Bankers are generally good at following the rules.  This is important, since there are a lot of rules, and the penalties for not following the rules can be painful, and expensive, or both.  Following the rules is not enough though.  Just ask Wells Fargo.  Since 2012, Wells has been dealing with a federal lawsuit filed against it related to its handling of the origination and underwriting of FHA loans.  In that suit, the information documented by Wells' own internal quality control reports is being used to support fraud allegations.1

Prosecutors are convinced that Wells' executives obtained information documented by their review processes and failed to act on it appropriately.  Aside from the details of the suit, this assumption by the prosecutors is where Credit Risk professionals should pay attention.  The prosecutors believe that because the review process identified an issue, management was automatically 'educated' on it and able to act on it appropriately.  On the surface, that sounds like a logical conclusion, but it is not hard to imagine a reality existing in many organizations where 'having' information, understanding its significance and acting on it are three totally separate events. 

If information is gathered by bank staff in the normal course of their work, and conclusions are drawn based on that work, just documenting the file is not enough.  Files full of insightful documents are not why the rules exist.  The rules exist in order to compel the bank to act on the information resulting from that effort.  Those rules are intended to direct the bank and its management toward prudent decisions which they can only make as a result of the efforts to produce that educated analysis.

Doing quality analysis of portfolios of loans results in a great deal of valuable information about the health of a portfolio, and in some cases that information will indicate concerns that need to be addressed.  Yes, it is great to be able to 'check the box' and achieve the desired portfolio coverage that the bank has as its target.  It is appropriate to have documents that detail the results of that analysis.  If the information is not communicated effectively and acted on accordingly, only one of the three critical steps has been completed.  The regulators expect more than that.  Actually management expects more than that, even though they would likely roll their eyes if the reports they received on all this work exceeded a page or two each period.  It is imperative then, that when there is a valid concern identified by a review, it gets communicated.  Management needs the information communicated in a meaningful way so it is critical that reports presented be clear and concise.  Let there be no confusion about what the issue is that has been identified, and then the possibility for appropriate action is much improved.  That is 'why' the work was done in the first place.

Footnotes: