What you need to know: the PRA’s thematic findings from the internal audit review of the credit risk management framework – non-systemic UK deposit takers

The Prudential Regulation Authority (PRA) asked the internal audit functions (IA) of 33 non-systemic firms (6 banks and 27 building societies, predominantly with lending books of less than £1.5bn) to review their credit risk management framework (CRMF) in September 2023. This stemmed from the high level of uncertainty in the macroeconomic environment and the expected deterioration in credit portfolios.

Below we explore the main findings that have been published off the back of this exercise and suggest ways firms can address the areas highlighted as requiring improvement.

Key findings:

Published on 10^th September and communicated to Chief Risk Officers (holding the role SMF4: Chief Risk Function under the Senior Managers Regime) in a “Dear CRO…” letter, the review shows that of the 236 Audit findings, 53% were rated moderate, 14% significant, and 1% materially significant. In other words, more than two-thirds of the findings relate to “notable breaches of rules around lending.”

Here are the areas requiring improvement, in order of priority, based on the number of findings:

1. Affordability assessment: Insufficient focus is put on keeping models up to date, and reflective of the economic environment in which they are being used. Controls around refresh of rules, buffers and judgements need to be improved to reflect the latest developments of the macroeconomic and business environment. Data used in expenditure models should be updated frequently and regularly.

• • Whilst most firms use ONS data, its publication is typically lagged by over a year and requires significant adjustments to be usable in a lender’s affordability assessment. Even then, it still has significant limitations and is effectively ‘tailored averages’ susceptible to both underestimation (creating credit risk) and overestimation (resulting in missed lending opportunities) across household compositions and income ranges. Using transaction level customer spend data is materially more effective at supporting expenditure estimates.
  • 4most has proprietary access to granular income and expenditure data from our partners IE Hub, which offers a serious alternative or complementary solution to address these challenges. You can learn more about our affordability modelling services here.

2. Quality assurance (QA) and underwriting process: QA controls should be improved. This includes first/second line of defence reviews, increasing the frequency of reviews and documentation of QA processes within policies.

• • Understanding the role of second line and how it should work with first line is often a challenge for both new and smaller lenders. 4most has significant experience of developing and implementing risk management frameworks that clearly set out roles for each line of defence and how they can operate, and how these can evolve as your business changes. Our team includes many senior industry figures who can help you understand what the regulator is looking for and how to set up a robust risk management approach.

3. Quality of management information (MI): Reliable and consistent report production without data issues is key. Good practice MI includes risk appetite metrics; performance, and quality indicators that sufficiently support board level decision making. Forward-looking MI and informative commentary should contribute to a better CRMF.

• • Design and production of reporting can be challenging for smaller lenders. Contending with data quality issues is time consuming and may require making costly upgrades to systems which would demand even more time and resource. However, it is very feasible to design reports that are meaningful to senior audiences and reinforce the key aspects of risk management, including a clean view on performance against risk appetite.
  • 4most’s Analytics and MI capabilities can help you to improve the MI you produce to manage your lending portfolios. In addition, our award-winning tool LUMOS, can be used to automate production, freeing up more time for commentary and insights to be delivered to your senior management.

4. Credit risk appetite (CRA): CRA limits should be consistent with the business strategy, lending, and collections policies. CRA should be granular enough to be able to support a good understanding of the portfolio asset quality. Escalation processes should be in place to deal with any breaches. Credit Risk MI, Credit Risk Appetite Statement and Lending policies should be aligned.

• • Risk appetite is a key area of focus for 4most. Our approach to the setting and operating of appetite works for many lenders. Data, analytics, and forecasting are areas in which 4most has significant industry experience. Integrating these elements into a forward-looking credit risk appetite and comprehensive management framework that supports the strategic commercial aims can help to better target opportunities and manage risk appetite.

5. Lending policy: the governance and control processes around the lending policy should be improved. This should include sufficient documentation and monitoring of limits on exceptions relating to ‘out of policy’ loans.

• • As with risk appetite and reporting, 4most have experience in establishing policies and controls to leverage best practice within policy frameworks and controls. We have set up policy frameworks for new and smaller lenders and helped them to integrate this with the whole risk management framework. Lending policy, which includes both credit risk and responsible lending and conduct risks are material policies in this approach.

6. Collections: Contingency planning is an area that should be improved. This includes early warning indicators for the high risk and vulnerable customer segment. Capacity planning should deal with portfolio quality deterioration and/or increase in number of customers in financial difficulties. Ideally portfolio performance is linked through the operational plan to make capacity and portfolio management more effective.

• • 4most’s forecasting capabilities can support capacity planning and decisions on strategy and resource, allowing organisations to support customers effectively.

Next steps:

The PRA expects firms to use this list of priorities to strengthen practices in advance of their next review by assessing their own CRMF controls and identifying the areas that might need strengthening.

4most has a suite of available solutions and extensive industry experience in working with organisations of all sizes and stages of development to address all of these areas.

Get in touch if you are interested in learning more about how we can help your organisation – info@4-most.co.uk.

References:

• Thematic findings of Internal Audit Review of the Credit Risk Management Framework – non-systemic UK Deposit Takers (UKDT) | Bank of England