CECL governance: who proposes, who decides, who approves

CECL governance is the written answer to four questions about one number: who may propose a change to the allowance for credit losses, who may challenge it, who decides, and who approves the result. The agencies do not prescribe the structure, but they do say the board or a committee of it oversees management's judgements, and that the evidence of that oversight is examined. In most banks the chain itself is sound and the record of it is thin — a committee met, the allowance was approved, and the minute that survives cannot show what was questioned. CECL Allowance Management is built around that gap: six agents check, draft and assemble, every factor decision lands on an audit trail with a name and a time, and nothing in the software is allowed to approve anything.

The quarter used throughout is a fictional sample bank in the solution — Ashgrove Plains Bank, $3,618.4M of loans, with an allowance committee of four and an allowance of $47,509K for the third quarter of 2026. The people named are characters. The rules are the agencies' own, linked where they appear.

What does CECL governance mean in practice?

It means that every judgement inside the estimate has an owner, a challenger and a record, and that the three are different things. The interagency policy statement puts the top of the chain where it belongs: "The board of directors, or a committee thereof, is responsible for overseeing management's significant judgments and estimates used in determining appropriate ACLs" (Interagency Policy Statement on Allowances for Credit Losses). Oversight is not the same as approval and neither is the same as preparation; a bank whose chief financial officer prepares the estimate, chairs the committee that approves it and writes the minutes has one act performed three times rather than three acts.

Underneath the board, the useful unit of governance is the individual judgement, not the quarterly total. A qualitative factor that moves from 15 to 35 basis points is a decision with a dollar value, a maker, a reason and a date. An allowance that moves from $44,812K to $47,509K is an outcome. Governance that operates on outcomes approves a number; governance that operates on judgements can be tested, which is what a reviewer actually does.

Who approves the allowance for credit losses?

Management determines it; the board, or a committee the board has delegated to, approves and oversees it; and both halves are examined. The handbook's examination procedure is specific about the timing: "Determine whether ACL policies provide for a board review of management's assessment of the appropriateness of ACLs each quarter before completion of the call report" (Comptroller's Handbook, Allowances for Credit Losses). That sentence rules out two common arrangements — a board that reviews the allowance annually, and a board that reviews it after the regulatory filing has gone.

Between management and the board most banks put a management allowance committee, which is where the real challenge happens and where membership matters. A committee drawn entirely from finance will test the arithmetic; one that includes credit will test whether the factors match what the portfolio is doing. The sample bank's four seats — finance, credit, the controllership and loan review — are a workable minimum, and the quorum rule matters as much as the roster: a committee that can approve with one person present has a quorum rule that does nothing.

What is review and challenge, and what does it leave behind?

Review and challenge is the act of a second party testing management's assumptions before the estimate is approved, and the handbook describes it as part of what board or committee oversight consists of: these activities "may include reviewing and challenging the assumptions used in estimating expected credit losses and designing and executing effective internal controls over the credit loss estimation methods" (Comptroller's Handbook, Allowances for Credit Losses).

The word that carries the weight is challenge. A committee that receives a package, asks two clarifying questions and approves has reviewed. A committee that asks why the office collateral factor doubled when the national index barely moved, hears the answer, and either accepts it or sends it back has challenged. The difference is visible only in what is written down, which is why challenge and the record of it are, for practical purposes, the same control.

A useful discipline is to make the challenge visible in the package before the meeting. The sample bank's memo lists each proposed change with its tag — a source that has gone stale, a factor the model already carries, a factor moving against its own trend — so the committee arrives knowing which three of the quarter's six changes are contestable and why. The one that most often is contestable is the removal; the factor the model already carries is worked through there.

What should allowance committee minutes contain?

Enough for someone who was not in the room to re-perform the committee's judgement. The clearest statement of the standard comes from the other side of the table. In its review of bank audits, the PCAOB found that "some auditors limited their review to obtaining and reading copies of committee meeting minutes that did not provide sufficient detail to allow the auditor to evaluate the design and operating effectiveness of the control" (PCAOB, Spotlight: Bank Financial Reporting Audits).

Read that as a specification rather than a criticism. If the minute cannot show the control operating, the control did not operate as far as the file is concerned, however well the meeting actually went. Six things close that gap, and none of them lengthens a minute by more than a paragraph.

The committee package, the approval list and the minutes, in one place

The assembler never marks anything approved — the committee's vote is recorded by name and time.

How often should the board review the allowance?

Every quarter, before the regulatory filing goes. That is the examination procedure quoted above, and the reason behind it is that the allowance is the estimate most exposed to management judgement in the financial statements; a board that sees it after the filing is reviewing a decision it cannot change. For a credit union the cadence is the same and the supervisory attention is current: the NCUA's 2026 priorities name, among the lending areas examiners may review, "the sufficiency of credit administration, including loan underwriting, loss mitigation programs (including loan modifications and workouts), Allowance for Credit Loss reserves and methodologies, and charge-off practices" (NCUA Letter to Credit Unions 26-CU-01).

What the board sees matters as much as how often. A single page showing the allowance, the change from last quarter with its causes, the qualitative share, the ratios and the sensitivity gives a non-executive something to challenge. A twelve-page appendix of segment tables does not. And the oversight is itself evidence: "Evidence of the board of directors' oversight activities is subject to review by examiners" (Interagency Policy Statement on Allowances for Credit Losses), which is a reminder that the board's minute is part of the allowance file, not a separate corporate record.

Who can change a qualitative factor — and who cannot

One named person, under the policy, on the evidence, with the change recorded. In the sample bank that is the allowance manager, and the rule is absolute in both directions: no agent sets a factor, and no one else accepts one. The analyst who prepares the schedules cannot move a cell; the committee can send a factor back but does not edit it in the meeting; the Controller approves changes to the rules rather than to the factors themselves.

The rejection path is the one worth building carefully, because it is where governance usually leaks. If rejecting a proposed change simply leaves the cell as it was, the file shows nothing and the examiner sees a factor that did not move. If a rejection is itself a decision — the prior level is kept, a written reason is attached, and the whole thing lands on the audit trail with a name and a time — then the quarter in which nothing changed is as well evidenced as the quarter in which everything did. That is the harder half of the support one factor owes.

Eighty-one cells, six proposed changes, and one person who may accept them

Where software stops: proposing is not deciding

The line that matters when agents enter a close is not technical but constitutional. Software may read, check, calculate, draft and assemble. It may not set an assumption, approve an outcome or post an entry. Those three are the acts a policy assigns to a person, and the reason has nothing to do with capability: an act that cannot be attributed to a named person cannot be challenged, and an estimate whose judgements cannot be challenged is not governed.

Written into a product, the line becomes a list of limits rather than a principle. The reconciler never posts or changes a journal entry. The forecast reader never chooses scenarios or weights. The trend analyst never changes a risk grade. The support writer never sets a factor and never exceeds the caps. The bridge builder never forces the bridge to tie; where there is an unexplained difference it shows it. The assembler never marks anything approved and never sends the package without the allowance manager. Each limit is negative, which is what makes it testable — a reviewer can look for the thing that should never appear.

What belongs in a CECL policy, and what belongs in a setting

A policy should carry the things that must not change quietly: who is on the committee and what its quorum is, who may accept a factor change, who approves the rules, what the board sees and when, the methodology by segment, and the principle that no factor may repeat something the model already carries. These are statements about authority, and a change to any of them is a change to the control environment.

A parameter is different. When a source goes stale, the cap on one factor, the cap on a segment, the concentration reference, the forecast horizon and the threshold above which a loan is individually evaluated are all numbers that should be reviewable, versioned and approved — but burying them in a policy document means they are revised once a year regardless of what the evidence says. The workable split is to name the parameter in the policy, state who approves a change to it, and hold the value where its history is visible.

The rules the factors are tested against, each with its own history

The audit trail the examiner reads before the memo

A memo is an argument; an audit trail is what happened. An experienced examiner or validator reads the second first, because the order in which decisions were taken often says more than the conclusion. A factor that was proposed on Monday, rejected on Tuesday, re-proposed at a different level on Wednesday and accepted on Thursday tells a story the memo will not. So does a quarter in which every proposed change was accepted without exception, and so does one in which the only changes accepted were the ones that lowered the allowance.

The policy statement sets the examiner's standing to look: "Management's evaluations are subject to review by examiners" (Interagency Policy Statement on Allowances for Credit Losses). The practical consequence is that a decision log should be designed to be read by someone sceptical, which means it has to keep the decisions that were not taken, carry a time as well as a date, and be impossible to edit after the fact. In the sample bank every factor decision — accepted, changed or rejected — goes to the trail, the trail goes into the evidence binder, and the external auditor sees the binder read-only from the day the package is final. What the auditor then does with it is the request list, item by item.

To see the chain run on one quarter — the proposals, the decisions, the votes by name and the trail underneath — start from CECL Allowance Management.

Questions people ask

Does the board have to approve the allowance, or just oversee it?

The policy statement makes the board, or a committee of it, responsible for overseeing management's significant judgements and estimates. The OCC's examination procedures go further on timing, asking whether policies provide for a board review of management's assessment each quarter before the call report is completed. Many banks delegate the detailed challenge to a management committee and keep a quarterly board review above it.

Can the same person prepare and approve the allowance?

It defeats the control. Preparation, challenge and approval are three different acts, and a reviewer tests whether they were performed by different people. Where a small institution cannot fully separate them, the usual answer is to strengthen what is compensating — an independent reviewer of the estimate, a credit officer outside finance on the committee, and minutes detailed enough to show the challenge actually happened.

What happens when a proposed factor change is rejected?

The prior level stands and the rejection is recorded as a decision with its reason, not as an absence; if the committee disagrees, it sends the factor back to the person who decides rather than editing it in the meeting. This matters because the file has to explain the factors that did not move as well as the ones that did; a cell that stayed at 15 basis points for four quarters with no written reason is indistinguishable, in a review, from one nobody looked at.

How detailed do allowance committee minutes have to be?

Detailed enough that someone who was not present can see the control operating: who attended, what they were given and when, what was challenged and by whom, what changed, and who voted which way. The PCAOB has reported auditors who could not evaluate the design and operating effectiveness of a control from the minutes they were given, which is the practical test to write against.

Can an agent set a qualitative factor?

Not in a governed process. Software can test a factor against this quarter's data, flag a stale source or a driver the model already carries, draft the support and price the change — all of which is preparation. Setting the factor is a judgement that has to be attributable to a named person, because an unattributable judgement cannot be challenged or examined.

Who is accountable when a third party does part of the work?

The board and senior management remain accountable. The OCC's handbook states that a bank's use of third parties does not diminish their responsibility to ensure the activity is performed in a safe and sound manner and complies with applicable laws and regulations. In an allowance context that covers vendor models, outsourced validations and any software that prepares the estimate.