Commercial Lending Assessment Criteria

Description of Line of Business ActivityPermanent link to this section

Commercial lending involves extending credit to businesses, such as the following sub-activities: commercial mortgages, commercial lines of credit, equipment leasing, interim construction financing, asset-based lending, start-up/small business lending, and other commercial lending. Commercial lending may include a mix of these sub-activities so long as the risk attributes are alike, and these risks are managed in the same manner.

Definition of Net RiskPermanent link to this section

The net risk of commercial lending is determined by assessing the risks inherent in the activity and the effectiveness with which those risks are being managed.

Credit risk is the primary inherent risk in commercial lending. Secondary risks include operational, compliance, and strategic risks. These inherent risks are mitigated by operational management, oversight functions, senior management, and the board of directors.

A credit union’s net risk for commercial lending is assessed as low, moderate, above average, or high.

Low Net Risk	The credit union has risk management that substantially mitigates risk inherent in its commercial lending activities down to levels that have lower than average probability of an adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have a predominance of commercial lending sub-activities with low inherent risks and acceptable quality of risk management. Other combinations are possible; for example, moderate inherent risk with strong quality of risk management.
Moderate Net Risk	The credit union has risk management that sufficiently mitigates risks inherent in its commercial lending activities, down to levels that collectively have an average probability of an adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have a predominance of commercial lending sub-activities rated as low or moderate inherent risks with acceptable quality of risk management. Other combinations are possible, for example low inherent risk with a quality of risk management that needs improvement.
Above Average Net Risk	The credit union has weaknesses in its quality of risk management that, although not serious enough to present an immediate threat to solvency, give rise to above average net risk in several of its commercial lending sub-activities. As a result, net risks in its commercial lending sub-activities collectively have an above average probability of an adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have several commercial lending sub-activities rated as moderate inherent risk with a needs improvement quality of risk management. Other combinations are possible, for example, a combination of low inherent risk with weak quality of risk management.
High Net Risk	The credit union has weaknesses in its risk management that may pose a serious threat to its financial viability or solvency and give rise to high net risk in several of the commercial lending sub-activities. As a result, net risks in its commercial lending sub-activities collectively have a high probability of adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have one or more commercial lending sub-activities rated as above average inherent risk with a needs improvement quality of risk management. Other combinations are possible, for example, a combination of moderate inherent risk with weak quality of risk management.

Quality of Risk Management CriteriaPermanent link to this section

The following statements describe the criteria for assessing the adequacy of commercial lending risk management policies and practices of a credit union. The application and weighting of the individual criteria will depend on the nature, scope, complexity, and risk profile of a credit union.

Essential Elements	Criteria
1. Operational Management (First Line of Defence)	Organization and Structure 1.1 Appropriateness of the department (or business unit) organization and structure, given the nature and scope of the commercial lending activity. 1.2 Appropriateness of segregation of duties and operational management’s span of control. 1.3 Extent to which frontline risk decisions are independent from oversight functions and senior management. 1.4 Extent to which legal advice is available to support loan agreements, guarantees, security agreements, and collateral/mortgage documents. 1.5 Adequacy of the risk culture in the department or business unit. Resources, Staffing, and Training 1.6 Adequacy of the commercial lending resources, staffing, and training, given the nature and scope of the commercial lending activity. 1.7 Extent to which staff understand commercial lending and keep current with developments in their area of responsibility, including associated risks, emerging issues, new risk management techniques, and changes in the operating environment impacting the nature and level of risk. 1.8 Appropriateness of staffing for assigned responsibilities and decision-making authorities, both in terms of numbers, skill sets, and experience. 1.9 Extent to which new hires are experienced and have strong analytical skills, knowledge, and expertise in the types of commercial products and services offered, and familiarity with target customer base and geographic market. 1.10 Extent to which operational management have sufficient knowledge and experience on evaluation of commercial lending risks, measurement metrics (both qualitative and non-qualitative), mitigation techniques, stress testing, provisioning/allowances, and identifying signs of poor credit quality and fraudulent activity. 1.11 Extent to which staff are knowledgeable, experienced, and skilled in managing troubled and non-performing loans, workout programs, and subsequent debt collections or foreclosures. 1.12 Appropriateness of the commercial lending staff turnover. 1.13 Adequacy of the staff training programs to support commercial lending knowledge, experience, and skills. Policies, Procedures, and Limits 1.14 Extent to which policies, procedures, and limits are clearly defined, documented, and disseminated. 1.15 Extent to which policies clearly define product lines that the credit union is willing and not willing to enter into. 1.16 Extent to which policies are consistent with commercial lending plans and business objectives. 1.17 Extent to which policies set criteria for new products, services, and ventures or the entry in new geographic regions or jurisdictions. 1.18 Appropriateness of the loan underwriting procedures, risk evaluation methodologies and lending metrics, and the risk-taking decision criteria. 1.19 Extent to which prudential exposures and concentration limits for each sub-activity and the aggregation of them are managed across the whole commercial lending activity. 1.20 Adequacy of the collateral and other risk mitigation techniques for each sub-activity. 1.21 Extent to which the day-to-day controls are commensurate with the level of risk in each sub-activity. 1.22 Appropriateness of exceptions to the underwriting policies and criteria for granting them. 1.23 Appropriateness of the authority levels and any delegation of authority. 1.24 Appropriateness of loan loss provisioning and troubled loan work out practices. Monitoring and Control 1.25 Extent to which adherence to policies, procedures, and limits is monitored and reported. 1.26 Appropriateness of how the nature, characteristics, and quality of products is monitored and reported. 1.27 Extent to which the reporting is sufficiently granular, complete, and accurate. 1.28 Appropriateness of how the performance of the activity is monitored and assessed against plan. 1.29 Extent to which any issues are resolved. Outsourcing 1.30 Extent to which commercial lending processes are outsourced to service providers. 1.31 Extent to which the due diligence procedures and practices are completed prior to entering the outsourcing arrangements. 1.32 Extent to which roles and responsibilities in policies, procedures, and outsourcing agreements are clearly defined, documented, and disseminated. 1.33 Extent to which staff are knowledgeable, experienced, and skilled in managing outsourced activities. 1.34 Adequacy of the outsourcing agreement, including performance measures, reporting requirements, resolution of differences, notifications, complaint handling, contingency planning, inspection rights, confidentiality and security, compensation, insurance, regulatory requirements, and advertising and promotion material. 1.35 Adequacy of the contingency measures for ensuring the continuation of the outsourced activities in the event of problems or events, that affect the delivery of those services. 1.36 Extent to which the outsourcing arrangements are aligned with the commercial lending business plans, objectives, and risk parameters. 1.37 Adequacy of policies and practices in monitoring the performance of the outsourced activities. 1.38 Appropriateness of the reporting, meetings, and periodic reviews to ensure adherence to commercial lending practices and procedure
2. Compliance Management (Second Line of Defence)	2.1 Extent to which compliance management is independent of day-to-day management of risks. 2.2 Adequacy of compliance policies and practices to ensure that the commercial lending approach and practices are in line with credit union industry and regulatory requirements and are appropriate for executing its mandate. 2.3 Extent to which compliance policies and practices cover the following: new products, characteristics of products, IT capability and systems security, outsourcing, on-going staff training, responsible lending, and customer data privacy and protection. 2.4 Extent to which compliance policies and practices keep abreast of new and changing commercial borrowers’ behaviors; new and changing patterns in specific industries’ ethos; and changes in the credit union’s risk profile. 2.5 Extent to which compliance management promptly develop or amend the credit union’s compliance policies as legislation is introduced or amended or as new or changing commercial lending activities impose different legislative requirements on the credit union. 2.6 Extent of which compliance management documents new or amended commercial lending compliance policies and communicate them across the commercial lending staff in a timely manner. 2.7 Extent to which compliance management monitor adherence to applicable laws, regulations, and guidelines by commercial lending staff. 2.8 Adequacy of the compliance reporting to senior management and the board and the practices for resolving significant issues in a timely manner. 2.9 Extent to which commercial lending compliance practices are regularly reviewed for continued effectiveness.
3. Risk Management (Second Line of Defence)	3.1 Extent to which risk management is independent of day-to-day management of commercial lending risks. 3.2 Adequacy of process to regularly review and update risk management policies, processes, and limits to consider changes in the commercial lending environment and in the risk appetite of the credit union. 3.3 Appropriateness of risk management policies, practices, and limits for commercial lending given the credit union’s business activities and related risks. 3.4 Appropriateness of the prudential exposures and concentration limits for each sub-activity and the aggregation of them across the whole commercial lending activity. 3.5 Appropriateness of the measurement and monitoring of risk culture across the commercial lending department (or business unit). 3.6 Extent to which risk management policies and practices for commercial lending are coordinated with the strategic, capital, and liquidity management policies and practices. 3.7 Extent to which risk management policies, practices, and limits for commercial lending are documented, communicated, and integrated with the credit union’s day-to-day operations. 3.8 Adequacy of policies and practices to monitor commercial lending positions against approved limits and for timely follow-up on material variances. 3.9 Adequacy of policies and practices to monitor commercial lending trends, identify emerging risks, and respond effectively to unexpected significant events. 3.10 Adequacy of policies and practices to model and measure the credit union’s commercial lending risks including stress testing. 3.11 Adequacy of the risk management reporting to senior management and the board, and the practices for resolving significant issues in a timely manner. 3.12 Extent to which risk management policies and practices are regularly reviewed for continued effectiveness.
4. Internal Audit (Third Line of Defence)	4.1 Extent to which internal audit staff understand commercial lending and keep current with developments in internal audit practices. 4.2 Extent to which internal audit’s management is experienced in commercial lending, and reviews and oversees the commercial lending internal audit work. 4.3 Adequacy of the internal audit program to verify that commercial lending policies and procedures have been implemented effectively across all activities. 4.4 Appropriateness of the scope and frequency of the audit program based on the level of commercial lending risk exposures. 4.5 Extent to which findings identified and reported in the audit process have been addressed by senior management in a timely and effective manner. 4.6 Extent to which high risk issues are raised to the attention of the board with timely follow up.
5. Senior Management and Board Oversight (Corporate Governance)	Senior Management 5.1 Extent of which the board has delegated to the CEO, the responsibility for developing and implementing commercial lending policies and practices. 5.2 Adequacy of policies and practices delegating responsibilities for developing commercial lending policies and practices from the CEO to other senior managers. 5.3 Appropriateness of the commercial lending mandates for senior management positions and the extent to which they clearly define lines of authority, responsibility, and accountability. Extent to which these mandates are communicated across the credit union. 5.4 Extent to which senior management committees are used to oversee the commercial lending activities. 5.5 Appropriateness of senior management’s commercial lending qualifications, knowledge, skills, and experience. 5.6 Extent to which senior management has a good understanding of the nature, level, and trend of the key risks in the commercial lending activity (by portfolio, portfolio segments and by product), its key controls and how risks relate to allocated capital levels. 5.7 Extent of which senior management have a good understanding of the commercial lending rating system’s design and operations and approve all material aspects of the rating and estimation processes. 5.8 Adequacy of the commercial lending reporting to the board and the practices for resolving significant issues in a timely manner. 5.9 Extent to which compensation programs promote prudent risk-taking in the commercial lending activity and are aligned with long-term strategic objectives. 5.10 Extent to which the management reporting senior management receives is sufficient to fulfill its responsibilities. 5.11 Extent to which the senior management has demonstrated effectiveness in carrying out its duties and managing the commercial lending activities. Board of Directors 5.12 Extent to which the board understands, reviews, and approves the commercial lending aspects of the credit union’s investment and lending policies, and ensures these policies are responsive to changes in the operating environment and supports the credit union’s risk appetite. 5.13 Appropriateness of the board’s knowledge and experience in the commercial lending activity, including the composition of the investment and lending committee. 5.14 Extent to which the board understands, reviews, and approves commercial lending objectives, strategies, and plans. 5.15 Adequacy of the board’s commercial lending reports including relevant metrics, measures and benchmarks, and the extent to which they are provided in a timely manner with clear, accurate, and complete information. 5.16 Extent to which the board understands commercial lending credit risk and the controls to manage this risk as well as other significant risks arising from lending. 5.17 Extent to which the board keeps up to date regarding members’ needs, market trends, emerging risks, competitor activities, and new lending practices. 5.18 Adequacy of the board’s practices to establish and monitor the senior management, involved in commercial lending, including performance, hiring, and fixed and variable compensation. 5.19 Extent to which the board acts independently and has demonstrated effectiveness, in carrying out its direction and oversight of the commercial lending activities.