Retail Lending Assessment Criteria

Description of Line of Business ActivityPermanent link to this section

Retail lending involves extending credit to individuals, such as the following sub-activities: residential mortgages, credit cards, home equity lines of credit (“HELOC”), consumer lines of credit, automobile loans, and other consumer lending. Retail lending may include a mix of these sub-activities so long as the risk attributes are alike, and these risks are managed in the same manner.

Definition of Net RiskPermanent link to this section

The net risk of retail lending is determined by assessing the risks inherent in the activity and then the effectiveness with which those risks are being managed.

The primary inherent risk in retail lending is credit risk; however, operational, compliance, and strategic risks may also be considered as secondary risks. These inherent risks are mitigated by operational management, oversight functions, senior management, and the board of directors.

A credit union’s net risk for retail lending is assessed as low, moderate, above average, or high.

Low Net Risk	The credit union has risk management that substantially mitigates risk inherent in its retail lending activities down to levels that have lower than average probability of an adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have a predominance of retail lending sub-activities with low inherent risks and acceptable quality of risk management. Other combinations are possible; for example, moderate inherent risk with strong quality of risk management.
Moderate Net Risk	The credit union has risk management that sufficiently mitigates risks inherent in its retail lending activities down to levels that collectively have an average probability of adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have a predominance of retail lending sub-activities rated as low or moderate inherent risks with acceptable quality of risk. Other combinations may be possible; for example, low inherent risk with a quality of risk management that needs improvement.
Above Average Net Risk	The credit union has weaknesses in its quality of risk management that, although not serious enough to present an immediate threat to solvency, give rise to above average retail lending net risk in several of its sub-activities. As a result, net risks in its retail lending collectively have an above average probability of an adverse impact on the earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have several the retail lending sub-activities rated as moderate inherent risk with a needs improvement quality of risk management. Other combinations are possible; for example, a combination of low inherent risk with weak quality of risk management.
High Net Risk	The credit union has weaknesses in its risk management that may pose a serious threat in its financial viability or solvency and give rise to high net risk in several of the retail lending sub-activities. As a result, net risks in its sub-activities collectively have a high probability of material adverse impact on its earnings, capital, and liquidity in the foreseeable future. Normally, credit unions in this category will have one or more retail sub-activity rated as above average inherent risk with a quality of risk management that needs improvement. Other combinations are possible, for example, a combination of moderate inherent risk with weak quality of risk management.

Quality of Risk Management CriteriaPermanent link to this section

The following statements describe the criteria for assessing a credit unions’ adequacy of retail lending risk management policies and practices. The application and weighting of the individual criteria will depend on the nature, scope, complexity, and risk profile of a credit union.

Essential Elements	Criteria
1. Operational Management (First Line of Defence)	Organization and Structure 1.1 Appropriateness of the department (or business unit) organization and structure given the nature and scope of the retail lending activity. 1.2 Appropriateness of segregation of duties and operational management’s span of control. 1.3 Extent to which front-line risk decisions are independent from oversight functions and senior management. 1.4 Extent to which legal advice is available to support loan agreements, guarantees, and collateral/mortgage documents. 1.5 Adequacy of the risk culture in the department or business unit. Resources, Staffing and Training 1.6 Adequacy of the retail lending resources, staffing, and training given the nature and scope of the retail lending activity. 1.7 Extent to which staff understand retail lending and keep current with developments in their area of responsibility, including associated risks, emerging issues, and new risk management techniques, as well as changes in the operating environment impacting the nature and level of risk. 1.8 Appropriateness of staffing for assigned responsibilities and decision-making authorities, both in terms of numbers, skill sets, and experience. 1.9 Extent to which new hires are experienced individuals having strong analytical skills, knowledge, and expertise in the types of retail lending products and services offered and familiarity with target customer base and geographic market. 1.10 Extent to which operational management have sufficient knowledge and experience on purchase/sale terminology, appraisals, credit bureau issues, and employment matters, and are able to identify signs of poor credit quality and fraudulent activity. 1.11 Extent to which staff are knowledgeable, experienced, and skilled in managing troubled and non-performing loans and subsequent debt collections or foreclosures. 1.12 Appropriateness of the retail lending staff turnover. 1.13 Adequacy of the staff training programs to support retail lending knowledge, experience, and skills. Policies, Procedures and Limits 1.14 Extent to which policies, procedures, and limits are clearly defined, documented, and disseminated. 1.15 Extent to which policies clearly define product lines that the credit union is willing and not willing to enter into. 1.16 Extent to which policies are consistent with retail lending plans and business objectives. 1.17 Extent to which policies set criteria for new products, services, and ventures or for entry in new geographic regions or jurisdictions. 1.18 Appropriateness of the loan underwriting procedures, risk evaluation methodologies, lending metrics and the risk-based decision-making criteria. 1.19 Extent to which prudential exposures and concentration limits for each sub-activity are managed, and in aggregate, across the whole retail lending activity. 1.20 Adequacy of the collateral and other risk mitigation techniques for each sub-activity. 1.21 Extent to which the day-to-day controls are commensurate with the level of risk in each sub-activity. 1.22 Appropriateness of exceptions to the underwriting policies and criteria for granting them. 1.23 Appropriateness of the authority levels and any delegations of authority. 1.24 Appropriateness of loan loss provisioning and troubled loan work out practices. Monitoring and Control 1.25 Extent of adherence to policies, procedures and limits is monitored and reported. 1.26 Appropriateness of how the nature, characteristics and quality of products is monitored and reported. 1.27 Extent to which the reporting is sufficiently granular, complete and accurate. 1.28 Appropriateness of the performance of the activity is monitored and assessed against plan. 1.29 Extent to which any issues are resolved. Outsourcing 1.30 Extent to which retail lending processes are outsourced to service providers. 1.31 Extent to which the due diligence procedures and practices are completed prior to entering the outsourcing arrangements. 1.32 Extent to which roles and responsibilities in policies and procedures and outsourcing agreements are clearly defined, documented, and disseminated. 1.33 Adequacy of the outsourcing agreement, including performance measures, reporting requirements, resolution of differences, notifications, complaint handling, contingency planning, inspection rights, confidentiality and security, compensation, insurance, regulatory requirements and advertising and promotion material. 1.34 Adequacy of the contingency measures for ensuring the continuation of the outsourced activities in the event of problems or events that affect the delivery of those services. 1.35 Extent to which the outsourcing arrangements are aligned with the retail lending business plans, objectives and risk parameters. 1.36 Adequacy of policies and practices in monitoring the performance of the outsourced activities. 1.37 Appropriateness of the reporting, meetings, and periodic reviews to ensure adherence to retail lending practices and procedures.
2. Compliance Management (Second Line of Defence)	2.1 Extent to which compliance management is independent of day-to-day management of risks. 2.2 Adequacy of compliance policies and practices to ensure that the retail lending approach and practices are in line with credit union industry and regulatory requirements and are appropriate for executing its mandate. 2.3 Extent to which compliance policies and practices cover the following: new products, characteristics of products, IT capability and systems security, outsourcing, on-going staff training, responsible lending and customer data privacy and protection. 2.4 Extent to which compliance policies and practices keeps abreast of new and changing retail borrowers’ behaviors and changes in the credit union’s risk profile. 2.5 Extent to which compliance management promptly develop or amend the credit union’s compliance policies as legislation is introduced or amended or as new or changing retail lending activities impose different legislative requirements on the credit union. 2.6 Extent to which compliance management documents new or amended retail lending compliance policies and communicate them across the retail lending staff on a timely basis. 2.7 Extent to which compliance management monitor adherence to applicable laws, regulations, and guidelines by retail lending staff. 2.8 Adequacy of the compliance reporting to senior management and the board, and the practices for resolving significant issues in a timely manner. 2.9 Extent to which retail lending compliance practices are regularly reviewed for continued effectiveness.
3. Risk Management (Second Line of Defence)	3.1 Extent to which risk management is independent of day-to-day management of retail lending risks. 3.2 Adequacy of the process to regularly review and update risk management policies, processes, and limits to consider changes in the retail lending environment and in the risk appetite of the credit union. 3.3 Appropriateness of the risk management policies, practices, and limits for retail lending, given the credit union’s business activities and related risks. 3.4 Appropriateness of the prudential exposures and concentration limits for each sub-activity, and in aggregate, across the whole retail lending activity. 3.5 Appropriateness of the risk culture across the retail lending department (or business unit). 3.6 Extent to which risk management policies and practices for retail lending are coordinated with the strategic capital and liquidity management policies and practices. 3.7 Extent to which risk management policies, practices and limits for retail lending are documented, communicated, and integrated with the credit union’s day-to-day operations. 3.8 Adequacy of policies and practices, to monitor retail lending positions against approved limits and for timely follow-up on material variances. 3.9 Adequacy of policies and practices, to monitor retail lending trends, identify emerging risks, and respond effectively to unexpected significant events. 3.10 Adequacy of policies and practices, to model and measure the credit union’s retail lending risks, including stress testing. 3.11 Adequacy of the risk management reporting to senior management and the board, and the practices for resolving significant issues in a timely manner. 3.12 Extent to which risk management policies and practices are regularly reviewed for continued effectiveness.
4. Internal Audit (Third Line of Defence)	4.1 Extent to which internal audit staff understand retail lending and keep current with developments in internal audit practices. 4.2 Extent to which internal audit’s management is experienced in retail lending and reviews and oversees the retail lending internal audit work. 4.3 Adequacy of the internal audit program to verify that retail lending policies and procedures have been implemented effectively across all activities. 4.4 Appropriateness of the scope and frequency of the audit program based on level of retail lending risk exposures. 4.5 Extent to which findings identified and reported in the audit process have been addressed by senior management in a timely and effective manner. 4.6 Extent to which high risk issues are raised to the attention of the board with timely follow up.
5. Senior Management and Board Oversight (Corporate Governance)	Senior Management 5.1 Extent to which the board has delegated responsibility for developing and implementing retail lending policies and practices to the CEO. 5.2 Adequacy of policies and practices delegating responsibilities for developing retail lending policies and practices from the CEO to other senior managers. 5.3 Appropriateness of the retail lending mandates for senior management positions and the extent to which they clearly define lines of authority, responsibility, and accountability. Extent to which these mandates are communicated across the credit union. 5.4 Extent to which senior management committees are used to oversee the retail lending activities. 5.5 Appropriateness of senior management’s retail lending qualifications, knowledge, skills, and experience. 5.6 Extent to which senior management has a good understanding of the nature, level, and trend of the key risks in the retail lending activity (by portfolio, portfolio segments and by product), its key controls and how risk relate to allocated capital levels. 5.7 Extent to which senior management have a good understanding of the retail lending rating system’s design and operations and approve all material aspects of the rating and estimation processes. 5.8 Adequacy of the retail lending reporting to the board and the practices for resolving significant issues in a timely manner. 5.9 Extent to which compensation programs promote prudent risk-taking in the retail lending activity and are aligned with long-term strategic objectives. 5.10 Adequacy of policies and practices for significant retail lending outsourcing arrangements and the extent to which senior management ensures the outsourcing is aligned with the credit union’s retail lending strategy and risk management policies. 5.11 Extent to which the management reports that senior management receives, is sufficient to fulfill its responsibilities. 5.12 Extent to which the senior management has demonstrated effectiveness, in carrying out its duties and managing the retail lending activities. Board of Directors 5.13 Extent to which the board understands, reviews, and approves the retail lending aspects of investment and lending policies and ensures these policies are responsive to changes in the operating environment and supports the credit union’ risk appetite. 5.14 Appropriateness of the board’s knowledge and experience in the retail lending activity, including the composition of the investment and lending committee. 5.15 Extent to which the board understands, reviews, and approves retail lending objectives, strategies, and plans. 5.16 Adequacy of the board’s retail lending reports, including relevant metrics, measures, and benchmarks, and are provided with timely, clear, accurate, and complete information. 5.17 Extent to which the board understands retail lending credit risk and the controls to manage this risk as well as other significant risks arising from lending. 5.18 Extent to which the board keeps up to date regarding members’ needs, market trends, emerging risks, competitor activities, and new lending practices. 5.19 Adequacy of the board’s practices to establish and monitor the senior management, involved in retail lending, including performance, hiring, and fixed and variable compensation. 5.20 Extent to which the board acts independently and has demonstrated effectiveness, in carrying out its direction and oversight of the retail lending activities.