Anyone searching for bank risk management software to handle credit concentrations is really shopping for reporting accuracy, and the OCC says why in one sentence: management information systems "that produce inaccurate reporting can provide a false sense of security and erroneously focus attention on lower-risk pools". A concentration report is a number about a pool, and the pool only exists because somebody decided which loans belong in it. Get that wrong and the software has not failed loudly — it has quietly pointed the bank's attention at the wrong industry. So every question worth asking a vendor is a question about evidence: does the number tie to the general ledger, does a classification cite the page it came from, does a person still confirm it, and can the whole thing be replayed on last quarter's book and scored. Botminds' Credit Concentration Risk Monitoring is built to answer those four in that order.
The figures below that come from the product are marked for what they are: the bank, the borrowers and the loans are fictional sample data in the solution, two numbers are design targets rather than measured results, and nothing here is a customer's outcome. Everything attributed to a regulator is quoted and linked.
Three numbers to hold any vendor to — and what each one actually is
3s
from a loan funding to every limit it touches re-tested — the design target
31
board limits on one map, re-tested on every funding — the design target
$1M
the difference against the general ledger above which a break is reported — the threshold in the sample bank’s configuration
What should bank risk management software do about concentrations?
Five things, and they are in a strict order, because each one is worthless if the one before it is wrong.
Aggregate. Pull every obligation from the core — funded loans, undrawn commitments, letters of credit, acceptances, leases, guarantees — and add the related and contingent exposure of each obligor group. The OCC's definition of what counts is long on purpose, and a product that aggregates only funded commercial loans is measuring a narrower thing than the bank is examined on.
Classify. Put each borrower in an industry, a region, a collateral type and, where it lends rather than borrows for its own operations, a Call Report category. This is where accuracy is won or lost.
Measure. Express each pool against the capital base the board chose, on the basis the board chose, with the arithmetic visible.
Test. Compare every pool with its limit, continuously rather than at quarter end, and test proposals before they are approved rather than after they fund.
Report. Produce what the board and the examiner read, with each figure traceable to the limit, case or schedule behind it. The OCC's own standard for this is not "complete" but "accurate and timely": data accuracy and timeliness issues "hinder the usefulness of management and board reports".
Three of those five are arithmetic — aggregating, measuring, testing — and two need judgement: classifying, and reporting in a way an examiner can trace. A vendor who talks only about the arithmetic is selling a calculator.
Twelve questions to ask before you buy
Each of these has an answer that should end the conversation, and a plausible answer that should start a harder one.
Twelve questions, and what a weak answer sounds like
- 1. Where does exposure come from, and how often?
A nightly extract is a quarterly report with extra steps. Ask whether a funding, a line increase, an amendment and a paydown each arrive on their own, and what happens between arrivals.
- 2. Does it tie to the general ledger, and what happens when it does not?
A product with no tie-out has no way of knowing it is wrong. Ask for the difference threshold, who is told, and where the unreconciled days are visible.
- 3. What is counted as exposure — commitments or outstandings?
Both, as a setting, with the choice recorded per pool. A product that only counts drawn balances will under-report a book of undrawn lines by whatever is undrawn.
- 4. Does it carry contingent and related exposure, or only loans?
Letters of credit, acceptances, guarantees and the obligor group. Ask to see one borrower whose related exposure sits in a different pool from its own.
- 5. Where does an industry code come from?
The right answer names a document — the tax return, the financial statements — not a lookup on the borrower’s name. Ask what it does when its answer and the relationship manager’s disagree.
- 6. Can it put a non-bank lender in the right Call Report category?
Ask it to read a borrowing base and apply the more-than-50-percent test, then ask where the page and the passage are shown.
- 7. Who confirms a classification before it counts?
A named seat, with the booked code still visible beside the proposed one, and a reason recorded when the booked code is kept.
- 8. Can it test a proposal before the committee votes?
Not "would this fit" but "how much of this fits, against every limit it touches, today" — with the answer attachable to the credit memo.
- 9. Are limits data, or are they code?
The board owns the numbers. Ask to change a limit, a capital base and a near-limit warning in front of you, and ask who may do it and where the old version went.
- 10. What does it do at a crossing, and on whose clock?
Who is told, within how long, and whether the escalation times are the bank’s own policy or the product’s assumption.
- 11. What can it not do without a person?
The useful answer is a list of refusals: never waive or move a limit, never commit the bank, never file or send. A product with no such list has not decided where judgement sits.
- 12. Can it be replayed on last quarter’s closed book, and scored?
The only question that produces evidence rather than opinion. If the answer is no, every other answer stays a claim.
Question twelve is the one that converts the other eleven from claims into evidence, and it is the reason the rest of this guide is mostly about testing rather than about features.
Does bank risk management software connect to the core banking system, and tie to the general ledger?
Connecting is easy and ties are rare. Almost any product can read a nightly extract. Far fewer will tell you, every morning, whether the totals they are reporting still agree with the bank's own books — and that is the difference between a system of record and a spreadsheet with a login.
The OCC's data expectation is blunt about why both halves matter: "Identifying, measuring, monitoring, and controlling concentration risk depends on accurate and timely data. The absence of a sufficiently robust set of data elements can hinder a bank's ability to identify, measure, monitor, and control concentration risk, regardless of the data's accuracy and timeliness. Similarly, a comprehensive data set is of little use if inaccurate, untimely, or unvalidated" (OCC, Concentrations of Credit, version 3.0). Breadth without accuracy and accuracy without breadth both fail.
In the sample bank, exposure is posted from the core as each loan is booked, funded or paid down, tied to the general ledger every night, and a difference above $1 million is reported rather than absorbed. The aggregator never edits core data: if the two disagree, the disagreement is the output. That is the behaviour to test for, and the way to test it is to ask what the product did on the worst night of last quarter, not what it does on a clean one.
One funding, step by step, with what each step found
How accurate is automated industry classification, and how would you know?
Nobody can honestly answer the first half in a sales meeting, and a vendor who gives you a single percentage has told you something about their marketing rather than about your book. Accuracy on industry codes is a property of the pair — this classifier, your borrowers — and the only way to learn it is to measure it on your borrowers.
The reason it is hard is that there are four different failures hiding under one word. A code can be wrong because the borrower's business changed and nobody re-coded it; because it was typed to satisfy a required field at origination; because the holding company and the operating company sit in different industries; or because the right answer genuinely depends on how finely the bank segments. The OCC itself sidesteps the last of these: examiners use a taxonomy of NAICS codes at a granularity chosen for the bank, and "may also identify concentrations in the ROE that do not correspond to specific NAICS codes when circumstances warrant".
Where classification disagreements come from, in the order they are worth hunting
- A stale relationship-manager code
Correct when it was entered, wrong since the borrower bought a business, sold a division or changed what it does. Nothing in the core makes anyone revisit it.
- A name-only guess
A code inferred from the legal name. Names are designed to be reassuring, not descriptive, and a fund-sounding name says almost nothing about what the borrower lends against.
- Related exposure that was never joined up
A guarantee from the same owner to a different entity, in a different industry. Each loan is coded correctly and the group is still mis-measured.
- Undrawn lines left out
A pool measured on drawn balances looks smaller than the same pool measured on commitments, and the gap grows exactly when borrowers are stressed and draw.
- Segmentation that is too coarse to see the pool
A single transportation code hides the difference between long-distance truckload, local delivery and leasing companies, which do not move together.
The product-side answer is not a better guess but a different act: read the borrower's own documents. In the sample bank, the mapper assigns an industry from the tax return and the financial statements, keeps the relationship manager's code beside its own, and flags the difference rather than overwriting it. A disagreement becomes a question for a person instead of a silent correction, and that is the only version of this that survives an examination.
Can software classify loans to nondepository financial institutions?
It can read the documents and apply the test. It cannot decide. The Call Report's own definition is why: the five non-bank lender categories turn on what the borrower lends against, and the instructions set a numeric test — a lender belongs with the mortgage credit intermediaries, for instance, when more than half of its assets or lending activities are residential or commercial mortgages (FFIEC 031 and 041 instructions, Schedule RC-C Part I). That is a reading task over a borrowing base, a credit agreement or an offering memo, and nothing in a borrower's name answers it.
The sample bank's case makes the point better than an argument. A $250 million line to Bluewater Funding II LLC, booked as business credit, was re-read: the 148-page credit agreement, Amendment No. 3 and the borrowing base certificate of 30 September showed $222.4 million of $312.4 million eligible receivables — 71.2 percent — to be retail auto installment contracts. That makes it a consumer credit intermediary, and moving it would take consumer lenders to 98.4 percent of their 30 percent sub-limit. The classifier proposed the category with the passage and the page; it did not change anything. The full taxonomy and its traps are worked through category by category elsewhere in this series.
The facility check: the figures, the test and the passage, waiting for a person
Who confirms a classification, and what the confirmation has to show
A confirmation is worth exactly as much as what it records. Three things make it evidence rather than a click: the proposed category with the figures and the passage it rests on, the booked code still visible beside it, and a reason when the booked code is kept. The third is the one products skip. An analyst who agrees with the proposal leaves a thin trail; an analyst who overrules it leaves none at all unless the product insists, and overrides are precisely where a reviewer will look first.
Re-checking matters as much as checking. A classification is a statement about a borrower on a date, and borrowers change. The sample bank's classifier re-reads on every amendment and every new borrowing base, which is how a line that went from $100 million to $250 million on a Friday gets looked at again on the Monday rather than at the next Call Report.
Does it test a proposal before the committee votes?
This is the question that separates monitoring from control, and most products do not pass it. Reporting what happened is useful. Telling the credit committee, before it votes, how much of a $28 million line fits inside every limit it touches today is the thing that stops the next breach.
The distinction matters because breaches at well-run banks are not approval failures; they are sequencing failures. Each deal fits when it is approved, then other deals in the same pool fund between approval and funding, and nobody adds them up. On the sample book, five proposals went to one Wednesday committee, each tested against every limit it touches: with a planned participation assumed closed, a $28 million equipment line would still take truck transportation to 108.9 percent of its limit, and $10.8 million of it fits. The test is written as a note and attached to the credit memo, so the vote happens against a number.
Which limits are nearest their line on one morning — the view a committee should vote against
What the second line will ask: validation, overrides and drift
Whoever buys this, independent risk review and internal audit will have to form a view on it, and their questions are not the first line's. The handbook points at the first of them: internal audit usually puts the accuracy of reporting inside the scope of its credit audits, a point the guide to the OCC booklet reads alongside the examiner's questionnaire. Testing that a report was produced tests the calendar. Testing that it was right tests the product.
Three things make that review possible. Reproducibility — can a figure from the October report be regenerated in January and come out the same, with the same inputs? Override visibility — can a reviewer list every place a person disagreed with a proposed classification, with the reasons, and see whether the disagreements cluster on one analyst or one industry? Drift — are classifications re-examined when a borrower amends, or do they age quietly until the next full review? A product that cannot show the first two will push the whole validation burden back onto the bank, and a product that does not do the third will be accurate on the day it is installed and stale a year later.
The board's own version of this question is shorter. The Director's Reference Guide tells directors to ask: "How are risk exposures aggregated to allow for identifying concentrations at the bank level, across lines of business, and between legal entities?" (OCC, Director's Reference Guide). If the honest answer involves a monthly spreadsheet merge, the software has not solved the problem it was bought for.
The board's numbers as settings, not as code
What a demonstration should show, and what no demonstration can prove
A demonstration can show behaviour. It cannot show accuracy, because accuracy is a property of your book and the demonstration is running on someone else's. Keeping that line straight saves a long evaluation from ending in an argument.
What passes a demonstration, beside what would actually prove the product
Passes a demonstration: A dashboard of pools against limits, refreshed on cue.
Proves the product: A figure that agrees with your general ledger on a stated night, and a visible break when it does not.
Passes a demonstration: An industry code appearing next to every borrower.
Proves the product: A code with the document and page it was read from, your relationship manager’s code beside it, and a scored disagreement rate on your own closed book.
Passes a demonstration: Five categories with borrowers in them.
Proves the product: One borrowing base read in front of you, the more-than-50-percent test applied to its numbers, and the passage cited.
Passes a demonstration: Limits configured before the meeting.
Proves the product: A limit, a capital base and a warning threshold changed live, with the old version still retrievable and the change attributable.
Passes a demonstration: A red tile and an alert.
Proves the product: A case with the cause loan by loan, options priced against every limit they touch, and an approval by a named person on the bank’s own clock.
Passes a demonstration: A board report exported as a document.
Proves the product: A board report in which each number names the limit, case or schedule it came from, and a corrected Call Report schedule with the documents behind each move.
The replay test: how to score any of this on your own book, before you buy
- Take a quarter that is closed and reported. Last quarter, after the Call Report was filed, so the answers are settled and nobody is guessing.
- Build the truth file. The industry code, region, collateral type, obligor group and — for non-bank lenders — the Call Report category your bank actually reported, for a sample that deliberately over-weights the hard cases: fund-like names, holding companies, borrowers who amended, anything whose line grew.
- Hide the answers and replay the quarter. Give the product the same extracts and the same documents your analysts had, in the same order, and let it classify and measure.
- Score field by field, not as one number. Industry, region, obligor group and Call Report category each have their own disagreement rate, and they will not be close to each other.
- Separate three kinds of disagreement. The product was wrong; the bank's booked answer was wrong; and the question was genuinely arguable. The second pile is often the largest, and it is the one that pays for the project.
- Count what a person had to settle, and how long it took. The useful figure is not accuracy alone but how much analyst time the residue costs each quarter.
- Re-run the limit tests on the same closed book. Every pool, against the limits in force on each date. Any crossing nobody saw at the time is the business case, in one line.
Two honest caveats. A replay flatters any product slightly, because the documents were filed in a tidy pile rather than arriving over eleven weeks. And a replay cannot test the thing that matters most in production — what happens at 10:14 on a Monday when a loan funds — because the quarter you are replaying has already ended. Watch for both, and the test is still the best evidence available before a contract.
Where this product fits is narrow and worth saying plainly: it monitors concentrations by industry, out-of-footprint region, collateral, trade-exposed borrowers, leveraged loans, shared national credits and non-bank lenders. Commercial real estate concentration, which has its own supervisory framework and its own stress testing, is a different solution. The cost side of the same decision — what the quarterly report costs today, four ways — is set out separately. To run the replay against your own closed quarter, start from Credit Concentration Risk Monitoring.
Questions people ask
What should bank risk management software do about concentrations?
Aggregate every obligation from the core including undrawn and contingent exposure, classify each borrower by industry, region, collateral and Call Report category, measure each pool against the board's capital base, test every pool against its limit continuously and every proposal before it is approved, and report with each figure traceable to its source. The OCC's standard for the last of those is accuracy and timeliness together, not completeness.
How do you test concentration risk software before buying it?
Replay a closed quarter. Build a truth file from what the bank actually reported, hide it, give the product the same extracts and documents your analysts had, and score industry, region, obligor group and Call Report category separately. Then re-run the limit tests across that quarter and see whether anything was crossed that nobody noticed at the time.
How accurate is automated industry classification?
It depends entirely on the book, so any single published figure should be treated as marketing. What can be assessed is the method: a classifier that reads the borrower's tax return and financial statements has a defensible basis, one that infers from the legal name does not, and one that keeps the relationship manager's code beside its own lets a person settle the difference instead of hiding it.
Can software classify loans to nondepository financial institutions for the Call Report?
It can read the borrowing base, credit agreement or offering memo and apply the instructions' own test — whether more than 50 percent of the borrower's assets or lending activities fall in one category — and show the figures and the passage behind its answer. It should not finalise the category. In practice a credit risk analyst or the director confirms before the classification counts in a limit or a filed schedule.
What evidence does an examiner want about risk reporting?
That the figures are accurate and timely, that the limits are meaningful and the bank's own, and that reporting has been independently reviewed. For a listed concentration the FDIC's report instructions ask examiners to "describe the methodology used by the institution to identify and monitor exposure to this specific concentration", so the method itself — and not only the number — is part of what is examined.
Does it cover commercial real estate concentration?
No. Commercial real estate has its own interagency guidance, its own 100% and 300% screens and its own stress testing, and it is handled by a separate solution, CRE Concentration and Stress Testing. Credit Concentration Risk Monitoring covers industries, out-of-footprint regions, collateral, trade-exposed borrowers, leveraged loans, shared national credits and non-bank lenders, against the same capital base.