the portfolio groups of loans with similar risk characteristics. Bank management may make a different decision about underwriting requirements for an individual transaction if it takes into account the risk profile of the bank's entire portfolio rather than focussing only on the individual transaction. Effective portfolio management requires an understanding of all of the risk characteristics of the portfolio. A bank should segment its portfolio in a number of different ways for example, by loan type, industry, geography, structure, collateral, tenor, and risk of default or loss. The same loan may be included in several portfolio segments based on different risk elements. Risk diversification is fundamental to portfolio management. The bank should identify the risk characteristics of each segment. And, as part of concentration management, the bank also should try to identify possible covariances, similarities, or interrelationships among portfolio segments. Identifying these shared risks is critical in developing diversification strategies. ANALYSIS OF LOANS ORIGINATED BY OTHER LENDERS Another part of portfolio credit risk management is assessing the effect of loans originated and underwritten at other financial institutions on a bank's credit risk profile. These loans include individual syndicated credits and participations and loans acquired through portfolio purchases. As noted in the Comptroller's speech, the OCC is concerned that some downstream participants may be purchasing loans based on underwriting standards significantly different from their own established criteria. The acquisition of any such credits should be subject to proper due diligence. The OCC encourages banks to consider the credit risks associated with syndicated credits and participations from the perspective of overall portfolio management. Before participating in a syndication or participation, a bank should evaluate the risk of the proposed credit to determine whether the loan is consistent with its portfolio strategy and risk tolerance. Because these decisions often have a short deadline, an effective portfolio management process is essential. Bankers should not invest in such credits without a thorough understanding of their bank's risk acceptance criteria and the portfolio risk consequences. The same portfolio risk concepts apply to the purchase of entire portfolios. A bank must conduct sufficient due diligence to understand fully the credit risks that it would assume in the purchase of a portfolio. The portfolio should be appropriately segmented, and the credit risk should be properly evaluated. Any decision to purchase, including the price at which to purchase, should take into account the effect the loans will have on the bank's overall portfolio risk profile. Banking Circular No. 181 (Revised) dated August 2, 1984, provides further guidance regarding the purchase of loans and highlights actions required to document, analyze, and control credit risk on such loans. AGGREGATE POLICY AND UNDERWRITING EXCEPTION SYSTEM Every bank should have a process to identify and approve loan policy and underwriting exceptions and to document any mitigating factors. Most banks do have effective systems for approving and monitoring exceptions for individual transactions. However, just as the best way to understand the full extent of a bank's credit risk is to analyze aggregate loan data, an important element of analyzing exceptions is for banks to track and analyze policy and underwriting exceptions in the aggregate. Portfolio credit risk management is facilitated by reporting systems that capture and track information on exceptions, both by transaction and by relevant portfolio segments. The aggregate data is useful in assessing portfolio risk profiles, reassessing existing policy and standards, and evaluating the adequacy of the allowance for loan and lease losses. The data also may serve as an oversight tool for monitoring the level of adherence to policy and underwriting standards by departments or individual lenders. A bank's analysis of the information also may reveal a correlation between certain types of exceptions and migration of internal risk ratings. STRESS TESTING FOR PORTFOLIOS In addition to stress testing individual significant credits, bank management should consider developing "what if" scenarios for key portfolio segments. The scenarios would identify possible credit risk triggers or events that could increase risk for a portfolio segment or for the portfolio as a whole. The trigger events may include interest rate changes, commodity or other price shocks, economic cycles, or technological, political, or sociological changes. Using scenarios can be more helpful if several possibilities are considered and probabilities are assigned to each. One good, basic approach is to develop best, worst, and most likely scenarios for each portfolio segment and then project the outcomes. Bank management should also consider developing contingency plans for scenarios and outcomes that involve credit risk in excess of the bank's established risk tolerances. These plans might include increased monitoring, limiting portfolio growth, and, possibly, hedging or exit strategies for both significant individual transactions and key portfolio segments. INDEPENDENT AND EFFECTIVE CONTROL FUNCTIONS Management should have control systems to ensure that credit extensions are consistent with strategic portfolio and risk objectives. Reliable identification, measurement, and monitoring of portfolio credit risk is possible only if control systems ensure the accuracy of information. There are many control functions throughout the lending process; in most banks, the key control functions are loan review and audit. The board of directors and senior management should ensure that these important control functions are independent of the lending function and are staffed adequately to perform their assigned duties. As bank systems and composition of the portfolio become more sophisticated, the bank should ensure that the expertise and experience of staff in the loan review and audit functions keep pace. A bank should not attempt to achieve its operating objectives at the expense of these necessary control functions. ANALYSIS OF PORTFOLIO RISK/REWARD TRADEOFFS Portfolio credit risk management cannot be complete if it does not take into account the bank's range of acceptable risk/reward relationships. The OCC encourages banks to research and experiment with risk pricing models. The models should consider individual transactions; relationship management, including risks and revenues from all sources; and portfolio segment risk/reward. CONCLUSION Underwriting of credit risk in a cyclical and highly competitive environment should be part of a comprehensive and integrated portfolio risk management process. The elements of portfolio credit risk management discussed in this advisory provide a foundation on which banks can build their own systems to identify, measure, monitor, and control credit risk. ORIGINATING OFFICE Questions concerning this advisory letter should be addressed to the Office of Chief National Bank Examiner at (202) 874-5170. Jimmy Barton Chief National Bank Examiner Date: March 11, 1997